221 lines
9.1 KiB
C#
221 lines
9.1 KiB
C#
using System.Buffers.Binary;
|
|
using ErsatzTV.Core.Images;
|
|
using ErsatzTV.Infrastructure.Streaming.Graphics;
|
|
using NUnit.Framework;
|
|
using Shouldly;
|
|
using SixLabors.ImageSharp;
|
|
using SixLabors.ImageSharp.Formats.Png;
|
|
using SixLabors.ImageSharp.PixelFormats;
|
|
using Image = SixLabors.ImageSharp.Image;
|
|
|
|
namespace ErsatzTV.Infrastructure.Tests.Streaming.Graphics;
|
|
|
|
/// <summary>
|
|
/// The byte cap in <c>HttpRemoteImageFetcher</c> does not bound decoding: a decompression bomb
|
|
/// is tiny on the wire and enormous in memory. These pin the header-first check that does.
|
|
/// (ersatztv#511)
|
|
/// </summary>
|
|
[TestFixture]
|
|
public class RemoteImageDecodeLimitTests
|
|
{
|
|
private static readonly Uri ImageUri = new("https://example.com/logo.png");
|
|
|
|
[Test]
|
|
public async Task Should_Decode_A_Normal_Image()
|
|
{
|
|
await using MemoryStream stream = await RealPng(64, 32);
|
|
|
|
using Image image = await ImageElementBase.DecodeRemoteImage(stream, ImageUri, CancellationToken.None);
|
|
|
|
image.Width.ShouldBe(64);
|
|
image.Height.ShouldBe(32);
|
|
}
|
|
|
|
// the bomb: a few dozen bytes on the wire, ~3.6 GB if decoded. it sails through the byte cap,
|
|
// the content-type check and the Content-Length reject -- only the header dimensions catch it.
|
|
[Test]
|
|
public async Task Should_Reject_An_Image_Whose_Declared_Dimensions_Are_A_Decompression_Bomb()
|
|
{
|
|
await using MemoryStream stream = PngHeaderDeclaring(30000, 30000);
|
|
|
|
stream.Length.ShouldBeLessThan(100, "the point is that this is tiny on the wire");
|
|
|
|
InvalidOperationException ex = await Should.ThrowAsync<InvalidOperationException>(
|
|
() => ImageElementBase.DecodeRemoteImage(stream, ImageUri, CancellationToken.None));
|
|
|
|
ex.Message.ShouldContain("pixel limit");
|
|
}
|
|
|
|
[Test]
|
|
public async Task Should_Accept_Dimensions_Exactly_At_The_Limit()
|
|
{
|
|
// 10000 x 5000 = 50,000,000 -- exactly the budget, so it must NOT be rejected. the decode
|
|
// then fails on the truncated body, which proves the check let it through. NOTE this test
|
|
// would also pass with the guard deleted entirely; deletion is covered by the bomb test
|
|
// above, and the boundary arithmetic by RemoteImageDecodeBudgetTests (ErsatzTV.Core.Tests).
