PNG decoder: chunk buffer is still not disposed when cancellation is observed just after the chunk-data read (follow-up to #3202)

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net10.0</TargetFramework>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
    <!-- To compare with the previous release: -p:ImageSharpVersion=4.1.2 -->
    <ImageSharpVersion Condition="'$(ImageSharpVersion)' == ''">4.1.3</ImageSharpVersion>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="SixLabors.ImageSharp" Version="$(ImageSharpVersion)" />
  </ItemGroup>

</Project>

// Reproduction for SixLabors.ImageSharp 4.1.3: a PNG chunk buffer is still left
// undisposed when a cancellation is first observed just AFTER the chunk-data
// read that #3203 / #3209 guarded.
//
// No timer and no repetition. The input stream cancels the token itself, at one
// chosen call, and the decoder observes it at its next check:
//
//   A  during the read of the first IDAT chunk's data
//        -> observed inside that read                     (the path #3203 fixed)
//   B  in the seek that follows that read
//        -> observed at the entry of the CRC read         (ValidateChunk)
//   C  during the read that fetches that chunk's CRC
//        -> observed when TryReadChunk moves the stream back to the IDAT data
//
// Each case runs once under Image.IdentifyAsync and once under Image.LoadAsync,
// with the default configuration.
//
// Only public ImageSharp APIs are used. Reflection is limited to diagnostic
// version and stack information; it is not used to access ImageSharp internals.
//
//   dotnet run -c Release

using System.Buffers.Binary;
using System.Diagnostics;
using System.Reflection;
using System.Runtime.InteropServices;
using SixLabors.ImageSharp;
using SixLabors.ImageSharp.Diagnostics;
using SixLabors.ImageSharp.PixelFormats;

Console.WriteLine($"imagesharp={typeof(Image).Assembly.GetCustomAttribute<AssemblyInformationalVersionAttribute>()?.InformationalVersion}");
Console.WriteLine($"runtime={RuntimeInformation.FrameworkDescription}");
Console.WriteLine($"os={RuntimeInformation.OSDescription} {RuntimeInformation.ProcessArchitecture}");
#if DEBUG
Console.WriteLine("build=Debug");
#else
Console.WriteLine("build=Release");
#endif

byte[] png = CreatePng(256, 256);
(int dataOffset, int dataLength) = FirstIdat(png);
int streamBuffer = Configuration.Default.StreamProcessingBufferSize;
Console.WriteLine($"input=generated PNG 256x256, {png.Length} bytes; first IDAT data at offset {dataOffset}, {dataLength} bytes; decoder stream buffer {streamBuffer} bytes");

if (dataLength <= streamBuffer)
{
    // The decoder reads a chunk in one call to the input stream only when the
    // chunk is larger than its own buffer; the cases below rely on that.
    Console.WriteLine("result=cannot run: the first IDAT chunk is not larger than the decoder's stream buffer");
    return 2;
}

// Where the cancellation is thrown. An awaited exception no longer carries it.
string? observedAt = null;
AppDomain.CurrentDomain.FirstChanceException += (_, e) =>
{
    if (e.Exception is OperationCanceledException && observedAt is null)
    {
        observedAt = string.Join(
            " < ",
            new StackTrace(fNeedFileInfo: false).GetFrames()
                .Select(frame => frame.GetMethod())
                .Where(method => method?.DeclaringType?.FullName?.StartsWith("SixLabors.ImageSharp", StringComparison.Ordinal) == true)
                .Take(6)
                .Select(method => $"{method!.DeclaringType!.Name}.{method.Name}"));
    }
};

int keptAfterTheGuardedRead = 0;

foreach (CancelAt cancelAt in Enum.GetValues<CancelAt>())
{
    foreach (bool decode in new[] { false, true })
    {
        using CancellationTokenSource cancellation = new();
        using CancellingStream stream = new(png, dataOffset, dataLength, cancelAt, cancellation);
        observedAt = null;

        int before = MemoryDiagnostics.TotalUndisposedAllocationCount;
        string outcome;

        try
        {
            if (decode)
            {
                using Image<Rgba32> image = await Image.LoadAsync<Rgba32>(stream, cancellation.Token);
            }
            else
            {
                await Image.IdentifyAsync(stream, cancellation.Token);
            }

            outcome = "completed";
        }
        catch (OperationCanceledException e)
        {
            outcome = e.GetType().Name;
        }

        int kept = MemoryDiagnostics.TotalUndisposedAllocationCount - before;

        if (cancelAt != CancelAt.DataRead)
        {
            keptAfterTheGuardedRead += kept;
        }

        Console.WriteLine();
        Console.WriteLine($"case={Label(cancelAt)} api={(decode ? "Image.LoadAsync<Rgba32>" : "Image.IdentifyAsync")}");
        Console.WriteLine($"  cancelled in     : {stream.CancelledIn ?? "NOT CANCELLED - this case shows nothing"}");
        Console.WriteLine($"  outcome          : {outcome}");
        Console.WriteLine($"  observed at      : {observedAt ?? "none"}");
        Console.WriteLine($"  undisposed count : {kept:+0;-0;+0}");
    }
}

