Detect invalid PNG and prevent segfault

[Hakerh400]

IIUC, the cairo PNG parser reads data until the IEND chunk is reached. It doesn't perform any overrun checks, and if there is no IEND chunk, it will cause a segfault.

• Have you updated CHANGELOG.md?

[zbjornson]

Good find. That seems like a pretty gross bug in cairo...

We also have #73 and #122 (and others?) open that AFAIK are unfixable without switching to libpng for loading images (instead of just writing). Any chance you're interested in doing that instead? Would be a cleaner fix...

[Hakerh400]

Is this PR still relevant? None of the mentioned issues reproduce with Cairo 1.16.0.

[zbjornson]

Sorry for the delay. With cairo 1.16.0:

• the test case in this PR passes
• the gAMA bomb in "out of memory" error when trying to load a PNG with a dubious gAMA chunk #73 loads fine
• the image in the OP in PNG with cHRM chunk fails to render #122 loads fine. Still get stdout as TJ described (PNG with cHRM chunk fails to render #122 (comment)).

Glad you checked with newer Cairo 👍 . We could merge just the test from this PR if you want to drop the other changes.

[Hakerh400]

Thanks for verifying. Left the test only.

[LinusU]

Nice!