Harden codec and metadata input validation

src/ImageSharp/ColorProfiles/Icc/Calculators/ClutCalculator.cs

@@ -42,6 +42,10 @@ public ClutCalculator(IccClut clut)
         Guard.NotNull(clut, nameof(clut));
         Guard.MustBeGreaterThan(clut.InputChannelCount, 0, nameof(clut.InputChannelCount));
         Guard.MustBeGreaterThan(clut.OutputChannelCount, 0, nameof(clut.OutputChannelCount));
+        if (clut.InputChannelCount > 4 || clut.OutputChannelCount > 4)
+        {
+            throw new InvalidIccProfileException("ICC conversion supports at most four input and output channels.");
+        }
 
         this.inputCount = clut.InputChannelCount;
         this.outputCount = clut.OutputChannelCount;

src/ImageSharp/ColorProfiles/Icc/Calculators/LutEntryCalculator.cs

@@ -59,6 +59,11 @@ private static Vector4 CalculateLut(LutCalculator[] lut, Vector4 value)
 
     private void Init(IccLut[] inputCurve, IccLut[] outputCurve, IccClut clut, Matrix4x4 matrix)
     {
+        if (inputCurve.Length > 4 || outputCurve.Length > 4)
+        {
+            throw new InvalidIccProfileException("ICC conversion supports at most four input and output channels.");
+        }
+
         this.inputCurve = InitLut(inputCurve);
         this.outputCurve = InitLut(outputCurve);
         this.clutCalculator = new ClutCalculator(clut);

src/ImageSharp/ColorProfiles/Icc/Calculators/TrcCalculator.cs

@@ -15,6 +15,10 @@ internal class TrcCalculator : IVector4Calculator
     public TrcCalculator(IccTagDataEntry[] entries, bool inverted)
     {
         Guard.NotNull(entries, nameof(entries));
+        if (entries.Length > 4)
+        {
+            throw new InvalidIccProfileException("ICC conversion supports at most four tone response curves.");
+        }
 
         this.calculators = new ISingleCalculator[entries.Length];
         for (int i = 0; i < entries.Length; i++)

src/ImageSharp/Common/Extensions/BufferedReadStreamExtensions.cs

@@ -0,0 +1,72 @@
+// Copyright (c) Six Labors.
+// Licensed under the Six Labors Split License.
+
+using SixLabors.ImageSharp.IO;
+
+namespace SixLabors.ImageSharp;
+
+/// <summary>
+/// Extension methods for the <see cref="BufferedReadStream"/> type.
+/// </summary>
+internal static class BufferedReadStreamExtensions
+{
+    /// <summary>
+    /// Determines whether the complete read range is contained in the stream.
+    /// </summary>
+    /// <param name="stream">The stream containing the data.</param>
+    /// <param name="offset">The absolute start of the range.</param>
+    /// <param name="length">The number of bytes in the range.</param>
+    /// <returns>Whether the range is contained in the stream.</returns>
+    public static bool IsReadRangeValid(this BufferedReadStream stream, long offset, ulong length)
+    {
+        // Compare the offset first so subtraction cannot underflow, and avoid
+        // adding an untrusted length to the offset where it could wrap around.
+        ulong streamLength = (ulong)stream.Length;
+        return (ulong)offset <= streamLength && length <= streamLength - (ulong)offset;
+    }
+
+    /// <summary>
+    /// Gets a buffer length when the complete read fits in both the stream and an integer-sized buffer.
+    /// </summary>
+    /// <param name="stream">The stream containing the data.</param>
+    /// <param name="length">The declared length in bytes.</param>
+    /// <param name="bufferLength">The validated length, or zero when the range is invalid.</param>
+    /// <returns>Whether the complete read is valid.</returns>
+    public static bool TryGetReadLength(this BufferedReadStream stream, ulong length, out int bufferLength)
+    {
+        if (length > int.MaxValue || !stream.IsReadRangeValid(stream.Position, length))
+        {
+            bufferLength = 0;
+            return false;
+        }
+
+        bufferLength = (int)length;
+        return true;
+    }
+
+    /// <summary>
+    /// Reads data from the stream into a slice of the provided buffer.
+    /// </summary>
+    /// <param name="stream">The stream.</param>
+    /// <param name="buffer">The buffer.</param>
+    /// <param name="offset">The offset within the buffer where bytes are read into.</param>
+    /// <param name="count">The number of bytes, if available, to read.</param>
+    /// <returns>The actual number of bytes read.</returns>
+    public static int Read(this BufferedReadStream stream, Span<byte> buffer, int offset, int count)
+        => stream.Read(buffer.Slice(offset, count));
+
+    /// <summary>
+    /// Advances the stream by the specified number of bytes. Nonpositive counts are ignored.
+    /// </summary>
+    /// <param name="stream">The stream.</param>
+    /// <param name="count">The number of bytes to skip.</param>
+    public static void Skip(this BufferedReadStream stream, int count)
+    {
+        if (count > 0)
+        {
+            // BufferedReadStream is always seekable; its position setter preserves
+            // buffered data when the destination is inside the current buffer.
+            stream.Position += count;
+        }
+    }
+}

