{"action":"created","issue":{"url":"https://api.github.com/repos/SixLabors/ImageSharp/issues/186","repository_url":"https://api.github.com/repos/SixLabors/ImageSharp","labels_url":"https://api.github.com/repos/SixLabors/ImageSharp/issues/186/labels{/name}","comments_url":"https://api.github.com/repos/SixLabors/ImageSharp/issues/186/comments","events_url":"https://api.github.com/repos/SixLabors/ImageSharp/issues/186/events","html_url":"https://github.com/SixLabors/ImageSharp/issues/186","id":223629719,"number":186,"title":"Some components do not check the return value of Stream.Read","user":{"login":"chausner","id":15180557,"avatar_url":"https://avatars3.githubusercontent.com/u/15180557?v=4","gravatar_id":"","url":"https://api.github.com/users/chausner","html_url":"https://github.com/chausner","followers_url":"https://api.github.com/users/chausner/followers","following_url":"https://api.github.com/users/chausner/following{/other_user}","gists_url":"https://api.github.com/users/chausner/gists{/gist_id}","starred_url":"https://api.github.com/users/chausner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chausner/subscriptions","organizations_url":"https://api.github.com/users/chausner/orgs","repos_url":"https://api.github.com/users/chausner/repos","events_url":"https://api.github.com/users/chausner/events{/privacy}","received_events_url":"https://api.github.com/users/chausner/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-04-23T11:34:17Z","updated_at":"2017-10-06T17:32:22Z","closed_at":"2017-10-06T05:42:47Z","author_association":"NONE","body":"I noticed that in many locations where data is read from a Stream the return value (number of bytes read) of Stream.Read is not checked. This is bad because of two reasons:\r\n- It is assumed that there is always enough data in the stream to read the full buffer which may not always be the case (e.g. when files are corrupted/truncated). If you do not check how many bytes were actually read you cannot detect when an unexpected end of a stream has been reached.\r\n- According to documentation, Stream implementations are free to read less than the number of requested bytes. While I think this case does not happen in practice with typical FileStream implementations, it is very common for NetworkStreams, for example. In any case, it should be treated as an implementation detail and not relied upon. The correct way to read a certain number of bytes from a stream is to use BinaryReader.Read or BinaryReader.ReadBytes. These methods are guaranteed to return less data only if the end of the stream has been reached.\r\n"},"comment":{"url":"https://api.github.com/repos/SixLabors/ImageSharp/issues/comments/334820496","html_url":"https://github.com/SixLabors/ImageSharp/issues/186#issuecomment-334820496","issue_url":"https://api.github.com/repos/SixLabors/ImageSharp/issues/186","id":334820496,"user":{"login":"chausner","id":15180557,"avatar_url":"https://avatars3.githubusercontent.com/u/15180557?v=4","gravatar_id":"","url":"https://api.github.com/users/chausner","html_url":"https://github.com/chausner","followers_url":"https://api.github.com/users/chausner/followers","following_url":"https://api.github.com/users/chausner/following{/other_user}","gists_url":"https://api.github.com/users/chausner/gists{/gist_id}","starred_url":"https://api.github.com/users/chausner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chausner/subscriptions","organizations_url":"https://api.github.com/users/chausner/orgs","repos_url":"https://api.github.com/users/chausner/repos","events_url":"https://api.github.com/users/chausner/events{/privacy}","received_events_url":"https://api.github.com/users/chausner/received_events","type":"User","site_admin":false},"created_at":"2017-10-06T17:32:22Z","updated_at":"2017-10-06T17:32:22Z","author_association":"NONE","body":"I remain convinced that the current way how components read from streams is incorrect and should be avoided. While it may \"work in practice\" in 99% of all cases, it is still wrong. I am not sure if any changes have been made since I reported this issue but last time I checked, ImageSharp would not recognize invalid, truncated images, for example, due to exactly that issue."}}
{"actor":{"display_login":"chausner"}}