Console.WriteLine();
Console.WriteLine(keptAfterTheGuardedRead > 0
    ? $"result=REPRODUCED: {keptAfterTheGuardedRead} buffer(s) left undisposed in cases B and C"
    : "result=not reproduced: cases B and C returned every buffer");

return keptAfterTheGuardedRead > 0 ? 1 : 0;

static string Label(CancelAt cancelAt) => cancelAt switch
{
    CancelAt.DataRead => "A (during the chunk-data read)",
    CancelAt.SeekAfterDataRead => "B (in the seek after the chunk-data read)",
    _ => "C (during the CRC read)",
};

// Noise, so the image data does not fit in one small IDAT chunk.
static byte[] CreatePng(int width, int height)
{
    Random random = new(7);
    using Image<Rgba32> image = new(width, height);
    image.ProcessPixelRows(accessor =>
    {
        for (int y = 0; y < accessor.Height; y++)
        {
            foreach (ref Rgba32 pixel in accessor.GetRowSpan(y))
            {
                pixel = new Rgba32((byte)random.Next(256), (byte)random.Next(256), (byte)random.Next(256), 255);
            }
        }
    });

    using MemoryStream output = new();
    image.SaveAsPng(output);
    return output.ToArray();
}

// Where the first IDAT chunk's data starts, and how long it is.
static (int Offset, int Length) FirstIdat(byte[] png)
{
    for (int at = 8; at + 8 <= png.Length;)
    {
        int length = (int)BinaryPrimitives.ReadUInt32BigEndian(png.AsSpan(at));

        if (png.AsSpan(at + 4, 4).SequenceEqual("IDAT"u8))
        {
            return (at + 8, length);
        }

        at += 4 + 4 + length + 4; // length, type, data, CRC
    }

    throw new InvalidOperationException("The PNG holds no IDAT chunk.");
}

enum CancelAt
{
    DataRead,
    SeekAfterDataRead,
    CrcRead,
}

// A MemoryStream, because that is what the decoder reads in place. It cancels
// the token once, inside the chosen call, and then lets the call complete.
sealed class CancellingStream(
    byte[] content,
    int dataOffset,
    int dataLength,
    CancelAt cancelAt,
    CancellationTokenSource cancellation)
    : MemoryStream(content, writable: false)
{
    private bool dataReadSeen;

    public string? CancelledIn { get; private set; }

    // Every Read overload of a type derived from MemoryStream arrives here.
    public override int Read(byte[] buffer, int offset, int count)
    {
        long position = this.Position;
        bool isDataRead = position == dataOffset && count == dataLength;

        if (isDataRead && cancelAt == CancelAt.DataRead)
        {
            this.Cancel($"Read at {position}, {count} bytes (the chunk's data)");
        }
        else if (this.dataReadSeen && position == dataOffset + dataLength && cancelAt == CancelAt.CrcRead)
        {
            this.Cancel($"Read at {position}, {count} bytes (starts with the chunk's CRC)");
        }

        this.dataReadSeen |= isDataRead;
        return base.Read(buffer, offset, count);
    }

    public override long Seek(long offset, SeekOrigin loc)
    {
        if (this.dataReadSeen && cancelAt == CancelAt.SeekAfterDataRead
            && loc == SeekOrigin.Begin && offset == dataOffset + dataLength)
        {
            this.Cancel($"Seek to {offset} (the end of the chunk's data)");
        }

        return base.Seek(offset, loc);
    }

    private void Cancel(string where)
    {
        if (!cancellation.IsCancellationRequested)
        {
            this.CancelledIn = where;
            cancellation.Cancel();
        }
    }
}

imagesharp=4.1.3+751037d0c6384c97e77ee1abd86e2203ae8dbd95
runtime=.NET 10.0.12
os=Microsoft Windows 10.0.26300 X64
build=Release
input=generated PNG 256x256, 225226 bytes; first IDAT data at offset 62, 65535 bytes; decoder stream buffer 8096 bytes

case=A (during the chunk-data read) api=Image.IdentifyAsync
  cancelled in     : Read at 62, 65535 bytes (the chunk's data)
  outcome          : TaskCanceledException
  observed at      : BufferedReadStream.set_Position < BufferedReadStream.ReadToBufferDirectSlow < BufferedReadStream.Read < BufferedReadStreamExtensions.Read < PngDecoderCore.ReadChunkData < PngDecoderCore.TryReadChunk
  undisposed count : +0

case=A (during the chunk-data read) api=Image.LoadAsync<Rgba32>
  cancelled in     : Read at 62, 65535 bytes (the chunk's data)
  outcome          : TaskCanceledException
  observed at      : BufferedReadStream.set_Position < BufferedReadStream.ReadToBufferDirectSlow < BufferedReadStream.Read < BufferedReadStreamExtensions.Read < PngDecoderCore.ReadChunkData < PngDecoderCore.TryReadChunk
  undisposed count : +0

