Differential Handling of Out-of-Range Palette Indices in PNG Decoders

[fasrm]

Summary

This research demonstrates that a paletted PNG image containing a reconstructed palette index outside the declared PLTE range is accepted by multiple PNG decoders but produces different pixel outputs depending on the implementation.

Specifically:

• A PNG image declares 255 palette entries (PLTE).
• The reconstructed scanline contains palette index 255, which is outside the valid range 0–254.
• The image is accepted by both libpng and ImageMagick without error.
• The resulting decoded pixel differs across implementations.

Decoder	Output Pixel
libpng	(0,0,0)
ImageMagick	(255,255,255)

Both decoders:

• accept the PNG
• emit no error
• produce valid output

But the resulting pixel differs.

Sentinel Experiment

To test for potential out-of-bounds palette access, the last palette entry was replaced with:

(1,2,3)

Modified palette tail:

..., (6,145,1), (1,2,3)

After decoding:

libpng

first_pixel=0,0,0

ImageMagick

(255,255,255)

This indicates the pixel value is not derived from the adjacent palette entry, suggesting internal fallback handling.

Security Analysis

The behavior indicates:

invalid palette index accepted
decoder-dependent resolution

However, the experiment did not demonstrate:

memory corruption
heap overflow
out-of-bounds read
crash

Therefore the issue is best classified as:

Parser robustness issue
Specification compliance divergence

Possible CWE classifications:

CWE-20 Improper Input Validation
CWE-754 Improper Check for Exceptional Conditions

Impact

Practical impact is limited to:

inconsistent rendering across implementations

Potential implications:

• image processing inconsistencies
• undefined behavior in downstream pipelines
• subtle visual discrepancies

No direct exploit scenario was identified.

Recommendations

PNG decoders should explicitly validate palette indices.

Recommended check:

if palette_index >= palette_entries:
    return error

Alternatively, emit a warning:

libpng warning: palette index out of range

Explicit validation improves:

decoder consistency
spec compliance
defensive parsing

References

PNG Specification:

https://www.w3.org/TR/PNG/

libpng project:

https://libpng.org/pub/png/libpng.html

pngcheck:

http://www.libpng.org/pub/png/apps/pngcheck.html

ImageMagick:

https://imagemagick.org

Conclusion

This research demonstrates that out-of-range palette indices reconstructed during PNG scanline decoding are accepted silently by multiple decoders but resolved differently across implementations.

Although no exploitable memory issue was identified, the findings highlight inconsistent parser behavior and incomplete validation of semantically invalid palette indices, which may warrant further investigation in PNG decoding pipelines.

[ctruta]

Acknowledged and confirmed. Thank you very much.
The methodology is sound and the differential rendering observation is well-documented. This will be the next issue to work on.

[fintelia]

The 3rd edition PNG spec directly addresses this topic:

When decoding an indexed-color PNG, if out-of-range indexes are encountered, decoders have historically varied in their handling of this error. Displaying the pixel as opaque black is one common error recovery tactic, and is now required by this specification. Older implementations will vary, and so the behavior must not be relied on by encoders.

[fasrm]

Thank you for the confirmation and the reference to the updated PNG specification.

This clarification is very helpful, especially regarding the requirement to render out-of-range indices as opaque black.

One aspect that may still be worth exploring is the cross-implementation impact, since different decoders (especially older or non-compliant ones) may still handle these cases inconsistently. In real-world pipelines where multiple libraries are involved (e.g., validation vs processing), this could potentially lead to logic discrepancies.

I plan to continue investigating whether this behavior can have practical implications in multi-stage image processing environments.

Appreciate the feedback and looking forward to any updates on this.