1862235 - PNG with out-of-range palette indices in tRNS incorrectly handled

Status: NEW

(Core :: Graphics: ImageLib, defect)

Description

[chris]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0

Steps to reproduce:

Run http://wpt.live/png/trns-chunk.html

Actual results:

Fail

Expected results:

Pass

Test passes in Chrome (and Edge) and Safari.

Comment 1

[chris]

The PNG specification had an ambiguity in the Second Edition:
https://www.w3.org/TR/2003/REC-PNG-20031110/#11tRNS

If the image bit depth is less than 16, the least significant bits are used and the others are 0.

After a bug report
https://github.com/w3c/PNG-spec/issues/96

this was clarified in Third Edition
https://w3c.github.io/PNG-spec/#11tRNS

If the image bit depth is less than 16, the least significant bits are used. Encoders should set the other bits to 0, and decoders must mask the other bits to 0 before the value is used.

The referenced WPT tests specifically for this updated text.

Comment 2

[Monica Chiorean]

Put link from description on Win11x64 using FF build 120.0b4 and it failed, while on Chrome passed.
Marking issue as new, not sure if component is correct please update if otherwise. Thank you.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jteow, could you have a look please?

For more information, please visit BugBot documentation.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:tnikkel, could you have a look please?

For more information, please visit BugBot documentation.

Comment 5

[lucas.chollet]

Attachment: Bug 1862235 Remove non-compliant behavior with tRNS chunks. r=tnikkel

In previous editions of the spec, out-of-range values were not
considered. As this is now specified, we should let libpng do the right
thing and not inject non-compliant behavior.

Comment 6

[lucas.chollet]

I started to investigate this issue, and there is code in nsPNGDecoder.cpp that was purposely written to have the unwanted behavior. It seems that there used to be some PNG images that had out-of-range palette indices in the wild, and that it was chosen to discard transparency in this case (bug #428045). As mentioned above, this is not spec compliant with regard to the third edition.

Removing these few lines makes the bug disappear and Firefox pass the WPT test, thus compliant to the newest PNG standard.

As you can see, I submitted a patch for it. I'm hoping I did nothing wrong, this is my first contribution here.

Comment 7

[BugBot (nomail) [:suhaib / :marco/ :calixte]]

The bug assignee is inactive on Bugzilla, so the assignee is being reset.