|
|
await using MemoryStream stream = PngHeaderDeclaring(10000, 5000);
|
|
|
|
Exception ex = await Should.ThrowAsync<Exception>(
|
|
() => ImageElementBase.DecodeRemoteImage(stream, ImageUri, CancellationToken.None));
|
|
|
|
ex.Message.ShouldNotContain("pixel limit");
|
|
}
|
|
|
|
// the retained-frame budget is INDEPENDENT of the decode budget: this source is trivial to
|
|
// decode (6 MP total) but retains ~5 GB of SKBitmap once every frame is scaled to 1080p
|
|
[Test]
|
|
public void Should_Reject_Cheap_Frames_That_Are_Expensive_Once_Scaled()
|
|
{
|
|
Should.NotThrow(() => RemoteImageDecodeBudget.EnsureDecodeAffordable(100, 100, 600, ImageUri));
|
|
|
|
InvalidOperationException ex = Should.Throw<InvalidOperationException>(
|
|
() => ImageElementBase.EnsureScaledFramesAffordable(600, 1920, 1080, ImageUri));
|
|
|
|
ex.Message.ShouldContain("pixel limit");
|
|
}
|
|
|
|
[Test]
|
|
public void Should_Allow_A_Scaled_Watermark_Sized_Animation()
|
|
{
|
|
// a 10%-width logo on a 1080p frame, animated
|
|
Should.NotThrow(() => ImageElementBase.EnsureScaledFramesAffordable(600, 192, 108, ImageUri));
|
|
}
|
|
|
|
|
|
// --- B1 regression: the header's frame count is a LIE for APNG ---
|
|
|
|
// ImageSharp 3.1.12 reports FrameMetadataCollection.Count == 0 for an APNG while the decoder
|
|
// produces every frame. A budget derived from that header count is enforced on a number the
|
|
// decoder does not honor — this exact payload shape, at 4000x4000, is ~134 KiB on the wire and
|
|
// ~36 GiB decoded. The bound therefore has to be imposed ON THE DECODER (DecoderOptions.
|
|
// MaxFrames) and re-verified against the real frame count. (ersatztv#511, second re-review.)
|
|
[Test]
|
|
public async Task Should_Reject_An_Animation_Whose_Header_Under_Reports_Its_Frames()
|
|
{
|
|
await using MemoryStream stream = Apng(64, 64, RemoteImageDecodeBudget.MaxRemoteFrames + 100);
|
|
|
|
// the premise: the header really does under-report, so a header-derived budget waves it through
|
|
stream.Position = 0;
|
|
ImageInfo info = await Image.IdentifyAsync(stream);
|
|
info.FrameMetadataCollection.Count.ShouldBe(0, "the APNG header under-reports; that is the whole point");
|
|
Should.NotThrow(() => RemoteImageDecodeBudget.EnsureDecodeAffordable(64, 64, info.FrameMetadataCollection.Count, ImageUri));
|
|
|
|
stream.Position = 0;
|
|
InvalidOperationException ex = await Should.ThrowAsync<InvalidOperationException>(
|
|
() => ImageElementBase.DecodeRemoteImage(stream, ImageUri, CancellationToken.None));
|
|
|
|
ex.Message.ShouldContain("frame limit");
|
|
}
|
|
|
|
// ...and an animation within budget still decodes IN FULL -- the decoder cap must not silently
|
|
// truncate legitimate content by a frame
|
|
[Test]
|
|
public async Task Should_Decode_An_Animation_Within_Budget_Without_Truncating_It()
|
|
{
|
|
await using MemoryStream stream = Apng(64, 64, 300);
|
|
|
|
using Image image = await ImageElementBase.DecodeRemoteImage(stream, ImageUri, CancellationToken.None);
|
|
|
|
image.Frames.Count.ShouldBe(300);
|
|
}
|
|
|
|
|
|
// H2 regression: a default `Image.Identify` throws InvalidImageContentException on most APNGs
|
|
// (measured: 13 of 16 shapes, including ones ImageSharp's own encoder wrote) even though
|
|
// `Image.Load` reads them back perfectly. 288x288 is one of the throwing shapes; 64x64 x300 --
|
|
// used by the tests above -- happens NOT to be, which is exactly why they could not see this.
|
|
// Without the MaxFrames=1 workaround on the Identify, every animated-PNG logo that worked
|
|
// before this change would be silently disabled. (ersatztv#511, fourth re-review.)
