Merge pull request #6431 from radarhere/png_srgb

Raise ValueError if PNG sRGB chunk is truncated

Author: hugovk

Tests/test_file_png.py

@@ -635,7 +635,9 @@ def test_padded_idat(self):
 
             assert_image_equal_tofile(im, "Tests/images/bw_gradient.png")
 
-    @pytest.mark.parametrize("cid", (b"IHDR", b"pHYs", b"acTL", b"fcTL", b"fdAT"))
+    @pytest.mark.parametrize(
+        "cid", (b"IHDR", b"sRGB", b"pHYs", b"acTL", b"fcTL", b"fdAT")
+    )
     def test_truncated_chunks(self, cid):
         fp = BytesIO()
         with PngImagePlugin.PngStream(fp) as png:

src/PIL/PngImagePlugin.py

@@ -509,6 +509,10 @@ def chunk_sRGB(self, pos, length):
         # 3 absolute colorimetric
 
         s = ImageFile._safe_read(self.fp, length)
+        if length < 1:
+            if ImageFile.LOAD_TRUNCATED_IMAGES:
+                return s
+            raise ValueError("Truncated sRGB chunk")
         self.im_info["srgb"] = s[0]
         return s