Skip to content

fix(media): validate PNG headers - #1252

Open
Promise Emmanuel Oluwadare (promiseeuler) wants to merge 1 commit into
viamrobotics:mainfrom
promiseeuler:fix/png-header-validation
Open

fix(media): validate PNG headers#1252
Promise Emmanuel Oluwadare (promiseeuler) wants to merge 1 commit into
viamrobotics:mainfrom
promiseeuler:fix/png-header-validation

Conversation

@promiseeuler

Copy link
Copy Markdown

Summary

While using viam-sdk==0.80.0, I found that ViamImage accepts PNG data with an invalid signature or a non-IHDR first chunk and reports dimensions from those bytes. For example, an invalid payload can be reported as 640x480.

The PNG parser was constructing ValueError objects without raising them, and it compared a bytes signature with a list of integers. This change raises the validation errors and compares the signature with bytes, allowing ViamImage to fall back to unknown dimensions for malformed PNG data.

Regression coverage includes both an invalid signature with a plausible IHDR chunk and a valid signature with an invalid first chunk.

Validation

  • uv run ruff format --check src/viam/media/video.py tests/test_media.py
  • uv run ruff check src/viam/media/video.py tests/test_media.py
  • uv run pyright — 0 errors (1 existing warning in src/viam/module/types.py)
  • uv run pytest -q tests/test_media.py — 9 passed
  • uv run pytest -q — 866 passed, 5 skipped because viam-server is not installed
  • git diff --check

@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@viambot

viambot commented Aug 23, 2026

Copy link
Copy Markdown
Member

👋 Thanks for requesting a review from the team!

We aim to review PRs within one business day. If this is urgent
or blocking you, please reach out in #team-sdk and
we'll prioritize it.

@njooma Naveed Jooma (njooma) left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice find

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants