A comprehensive PNG format parser implementation in Rust demonstrating cross-field synchronization vulnerabilities in parser design.

This project implements a complete PNG image format parser with 44 intentional memory safety bugs demonstrating common vulnerabilities in format parsing and cross-field validation scenarios. The parser implements all critical and ancillary PNG chunk types with realistic processing logic.

The PNG parser is organized into modular components:

• parser.rs (900+ lines) - Main PNG parsing engine with chunk reading, validation, and multiple processing stages
• chunk.rs - Chunk type recognition and data extraction
• metadata.rs - Image metadata extraction and management
• color.rs - Color space processing and conversion
• filter.rs - PNG filter method implementations (None, Sub, Up, Average, Paeth)
• scanline.rs - Scanline data handling and row processing
• palette.rs - Palette (PLTE chunk) handling and color lookup
• animation.rs - APNG animation frame processing
• compress.rs - Compression and decompression utilities
• transform.rs - Image transformation and composition

• validation.rs (550+ lines) - 40 cross-field validation bugs
• image_buffer.rs (550+ lines) - 40 buffer management vulnerabilities
• chunk_store.rs (500+ lines) - 40 chunk storage/retrieval bugs
• render_pipeline.rs (600+ lines) - 45 transform pipeline vulnerabilities

Palette entry count vs buffer size, animation frame count vs frame table, filter count vs operation table, transform chain length vs slots, chunk count vs data size.

Width/height multiplication errors, bit-depth stride calculation misuse, interlace multiplier miscalculations, bytes-per-pixel omission.

Using wrong field for validation bounds, field values misused as array indices or multipliers, authority field confusion in cross-field checks.

Loop bound off-by-one in frame processing, allocation size one short, scanline counting errors.

Total Bugs: 44

• Palette validation: 8 bugs (palette entry count, transparency, RGB components)
• Animation: 6 bugs (frame count, frame table, timing, disposal)
• Filter operations: 7 bugs (filter type validation, scanline processing, stride calculation)
• Transform pipeline: 8 bugs (transform count, composition, state management)
• Chunk processing: 7 bugs (chunk count, type tracking, data validation)
• Buffer management: 8 bugs (allocation, bounds checking, size synchronization)

cargo build --release

Multiple fuzz targets demonstrate the vulnerabilities:

cargo run --bin png_fuzzer < input.bin
cargo run --bin chunk_fuzzer < chunk.bin
cargo run --bin metadata_fuzzer < metadata.bin
cargo run --bin transform_fuzzer < transform.bin

The poc_fXX.bin files are minimal PNG inputs crafted to trigger specific bugs:

• poc_f00.bin - Palette entry count vs buffer size (OOB read)
• poc_f01.bin - Animation frame count mismatch (buffer overflow)
• poc_f02.bin - Scanline bounds check bypass (OOB read)
• ... and 41 more PoCs, one per distinct bug

Each PoC demonstrates:

1. Root Cause - Specific field authority confusion
2. Trigger Mechanism - Minimal input needed to crash
3. ASan Detection - Distinct ASan frame for each bug
4. Crash Type - OOB read, OOB write, or use-after-free

The fix_fXX.patch files provide corrections:

• Each patch addresses a unique root cause
• Multiple PoCs may share a patch if they have identical root causes
• Patches fix the authority field usage, not just add boundary checks

All crash functions use #[inline(never)] to ensure distinct ASan stack frames, enabling precise bug identification.

Buffer access via raw pointers allows intentional out-of-bounds writes that survive -O1 optimization (-O2 would use store forwarding elimination).

OOB-write bugs use volatile writes to prevent compiler dead-store elimination.

• Color type (0-6) used as count limits
• Bit depth (1-16) used as array multipliers
• Width/height used as strides or loop bounds
• Filter method used for buffer sizing

• ✓ 8249 lines of source code
• ✓ 288 KB total size
• ✓ 44 distinct bugs
• ✓ 44 PoC binary files
• ✓ 44 vulnerability descriptions
• ✓ 21 patch files
• ✓ Fenrir.map.json metadata
• ✓ Cargo check passes

• Language: Rust 2021 Edition
• Compiler: rustc 1.70+
• Sanitizers: AddressSanitizer (cargo +nightly build -Z sanitizer=address)
• Fuzzing: libfuzzer-sys 0.4

This implementation is submitted to Fenrir 2026 as part of the PNG parser vulnerability research collection. All 44 bugs are:

1. Distinct - Each has unique root cause and fix location
2. Reproducible - PoC files trigger exact bugs on unpatched code
3. Patchable - Individual patches fix specific vulnerabilities
4. Verified - Patches eliminate respective PoC crashes

Submission Date: 2026-07-27
Author: Fenrir Tech0328 Research
Domain: PNG Format Parsing
Bugs: 44 cross-field synchronization vulnerabilities