code review 86750044: image/png: fix crash when an alleged PNG has too much p...

image/png: fix crash when an alleged PNG has too much pixel data,
so that the zlib.Reader returns nil error.

Fixes issue 7762.

[nigeltao, 2014-04-11 07:53:52]

Hello r@golang.org (cc: golang-codereviews@googlegroups.com),

I'd like you to review this change to
https://code.google.com/p/go/

[r, 2014-04-11 08:43:53]

https://codereview.appspot.com/86750044/diff/40001/src/pkg/image/png/reader.go
File src/pkg/image/png/reader.go (right):

https://codereview.appspot.com/86750044/diff/40001/src/pkg/image/png/reader.g...
src/pkg/image/png/reader.go:526: return img, nil
this logic is hard for me to follow. too much going on in the loop.
try this. i think it's shorter and it puts the return at the end of the function

var n int
for i := 0; err == nil && n == 0; i++ {
   if i == 100 {
       return nil, io.ErrNoProgress
   }
   n, err := r.Read(pr[:1])
}

if err !=nil && err != io.EOF {
    return nil, FormatError(err.Error())
}
if n != 0 || d.idatLength != 0 {
      return nil, FormatError("too much pixel data")
}
return img, nil

[nigeltao, 2014-04-14 00:06:58]

PTAL.

[r, 2014-04-15 15:46:02]

LGTM

[nigeltao, 2014-04-16 02:19:08]

*** Submitted as https://code.google.com/p/go/source/detail?r=cdbb80e37f78 ***

image/png: fix crash when an alleged PNG has too much pixel data,
so that the zlib.Reader returns nil error.

Fixes issue 7762.

LGTM=r
R=r
CC=golang-codereviews
https://codereview.appspot.com/86750044