Skip to content

Add lenient mode to ICO decoder #3001

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mpospelova wants to merge 2 commits into
base: main
Choose a base branch
from
+62 −11
Open

Add lenient mode to ICO decoder #3001

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
111637d
Add lenient mode to ICO decoder
May 29, 2026
bfb0e92
Add PNG lenient mode to ICO decoder
Jun 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 58 additions & 10 deletions src/codecs/ico/decoder.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ use crate::color::ColorType;
use crate::error::{
DecodingError, ImageError, ImageResult, UnsupportedError, UnsupportedErrorKind,
};
use crate::io::image_reader_type::SpecCompliance;
use crate::io::{
DecodedAnimationAttributes, DecodedImageAttributes, DecoderPreparedImage, FormatAttributes,
};
Expand Down Expand Up @@ -113,6 +114,7 @@ pub struct IcoDecoder<R: BufRead + Seek> {
selected_entry: DirEntry,
reader_offset: u64,
inner_decoder: InnerDecoder<R>,
spec_strictness: SpecCompliance,
}

enum InnerDecoder<R: BufRead + Seek> {
Expand Down Expand Up @@ -147,16 +149,25 @@ struct DirEntry {

impl<R: BufRead + Seek> IcoDecoder<R> {
/// Create a new decoder that decodes from the stream ```r```
pub fn new(mut r: R) -> ImageResult<IcoDecoder<R>> {
pub fn new(r: R) -> ImageResult<IcoDecoder<R>> {
Self::with_spec_compliance(r, SpecCompliance::default())
}

/// Create a new decoder with the given spec compliance mode.
pub(crate) fn with_spec_compliance(
mut r: R,
spec: SpecCompliance,
) -> ImageResult<IcoDecoder<R>> {
let reader_offset = r.stream_position()?;
let entries = read_entries(&mut r)?;
let entry = best_entry(entries)?;
let decoder = entry.decoder(r, reader_offset)?;
let decoder = entry.decoder(r, reader_offset, spec)?;

Ok(IcoDecoder {
selected_entry: entry,
reader_offset,
inner_decoder: decoder,
spec_strictness: spec,
})
}
}
Expand Down Expand Up @@ -256,17 +267,22 @@ impl DirEntry {
&self,
mut r: R,
reader_offset: u64,
spec: SpecCompliance,
) -> ImageResult<InnerDecoder<R>> {
let is_png = self.is_png(&mut r, reader_offset)?;
self.seek_to_start(&mut r, reader_offset)?;

if is_png {
let limits = crate::Limits {
max_image_width: Some(self.real_width().into()),
max_image_height: Some(self.real_height().into()),
max_alloc: Some(256 * 256 * 4 * 2), // width * height * 4 bytes per pixel * safety factor of 2
};
Ok(Png(Box::new(PngDecoder::with_limits(r, limits))))
if spec == SpecCompliance::Strict {
let limits = crate::Limits {
max_image_width: Some(self.real_width().into()),
max_image_height: Some(self.real_height().into()),
max_alloc: Some(256 * 256 * 4 * 2), // width * height * 4 bytes per pixel * safety factor of 2
};
Ok(Png(Box::new(PngDecoder::with_limits(r, limits))))
} else {
Ok(Png(Box::new(PngDecoder::new(r))))
}
Comment on lines +276 to +285
Copy link
Copy Markdown
Member

@RunDevelopment RunDevelopment Jun 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added this in #2682 to prevent OOMs but this is no longer necessary since we ImageDecoder::set_limits now. So let's just remove it instead of making things more complex than they have to be.

Suggested change
if spec == SpecCompliance::Strict {
let limits = crate::Limits {
max_image_width: Some(self.real_width().into()),
max_image_height: Some(self.real_height().into()),
max_alloc: Some(256 * 256 * 4 * 2), // width * height * 4 bytes per pixel * safety factor of 2
};
Ok(Png(Box::new(PngDecoder::with_limits(r, limits))))
} else {
Ok(Png(Box::new(PngDecoder::new(r))))
}
Ok(Png(Box::new(PngDecoder::new(r))))

} else {
Ok(Bmp(BmpDecoder::new_with_ico_format(r)?))
}
Expand Down Expand Up @@ -307,7 +323,9 @@ impl<R: BufRead + Seek> ImageDecoder for IcoDecoder<R> {
let layout = decoder.prepare_image()?;
// Check if the image dimensions match the ones in the image data.
let (width, height) = layout.layout.dimensions();
if !self.selected_entry.matches_dimensions(width, height) {
if self.spec_strictness == SpecCompliance::Strict
&& !self.selected_entry.matches_dimensions(width, height)
{
return Err(DecoderError::ImageEntryDimensionMismatch {
format: IcoEntryImageFormat::Png,
entry: (
Expand All @@ -330,7 +348,9 @@ impl<R: BufRead + Seek> ImageDecoder for IcoDecoder<R> {
Bmp(decoder) => {
let layout = decoder.prepare_image()?;
let (width, height) = layout.layout.dimensions();
if !self.selected_entry.matches_dimensions(width, height) {
if self.spec_strictness == SpecCompliance::Strict
&& !self.selected_entry.matches_dimensions(width, height)
{
return Err(DecoderError::ImageEntryDimensionMismatch {
format: IcoEntryImageFormat::Bmp,
entry: (
Expand Down Expand Up @@ -531,4 +551,32 @@ mod test {
let mut buf = vec![0; usize::try_from(bytes).unwrap()];
assert!(decoder.read_image(&mut buf).is_err());
}

#[test]
fn dimension_mismatch_strict_vs_lenient() {
// Minimal 2x2 32-bit BMP inside an ICO where the directory entry says 3x3.
let data = vec![
0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x03, 0x03, 0x00, 0x00, 0x01, 0x00, 0x20, 0x00,
0x40, 0x00, 0x00, 0x00, 0x16, 0x00, 0x00, 0x00, 0x28, 0x00, 0x00, 0x00, 0x02, 0x00,
0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00,
];

let mut decoder =
IcoDecoder::with_spec_compliance(std::io::Cursor::new(&data), SpecCompliance::Lenient)
.unwrap();
let bytes = decoder.prepare_image().unwrap().total_bytes();
let mut buf = vec![0; usize::try_from(bytes).unwrap()];
assert!(decoder.read_image(&mut buf).is_ok());

let mut decoder =
IcoDecoder::with_spec_compliance(std::io::Cursor::new(&data), SpecCompliance::Strict)
.unwrap();
let bytes = decoder.prepare_image().unwrap().total_bytes();
let mut buf = vec![0; usize::try_from(bytes).unwrap()];
assert!(decoder.read_image(&mut buf).is_err());
}
}
5 changes: 4 additions & 1 deletion src/io/image_reader_type.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,7 +220,10 @@ impl<'a, R: 'a + BufRead + Seek> ImageReaderOptions<R> {
spec_compliance,
)?),
#[cfg(feature = "ico")]
ImageFormat::Ico => Box::new(ico::IcoDecoder::new(reader)?),
ImageFormat::Ico => Box::new(ico::IcoDecoder::with_spec_compliance(
reader,
spec_compliance,
)?),
#[cfg(feature = "hdr")]
ImageFormat::Hdr => Box::new(hdr::HdrDecoder::with_spec_compliance(
reader,
Expand Down
Loading