When decoding a paletted PNG, require that a PLTE chunk is seen before

the first IDAT chunk.

R=rsc
APPROVED=rsc
DELTA=7  (2 added, 0 deleted, 5 changed)
OCL=34583
CL=34585

diff --git a/src/pkg/image/png/reader.go b/src/pkg/image/png/reader.go
index d410b6e53bd649a5c5fa7f7bd0a127174d99d301..2e67fd999dc99605166a8fb8392a3d5171501496 100644 (file)
--- a/src/pkg/image/png/reader.go
+++ b/src/pkg/image/png/reader.go
@@ -65,6 +65,8 @@ func (e FormatError) String() string {
        return "invalid PNG format: " + e;
 }
 
+var chunkOrderError = FormatError("chunk out of order")
+
 // An IDATDecodingError wraps an inner error (such as a ZLIB decoding error) encountered while processing an IDAT chunk.
 type IDATDecodingError struct {
        Err os.Error;
@@ -347,25 +349,25 @@ func (d *decoder) parseChunk(r io.Reader) os.Error {
        switch string(d.scratch[0:4]) {
        case "IHDR":
                if d.stage != dsStart {
-                       return FormatError("chunk out of order");
+                       return chunkOrderError;
                }
                d.stage = dsSeenIHDR;
                err = d.parseIHDR(r, crc, length);
        case "PLTE":
                if d.stage != dsSeenIHDR {
-                       return FormatError("chunk out of order");
+                       return chunkOrderError;
                }
                d.stage = dsSeenPLTE;
                err = d.parsePLTE(r, crc, length);
        case "IDAT":
-               if d.stage < dsSeenIHDR || d.stage > dsSeenIDAT {
-                       return FormatError("chunk out of order");
+               if d.stage < dsSeenIHDR || d.stage > dsSeenIDAT || (d.colorType == ctPaletted && d.stage == dsSeenIHDR) {
+                       return chunkOrderError;
                }
                d.stage = dsSeenIDAT;
                err = d.parseIDAT(r, crc, length);
        case "IEND":
                if d.stage != dsSeenIDAT {
-                       return FormatError("chunk out of order");
+                       return chunkOrderError;
                }
                d.stage = dsSeenIEND;
                err = d.parseIEND(r, crc, length);