Re: Endless loop in version 1.6.26

On Mon, Dec 26, 2016 at 10:12 AM, John Bowler <
[email protected]> wrote:

>
> The obvious thing to do in 1.6 if it is to remain API compatible with 1.7
> is to just define a new API (possible a png_set_option macro):
>
> png_ignore_IDAT_errors(png_ptr);
>

OK.  I agree that hijacking png_set_crc_action() wasn't a good solution.


>   I don't know if FireFox actually wants this change
>

It's motivated by some CAPTCHA-generator that doesn't bother to write a
correct ADLER32 checksum,
and apparently won't be bothered to fix it.  Siince some other browsers
accept the image, firefox
is perceived to be buggy because it (correctly IMHO) rejects it.


> but it seems to me that it definitely should be something an app turns on
> explicitly
>

Yes.  We were doing it with png_set_crc_action() but it wouldn't be a
problem using a new
 png_set_adler32_action(png_ptr, ERROR|WARN_USE|QUIET_USE) or similar API
instead.


> (if it happens in a minor release) because, as shown by this report, it is
> capable of causing a serious bug.
>
> Some additional points:
>
> 1) libpng 1.7 png_inflate probably has many serious bugs because of the
> extent of the changes.
>
> 2) One advantage of png_error is that it changes a combinatorial test
> problem into a linear one.  With png_error any detectable error in a
> deflate stream stops the decoding.  However with png_warning different
> combinations of errors cause potentially different code paths which all
> need to be tested; this is difficult.
>

Fighting that in ImageMagick right now, there's a request to plunge ahead
with a bad image returned by the PNG decoder instead of aborting, and I
feel that this comment is pertinent.

Glenn

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/intel

_______________________________________________
png-mng-implement mailing list
png-mng-implement-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/png-mng-implement