Merge pull request #180 from image-rs/issue-image-1410-panic

HeroicKatora · web-flow · commit ff16c659a8b5 · 2021-01-27T08:31:29.000+01:00
Issue image 1410 panic
diff --git a/src/decoder.rs b/src/decoder.rs
@@ -409,6 +409,10 @@ impl<R: Read> Decoder<R> {
             previous_marker = marker;
         }
 
+        if self.frame.is_none() {
+            return Err(Error::Format("end of image encountered before frame".to_owned()));
+        }
+
         let frame = self.frame.as_ref().unwrap();
 
         // If we're decoding a progressive jpeg and a component is unfinished, render what we've got
diff --git a/tests/crashtest/images/README.md b/tests/crashtest/images/README.md
@@ -7,3 +7,4 @@ derive-huffman-codes-overflow.jpg | Found by Pascal Hertleif (@killercup) while
 missing-sof.jpg           | Found by Corey Farwell (@frewsxcv) when fuzz testing
 extraneous-bytes-after-sos.jpg | Scan from brother DSmobile 920DW provided by Filip Lundborg (@filipl)
 missing-sos.jpg           | Generated in GIMP and manually edited by John Reynolds (@quilan1)
+missing-frame-image-1410.jpg | Found by @frewsxcv when fuzzing
diff --git a/tests/crashtest/images/missing-frame-image-1410.jpg b/tests/crashtest/images/missing-frame-image-1410.jpg
@@ -0,0 +1 @@
+����

Original file line number	Diff line number	Diff line change
`@@ -409,6 +409,10 @@ impl<R: Read> Decoder<R> {`
`409`	`409`	`previous_marker = marker;`
`410`	`410`	`}`
`411`	`411`
	`412`	`+ if self.frame.is_none() {`
	`413`	`+ return Err(Error::Format("end of image encountered before frame".to_owned()));`
	`414`	`+ }`
	`415`	`+`
`412`	`416`	`let frame = self.frame.as_ref().unwrap();`
`413`	`417`
`414`	`418`	`// If we're decoding a progressive jpeg and a component is unfinished, render what we've got`