case=B (in the seek after the chunk-data read) api=Image.IdentifyAsync
  cancelled in     : Seek to 65597 (the end of the chunk's data)
  outcome          : TaskCanceledException
  observed at      : BufferedReadStream.Read < BufferedReadStreamExtensions.Read < PngDecoderCore.ReadChunkCrc < PngDecoderCore.ValidateChunk < PngDecoderCore.TryReadChunk < PngDecoderCore.Identify
  undisposed count : +1

case=B (in the seek after the chunk-data read) api=Image.LoadAsync<Rgba32>
  cancelled in     : Seek to 65597 (the end of the chunk's data)
  outcome          : TaskCanceledException
  observed at      : BufferedReadStream.Read < BufferedReadStreamExtensions.Read < PngDecoderCore.ReadChunkCrc < PngDecoderCore.ValidateChunk < PngDecoderCore.TryReadChunk < PngDecoderCore.Decode
  undisposed count : +1

case=C (during the CRC read) api=Image.IdentifyAsync
  cancelled in     : Read at 65597, 8096 bytes (starts with the chunk's CRC)
  outcome          : TaskCanceledException
  observed at      : BufferedReadStream.set_Position < PngDecoderCore.TryReadChunk < PngDecoderCore.Identify < ImageDecoderCore.Identify < PngDecoder.Identify < <>c__DisplayClass5_0.<IdentifyAsync>b__0
  undisposed count : +1

case=C (during the CRC read) api=Image.LoadAsync<Rgba32>
  cancelled in     : Read at 65597, 8096 bytes (starts with the chunk's CRC)
  outcome          : TaskCanceledException
  observed at      : BufferedReadStream.set_Position < PngDecoderCore.TryReadChunk < PngDecoderCore.Decode < ImageDecoderCore.Decode < PngDecoder.Decode < SpecializedImageDecoder`1.Decode
  undisposed count : +1

result=REPRODUCED: 4 buffer(s) left undisposed in cases B and C

imagesharp=4.1.2+dee414097e4be7bb35ef0209cf96bd0b61a7133a
runtime=.NET 10.0.12
os=Microsoft Windows 10.0.26300 X64
build=Release
input=generated PNG 256x256, 225226 bytes; first IDAT data at offset 62, 65535 bytes; decoder stream buffer 8096 bytes

case=A (during the chunk-data read) api=Image.IdentifyAsync
  cancelled in     : Read at 62, 65535 bytes (the chunk's data)
  outcome          : TaskCanceledException
  observed at      : BufferedReadStream.set_Position < BufferedReadStream.ReadToBufferDirectSlow < BufferedReadStream.Read < BufferedReadStreamExtensions.Read < PngDecoderCore.ReadChunkData < PngDecoderCore.TryReadChunk
  undisposed count : +1

case=A (during the chunk-data read) api=Image.LoadAsync<Rgba32>
  cancelled in     : Read at 62, 65535 bytes (the chunk's data)
  outcome          : TaskCanceledException
  observed at      : BufferedReadStream.set_Position < BufferedReadStream.ReadToBufferDirectSlow < BufferedReadStream.Read < BufferedReadStreamExtensions.Read < PngDecoderCore.ReadChunkData < PngDecoderCore.TryReadChunk
  undisposed count : +1

case=B (in the seek after the chunk-data read) api=Image.IdentifyAsync
  cancelled in     : Seek to 65597 (the end of the chunk's data)
  outcome          : TaskCanceledException
  observed at      : BufferedReadStream.Read < BufferedReadStreamExtensions.Read < PngDecoderCore.ReadChunkCrc < PngDecoderCore.ValidateChunk < PngDecoderCore.TryReadChunk < PngDecoderCore.Identify
  undisposed count : +1

case=B (in the seek after the chunk-data read) api=Image.LoadAsync<Rgba32>
  cancelled in     : Seek to 65597 (the end of the chunk's data)
  outcome          : TaskCanceledException
  observed at      : BufferedReadStream.Read < BufferedReadStreamExtensions.Read < PngDecoderCore.ReadChunkCrc < PngDecoderCore.ValidateChunk < PngDecoderCore.TryReadChunk < PngDecoderCore.Decode
  undisposed count : +1

case=C (during the CRC read) api=Image.IdentifyAsync
  cancelled in     : Read at 65597, 8096 bytes (starts with the chunk's CRC)
  outcome          : TaskCanceledException
  observed at      : BufferedReadStream.set_Position < PngDecoderCore.TryReadChunk < PngDecoderCore.Identify < ImageDecoderCore.Identify < PngDecoder.Identify < <>c__DisplayClass5_0.<IdentifyAsync>b__0
  undisposed count : +1

case=C (during the CRC read) api=Image.LoadAsync<Rgba32>
  cancelled in     : Read at 65597, 8096 bytes (starts with the chunk's CRC)
  outcome          : TaskCanceledException
  observed at      : BufferedReadStream.set_Position < PngDecoderCore.TryReadChunk < PngDecoderCore.Decode < ImageDecoderCore.Decode < PngDecoder.Decode < SpecializedImageDecoder`1.Decode
  undisposed count : +1

result=REPRODUCED: 4 buffer(s) left undisposed in cases B and C