Panic on specific broken image [bug]

[hedhyw]

The library panics in case of uploading a broken image.

Relates to disintegration/imaging#165

Minimal reproducible example

• poc.tiff by @pic4xiu
• main.go

  package main
  
  import (
      "fmt"
      "log"
      "os"
  
      "github.com/buckket/go-blurhash"
      "golang.org/x/image/tiff"
  )
  
  func main() {
      imageFile, err := os.Open("poc.tiff")
      if err != nil {
  	    log.Fatal(err)
      }
  
      loadedImage, err := tiff.Decode(imageFile)
      if err != nil {
  	    log.Fatal(err)
      }
  
      str, err := blurhash.Encode(4, 3, loadedImage) // Panic.
      if err != nil {
  	    log.Fatal(err)
      }
  
      fmt.Printf("Hash: %s\n", str)
  }

Panic

panic: runtime error: index out of range [70] with length 65

goroutine 1 [running]:
image.(*Paletted).At(0xc000061d68?, 0x48a050?, 0x101c000061d98?)
        /usr/local/go/src/image/image.go:1159 +0x9a
github.com/buckket/go-blurhash.multiplyBasisFunction({0x4dfb20, 0xc00002c2a0}, {0xc00014c000, 0x24, 0x1?}, 0x4, 0x3)
        .../poc-blurhash/vendor/github.com/buckket/go-blurhash/encode.go:131 +0x207
github.com/buckket/go-blurhash.Encode(0x4, 0x3, {0x4dfb20, 0xc00002c2a0})
        .../poc-blurhash/vendor/github.com/buckket/go-blurhash/encode.go:63 +0x22e
main.main()
        .../poc-blurhash/main.go:23 +0xc9
exit status 2

[buckket]

Thanks for reporting! I suspect the problem is within the golang.org/x/image/tiff decoder though. The library itself is not using any 3rd party library or decoder, it just requires a valid image.Image, which seems the malformed here.

[jswright]

I suspect the problem is within the golang.org/x/image/tiff decoder though.

Agreed - see golang/go#67624.