Summary

The APNG parser in image_generator_apng.cc has an integer underflow in DemuxNextImage() that leads to a heap buffer overflow when processing crafted APNG images with malformed fdAT chunks.

The Bug

When converting fdAT chunks to IDAT chunks, the code subtracts 4 from data_length to remove the 4-byte sequence number (line 519):

write_header->set_data_length(c->get_data_length() - 4);

If an fdAT chunk has data_length < 4, this uint32_t subtraction underflows:

set_data_length(0 - 4) → 0xFFFFFFFC (4,294,967,292)

The underflowed value is then passed to memcpy (lines 525-527):

memcpy(write_cursor,
       reinterpret_cast<const uint8_t*>(c) + sizeof(ChunkHeader) + 4,
       write_header->get_data_length());  // copies ~4GB → heap buffer overflow

The same issue exists in the chunk_space calculation (line 477), where chunk_space -= 4 can produce an undersized allocation.

Attack Vector

Any Flutter application that loads images from external sources is affected:

Image.network('https://attacker.com/exploit.apng')

The APNG parser is registered as a default image decoder in ImageGeneratorRegistry and processes all image data with a valid PNG signature + acTL chunk. The trigger flow:

1. Attacker serves crafted APNG with an fdAT chunk whose data_length is 0
2. Frame 0 decodes normally (uses IDAT, no fdAT conversion)
3. Frame 1 triggers DemuxNextImage() on the malicious fdAT chunk
4. Integer underflow → memcpy with ~4GB length → heap buffer overflow

No user interaction is required beyond the application loading the image.

The Fix

This commit adds data_length < 4 checks in both locations:

1. chunk_space calculation (line 476): Reject malformed fdAT before computing buffer size
2. fdAT-to-IDAT conversion (line 515): Reject malformed fdAT before the subtraction

Both checks return std::make_pair(std::nullopt, nullptr) to gracefully fail the decode.

PoC

A valid APNG with this structure triggers the vulnerability:

PNG signature (8 bytes)
IHDR: 1×1 RGBA
acTL: num_frames=2, num_plays=0
fcTL: frame 0 control (1×1, offset 0,0)
IDAT: valid compressed frame 0 data
fcTL: frame 1 control (1×1, offset 0,0)
fdAT: data_length=0, sequence_number only (NO compressed data)
IEND

When loaded by a Flutter app, frame 1 decode triggers the heap overflow.

Related Prior Fixes

• PR Add mirror overrides to doctor output #56928: Added bounds check for APNG frame regions (x_offset + width)
• PR Update Dream roller documentation with latest stable roll process #57025: Fixed integer wrapping in the bounds check from Add mirror overrides to doctor output #56928
• Neither fix addressed the fdAT data_length underflow — this is a distinct vulnerability in a different code path within the same function.

Impact

• Heap buffer overflow — writes up to ~4GB past the allocated buffer
• Remote trigger — attacker serves malicious APNG from any web server
• No user interaction beyond the app loading the image
• Same vulnerability class as CVE-2023-4863 (libwebp) and CVE-2023-41064 (ImageIO)