Make SkPngCodec only read as much of the stream as necessary

Previously, SkPngCodec assumed that the stream only contained one
image, which ended at the end of the stream. It read the stream in
arbitrarily-sized chunks, and then passed that data to libpng for
processing.

If a stream contains more than one image, this may result in reading
beyond the end of the image, making future reads read the wrong data.

Now, SkPngCodec starts by reading 8 bytes at a time. After the
signature, 8 bytes is enough to know which chunk is next and how many
bytes are in the chunk.

When decoding the size, we stop when we reach IDAT, and when decoding
the image, we stop when we reach IEND.

This manual parsing is necessary to support APNG, which is planned in
the future. It also allows us to remove the SK_GOOGLE3_PNG_HACK, which
was a workaround for reading more than necessary at the beginning of
the image.

Add a test that simulates the issue, by decoding a special stream that
reports an error if the codec attempts to read beyond the end.

Temporarily disable the partial decoding tests for png. A larger change
will be necessary to get those working again, and no clients are
currently relying on incrementally decoding PNGs (i.e. decode part of
an image, then decode further with more data).

Bug: skia:5368
BUG:34073812

Change-Id: If832f7b20565411226fb5be3c305a4d16bf9269d
Reviewed-on: https://skia-review.googlesource.com/13900
Commit-Queue: Leon Scroggins <scroggo@google.com>
Reviewed-by: Matt Sarett <msarett@google.com>

2 files changed, 106 insertions, 1 deletions

diff --git a/tests/CodecExactReadTest.cpp b/tests/CodecExactReadTest.cpp
new file mode 100644
index 0000000000..7e0d8eaccc
--- /dev/null
+++ b/tests/CodecExactReadTest.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright 2017 Google Inc.
+ *
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ */
+
+#include "Resources.h"
+#include "Test.h"
+
+#include "SkBitmap.h"
+#include "SkCodec.h"
+#include "SkData.h"
+#include "SkStream.h"
+
+namespace {
+// This class emits a skiatest failure if a client attempts to read beyond its
+// end. Since it is used with complete, valid images, and contains nothing
+// after the encoded image data, it will emit a failure if the client attempts
+// to read beyond the logical end of the data.
+class MyStream : public SkStream {
+public:
+    static MyStream* Make(const char* path, skiatest::Reporter* r) {
+        SkASSERT(path);
+        sk_sp<SkData> data(GetResourceAsData(path));
+        if (!data) {
+            return nullptr;
+        }
+
+        return new MyStream(path, std::move(data), r);
+    }
+
+    size_t read(void* buf, size_t bytes) override {
+        const size_t remaining = fStream.getLength() - fStream.getPosition();
+        if (bytes > remaining) {
+            ERRORF(fReporter, "Tried to read %lu bytes (only %lu remaining) from %s",
+                   bytes, remaining, fPath);
+        }
+        return fStream.read(buf, bytes);
+    }
+
+    bool rewind() override {
+        return fStream.rewind();
+    }
+
+    bool isAtEnd() const override {
+        return fStream.isAtEnd();
+    }
+private:
+    const char* fPath;
+    SkMemoryStream fStream;
+    skiatest::Reporter* fReporter;  // Unowned
+
+    MyStream(const char* path, sk_sp<SkData> data, skiatest::Reporter* r)
+        : fPath(path)
+        , fStream(std::move(data))
+        , fReporter(r)
+    {}
+};
+} // namespace
+
+// Test that SkPngCodec does not attempt to read its input beyond the logical
+// end of its data. Some other SkCodecs do, but some Android apps rely on not
+// doing so for PNGs.
+DEF_TEST(Codec_end, r) {
+    for (const char* path : { "plane.png",
+                              "yellow_rose.png",
+                              "plane_interlaced.png" }) {
+        std::unique_ptr<MyStream> stream(MyStream::Make(path, r));
+        if (!stream) {
+            continue;
+        }
+
+        std::unique_ptr<SkCodec> codec(SkCodec::NewFromStream(stream.release()));
+        if (!codec) {
+            ERRORF(r, "Failed to create a codec from %s\n", path);
+            continue;
+        }
+
+        auto info = codec->getInfo().makeColorType(kN32_SkColorType);
+        SkBitmap bm;
+        bm.allocPixels(info);
+
+        auto result = codec->getPixels(bm.info(), bm.getPixels(), bm.rowBytes());
+        if (result != SkCodec::kSuccess) {
+            ERRORF(r, "Failed to getPixels from %s. error %i", path, result);
+            continue;
+        }
+
+        // Rewind and do an incremental decode.
+        result = codec->startIncrementalDecode(bm.info(), bm.getPixels(), bm.rowBytes());
+        if (result != SkCodec::kSuccess) {
+            ERRORF(r, "Failed to startIncrementalDecode from %s. error %i", path, result);
+            continue;
+        }
+
+        result = codec->incrementalDecode();
+        if (result != SkCodec::kSuccess) {
+            ERRORF(r, "Failed to incrementalDecode from %s. error %i", path, result);
+        }
+    }
+}
diff --git a/tests/CodecPartialTest.cpp b/tests/CodecPartialTest.cpp
index 20cd1d11f0..c029922f71 100644
--- a/tests/CodecPartialTest.cpp
+++ b/tests/CodecPartialTest.cpp
@@ -118,6 +118,9 @@ static void test_partial(skiatest::Reporter* r, const char* name, size_t minByte
 }
 
 DEF_TEST(Codec_partial, r) {
+#if 0
+    // FIXME (scroggo): SkPngCodec needs to use SkStreamBuffer in order to
+    // support incremental decoding.
     test_partial(r, "plane.png");
     test_partial(r, "plane_interlaced.png");
     test_partial(r, "yellow_rose.png");
@@ -128,7 +131,7 @@ DEF_TEST(Codec_partial, r) {
     test_partial(r, "arrow.png");
     test_partial(r, "randPixels.png");
     test_partial(r, "baby_tux.png");
-
+#endif
     test_partial(r, "box.gif");
     test_partial(r, "randPixels.gif", 215);
     test_partial(r, "color_wheel.gif");