engine apng: reject short fdAT chunk lengths by 1seal · Pull Request #183180 · flutter/flutter
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Code Review
This pull request modifies the APNG image decoding logic to handle fdAT chunks with short data lengths. In APNGImageGenerator::DemuxNextImage, a check is added to ensure the data_length of an fdAT chunk is at least 4 bytes. If the length is less than 4, the function now returns an error, preventing a potential integer underflow and subsequent buffer overflow in memcpy. A new test file, image_generator_apng_unittests.cc, is added with two tests: one that verifies that an APNG with an fdAT chunk of length 0 is rejected, and another that confirms an APNG with an fdAT chunk of length 4 is accepted. The BUILD.gn file is updated to include the new test file and its associated image fixtures.