Fix #937

src/ImageSharp/Formats/Png/Zlib/ZlibInflateStream.cs

@@ -1,4 +1,4 @@
-// Copyright (c) Six Labors and contributors.
+// Copyright (c) Six Labors and contributors.
 // Licensed under the Apache License, Version 2.0.
 
 using System;
@@ -140,7 +140,7 @@ public override int Read(byte[] buffer, int offset, int count)
 
                 offset += bytesRead;
 
-                if (offset >= length)
+                if (offset >= length || offset >= count)
                 {
                     return bytesRead;
                 }
@@ -249,4 +249,4 @@ private void InitializeInflateStream()
             this.compressedStream = new DeflateStream(this, CompressionMode.Decompress, true);
         }
     }
-}
+}

tests/ImageSharp.Tests/Formats/Png/PngDecoderTests.cs

@@ -1,4 +1,4 @@
-// Copyright (c) Six Labors and contributors.
+// Copyright (c) Six Labors and contributors.
 // Licensed under the Apache License, Version 2.0.
 
 // ReSharper disable InconsistentNaming
@@ -42,7 +42,8 @@ public partial class PngDecoderTests
             TestImages.Png.Rgb24BppTrans,
             TestImages.Png.GrayAlpha8Bit,
             TestImages.Png.Gray1BitTrans,
-            TestImages.Png.Bad.ZlibOverflow
+            TestImages.Png.Bad.ZlibOverflow,
+            TestImages.Png.Bad.ZlibOverflow2
         };
 
         public static readonly string[] TestImages48Bpp =
@@ -294,4 +295,4 @@ public void Identify_VerifyRatio(string imagePath, int xResolution, int yResolut
             }
         }
     }
-}
+}

tests/ImageSharp.Tests/TestImages.cs

@@ -87,6 +87,7 @@ public static class Bad
                 public const string ChunkLength2 = "Png/chunklength2.png";
                 public const string CorruptedChunk = "Png/big-corrupted-chunk.png";
                 public const string ZlibOverflow = "Png/zlib-overflow.png";
+                public const string ZlibOverflow2 = "Png/zlib-overflow2.png";
             }
 
             public static readonly string[] All =