AccessViolationException when decoding gif

[andreas-eriksson]

Prerequisites

• I have written a descriptive issue title
• I have verified that I am running the latest version of ImageSharp
• I have verified if the problem exist in both DEBUG and RELEASE mode
• I have searched open and closed issues to ensure it has not already been reported

ImageSharp version

3.1.6

Other ImageSharp packages and versions

N/A

Environment (Operating system, version and so on)

Windows 11

.NET Framework version

.NET 8

Description

Loading the attached gif causes an AccessViolationException and brings down the process.

at SixLabors.ImageSharp.Formats.Gif.LzwDecoder.DecodePixelRow(System.Span`1<Byte>)
at SixLabors.ImageSharp.Formats.Gif.GifDecoderCore.ReadFrameColors[[SixLabors.ImageSharp.PixelFormats.Rgba32, SixLabors.ImageSharp, Version=3.0.0.0, Culture=neutral, PublicKeyToken=d998eea7b14cab13]](SixLabors.ImageSharp.IO.BufferedReadStream, SixLabors.ImageSharp.Image`1<SixLabors.ImageSharp.PixelFormats.Rgba32> ByRef, SixLabors.ImageSharp.ImageFrame`1<SixLabors.ImageSharp.PixelFormats.Rgba32> ByRef, System.ReadOnlySpan`1<SixLabors.ImageSharp.PixelFormats.Rgb24>, SixLabors.ImageSharp.Formats.Gif.GifImageDescriptor ByRef)
at SixLabors.ImageSharp.Formats.Gif.GifDecoderCore.ReadFrame[[SixLabors.ImageSharp.PixelFormats.Rgba32, SixLabors.ImageSharp, Version=3.0.0.0, Culture=neutral, PublicKeyToken=d998eea7b14cab13]](SixLabors.ImageSharp.IO.BufferedReadStream, SixLabors.ImageSharp.Image`1<SixLabors.ImageSharp.PixelFormats.Rgba32> ByRef, SixLabors.ImageSharp.ImageFrame`1<SixLabors.ImageSharp.PixelFormats.Rgba32> ByRef)
at SixLabors.ImageSharp.Formats.Gif.GifDecoderCore.Decode[[SixLabors.ImageSharp.PixelFormats.Rgba32, SixLabors.ImageSharp, Version=3.0.0.0, Culture=neutral, PublicKeyToken=d998eea7b14cab13]](SixLabors.ImageSharp.IO.BufferedReadStream, System.Threading.CancellationToken)
at SixLabors.ImageSharp.Formats.ImageDecoderCore.Decode[[SixLabors.ImageSharp.PixelFormats.Rgba32, SixLabors.ImageSharp, Version=3.0.0.0, Culture=neutral, PublicKeyToken=d998eea7b14cab13]](SixLabors.ImageSharp.Configuration, System.IO.Stream, System.Threading.CancellationToken)
at SixLabors.ImageSharp.Formats.Gif.GifDecoder.Decode[[SixLabors.ImageSharp.PixelFormats.Rgba32, SixLabors.ImageSharp, Version=3.0.0.0, Culture=neutral, PublicKeyToken=d998eea7b14cab13]](SixLabors.ImageSharp.Formats.DecoderOptions, System.IO.Stream, System.Threading.CancellationToken)
at SixLabors.ImageSharp.Formats.Gif.GifDecoder.Decode(SixLabors.ImageSharp.Formats.DecoderOptions, System.IO.Stream, System.Threading.CancellationToken)
at SixLabors.ImageSharp.Formats.ImageDecoder+<>c__DisplayClass1_0.<Decode>b__0(System.IO.Stream)
at SixLabors.ImageSharp.Formats.ImageDecoder.<WithSeekableStream>g__PerformActionAndResetPosition|11_0[[System.__Canon, System.Private.CoreLib, Version=8.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]](System.IO.Stream, Int64, <>c__DisplayClass11_0`1<System.__Canon> ByRef)
at SixLabors.ImageSharp.Formats.ImageDecoder.WithSeekableStream[[System.__Canon, System.Private.CoreLib, Version=8.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]](SixLabors.ImageSharp.Formats.DecoderOptions, System.IO.Stream, System.Func`2<System.IO.Stream,System.__Canon>)
at SixLabors.ImageSharp.Formats.ImageDecoder.Decode(SixLabors.ImageSharp.Formats.DecoderOptions, System.IO.Stream)
at SixLabors.ImageSharp.Image.Decode(SixLabors.ImageSharp.Formats.DecoderOptions, System.IO.Stream)
at SixLabors.ImageSharp.Image+<>c__DisplayClass80_0.<Load>b__0(System.IO.Stream)
at SixLabors.ImageSharp.Image.WithSeekableStream[[System.__Canon, System.Private.CoreLib, Version=8.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]](SixLabors.ImageSharp.Formats.DecoderOptions, System.IO.Stream, System.Func`2<System.IO.Stream,System.__Canon>)
at SixLabors.ImageSharp.Image.Load(SixLabors.ImageSharp.Formats.DecoderOptions, System.IO.Stream)
at SixLabors.ImageSharp.Image.Load(System.IO.Stream)

Steps to Reproduce

using var image = Image.Load("corrupt.gif");

Images

[andreas-eriksson]

Here is another gif that causes the same hard crash.

[JimBobSquarePants]

Thanks. I’ll investigate it asap

[andreas-eriksson]

Thanks for fixing this 👍

Will this be reported as a CVE?
Will there be a public release with the fix?

[JimBobSquarePants]

Yes, there will be. CVE identifier has been requested and will hopefully get a release out very soon.