src/ImageSharp/Common/Extensions/StreamExtensions.cs

@@ -1,8 +1,6 @@
 // Copyright (c) Six Labors.
 // Licensed under the Six Labors Split License.
 
-using System.Buffers;
-
 namespace SixLabors.ImageSharp;
 
 /// <summary>
@@ -19,53 +17,4 @@ internal static class StreamExtensions
     /// <param name="count">The number of bytes to write to the stream.</param>
     public static void Write(this Stream stream, Span<byte> buffer, int offset, int count)
         => stream.Write(buffer.Slice(offset, count));
-
-    /// <summary>
-    /// Reads data from a stream into the provided buffer.
-    /// </summary>
-    /// <param name="stream">The stream.</param>
-    /// <param name="buffer">The buffer.</param>
-    /// <param name="offset">The offset within the buffer where the bytes are read into.</param>
-    /// <param name="count">The number of bytes, if available, to read.</param>
-    /// <returns>The actual number of bytes read.</returns>
-    public static int Read(this Stream stream, Span<byte> buffer, int offset, int count)
-        => stream.Read(buffer.Slice(offset, count));
-
-    /// <summary>
-    /// Skips the number of bytes in the given stream.
-    /// </summary>
-    /// <param name="stream">The stream.</param>
-    /// <param name="count">A byte offset relative to the origin parameter.</param>
-    public static void Skip(this Stream stream, int count)
-    {
-        if (count < 1)
-        {
-            return;
-        }
-
-        if (stream.CanSeek)
-        {
-            stream.Seek(count, SeekOrigin.Current);
-            return;
-        }
-
-        byte[] buffer = ArrayPool<byte>.Shared.Rent(count);
-        try
-        {
-            while (count > 0)
-            {
-                int bytesRead = stream.Read(buffer, 0, count);
-                if (bytesRead == 0)
-                {
-                    break;
-                }
-
-                count -= bytesRead;
-            }
-        }
-        finally
-        {
-            ArrayPool<byte>.Shared.Return(buffer);
-        }
-    }
 }

src/ImageSharp/Common/Helpers/ColorNumerics.cs

@@ -26,8 +26,7 @@ internal static class ColorNumerics
     /// The number of luminance levels (256 for 8 bit, 65536 for 16 bit grayscale images).
     /// </param>
     [MethodImpl(MethodImplOptions.AggressiveInlining)]
-    public static int GetBT709Luminance(Vector4 vector, int luminanceLevels)
-        => (int)MathF.Round(Vector4.Dot(vector, Bt709) * (luminanceLevels - 1));
+    public static int GetBT709Luminance(Vector4 vector, int luminanceLevels) => (int)MathF.Round(Vector4.Dot(vector, Bt709) * (luminanceLevels - 1));
 
     /// <summary>
     /// Gets the luminance from the rgb components using the formula