From bf97a92bc62bfba894e1f2a641c2bbd885f0f75e Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Fri, 14 May 2021 13:18:49 +1000
Subject: [PATCH] Ensure PNG seeks to end of previous chunk at start of
 load_end

---
 Tests/images/padded_idat.png | Bin 0 -> 104 bytes
 Tests/test_file_png.py       |  17 +++++++++++++++++
 src/PIL/PngImagePlugin.py    |   2 ++
 3 files changed, 19 insertions(+)
 create mode 100644 Tests/images/padded_idat.png

diff --git a/Tests/images/padded_idat.png b/Tests/images/padded_idat.png
new file mode 100644
index 0000000000000000000000000000000000000000..18c5a4990cdcaf8b31f71ee20f88c85d291de263
GIT binary patch
literal 104
zcmeAS@N?(olHy`uVBq!ia0y~yU<5K5xHv#$-PijWKuX`!#WAE}&f5!)f(#5i%^S-8
rx%#v93$e=hZjU`?*}%5|8QZ?gVHD1NmlhaZ1Tw<Y)z4*}Q$iB}FQpxA

literal 0
HcmV?d00001

diff --git a/Tests/test_file_png.py b/Tests/test_file_png.py
index 15d74ca6b..0356873af 100644
--- a/Tests/test_file_png.py
+++ b/Tests/test_file_png.py
@@ -628,6 +628,23 @@ class TestFilePng:
         with Image.open("Tests/images/hopper_idat_after_image_end.png") as im:
             assert im.text == {"TXT": "VALUE", "ZIP": "VALUE"}
 
+    def test_padded_idat(self):
+        # This image has been manually hexedited
+        # so that the IDAT chunk has padding at the end
+        # Set MAXBLOCK to the length of the actual data
+        # so that the decoder finishes reading before the chunk ends
+        MAXBLOCK = ImageFile.MAXBLOCK
+        ImageFile.MAXBLOCK = 45
+        ImageFile.LOAD_TRUNCATED_IMAGES = True
+
+        with Image.open("Tests/images/padded_idat.png") as im:
+            im.load()
+
+            ImageFile.MAXBLOCK = MAXBLOCK
+            ImageFile.LOAD_TRUNCATED_IMAGES = False
+
+            assert_image_equal_tofile(im, "Tests/images/bw_gradient.png")
+
     def test_specify_bits(self, tmp_path):
         im = hopper("P")
 
diff --git a/src/PIL/PngImagePlugin.py b/src/PIL/PngImagePlugin.py
index 07bbc5228..8f0d566d1 100644
--- a/src/PIL/PngImagePlugin.py
+++ b/src/PIL/PngImagePlugin.py
@@ -920,6 +920,8 @@ class PngImageFile(ImageFile.ImageFile):
 
     def load_end(self):
         """internal: finished reading image data"""
+        if self.__idat != 0:
+            self.fp.read(self.__idat)
         while True:
             self.fp.read(4)  # CRC