|
|
[Test]
|
|
public async Task Should_Decode_An_Apng_That_A_Default_Identify_Cannot_Read()
|
|
{
|
|
await using MemoryStream stream = Apng(288, 288, 60);
|
|
|
|
// the premise: a default Identify really does fail on this file
|
|
stream.Position = 0;
|
|
await Should.ThrowAsync<Exception>(() => Image.IdentifyAsync(stream));
|
|
|
|
stream.Position = 0;
|
|
using Image image = await ImageElementBase.DecodeRemoteImage(stream, ImageUri, CancellationToken.None);
|
|
|
|
image.Width.ShouldBe(288);
|
|
image.Height.ShouldBe(288);
|
|
image.Frames.Count.ShouldBe(60);
|
|
}
|
|
|
|
/// <summary>A real multi-frame APNG. Small on the wire, many frames — the shape that matters.</summary>
|
|
private static MemoryStream Apng(int width, int height, int frames)
|
|
{
|
|
using var image = new Image<Rgba32>(width, height);
|
|
for (var i = 1; i < frames; i++)
|
|
{
|
|
image.Frames.CreateFrame();
|
|
}
|
|
|
|
var stream = new MemoryStream();
|
|
image.Save(stream, new PngEncoder { ColorType = PngColorType.RgbWithAlpha });
|
|
stream.Position = 0;
|
|
return stream;
|
|
}
|
|
|
|
// PNG chunk CRC-32 (IEEE, reflected). hand-rolled because the repo does not reference
|
|
// System.IO.Hashing, and ImageSharp validates the CRC of critical chunks like IHDR.
|
|
private static uint Crc32(ReadOnlySpan<byte> data)
|
|
{
|
|
uint crc = 0xFFFFFFFF;
|
|
foreach (byte b in data)
|
|
{
|
|
crc ^= b;
|
|
for (var i = 0; i < 8; i++)
|
|
{
|
|
crc = (crc & 1) != 0 ? (crc >> 1) ^ 0xEDB88320 : crc >> 1;
|
|
}
|
|
}
|
|
|
|
return crc ^ 0xFFFFFFFF;
|
|
}
|
|
|
|
/// <summary>A real, decodable PNG.</summary>
|
|
private static async Task<MemoryStream> RealPng(int width, int height)
|
|
{
|
|
using var image = new Image<Rgba32>(width, height);
|
|
var stream = new MemoryStream();
|
|
await image.SaveAsync(stream, new PngEncoder());
|
|
stream.Position = 0;
|
|
return stream;
|
|
}
|
|
|
|
/// <summary>
|
|
/// A PNG signature plus a single valid IHDR chunk declaring <paramref name="width" /> x
|
|
/// <paramref name="height" /> and nothing else — enough for Identify, far too little to
|
|
/// decode. This is what a decompression bomb looks like at the point we have to reject it.
|
|
/// </summary>
|
|
private static MemoryStream PngHeaderDeclaring(int width, int height)
|
|
{
|
|
var stream = new MemoryStream();
|
|
stream.Write([0x89, (byte)'P', (byte)'N', (byte)'G', 0x0D, 0x0A, 0x1A, 0x0A]);
|
|
|
|
var ihdr = new byte[17];
|
|
"IHDR"u8.CopyTo(ihdr);
|
|
BinaryPrimitives.WriteInt32BigEndian(ihdr.AsSpan(4), width);
|
|
BinaryPrimitives.WriteInt32BigEndian(ihdr.AsSpan(8), height);
|
|
ihdr[12] = 8; // bit depth
|
|
ihdr[13] = 6; // color type: truecolor + alpha
|
|
ihdr[14] = 0; // compression
|
|
ihdr[15] = 0; // filter
|
|
ihdr[16] = 0; // interlace
|
|
|
|
var length = new byte[4];
|
|
BinaryPrimitives.WriteInt32BigEndian(length, 13);
|
|
stream.Write(length);
|
|
stream.Write(ihdr);
|
|
|
|
var crc = new byte[4];
|
|
BinaryPrimitives.WriteUInt32BigEndian(crc, Crc32(ihdr));
|
|
stream.Write(crc);
|
|
|
|
stream.Position = 0;
|
|
return stream;
|
|
}
|
|
}
|