Sharp: Possible image data leak when resizing a transparent GIF

[makepanic]

Hi there,
I'm seeing leaked image data when resizing a transparent GIF image.

I'm unsure if this is a issue with sharp/vips or the loader that handles GIF images.
It looks like the content of resizes leak into the resize of transparent GIF images.

Here's the output of resizing one png and a gif multiple times:

(with flatten):

(without flatten):

After transforming the png, each transformation of the transparent gif leaks leaks some information. In this minimal case, it's pretty uncommon but we've seen worse in production.

Is this a known issue that once can possibly fix by using a different configuration?
Trying to reproduce it with a transparent png, it doesn't happen :thinking:

Here's the minimal setup for the above output (note it will result in slightly different images depending on your system).

const sharp = require("sharp");
const fs = require("fs");

const fA = "top-secret.png";
const fB = "transparent.gif";

let counter = 0;

function transform(fileName) {
  return new Promise(resolve => {
    const resizer = sharp()
      .flatten(true)
      .rotate()
      .toFormat("png")
      .resize(300, 400)
      .min()
      .crop(sharp.gravity.center);

    const writeStream = fs.createWriteStream(
      `./outputs/${fileName}.${counter}.png`
    );

    writeStream.on("close", () => {
      counter++;
      resolve();
    });

    fs.createReadStream(`./inputs/${fileName}`)
      .pipe(resizer)
      .pipe(writeStream);
  });
}

async function main() {
  await transform(fA);
  await transform(fB);
  await transform(fB);
  await transform(fB);
  await transform(fB);
  await transform(fB);
  await transform(fB);
  await transform(fB);
  await transform(fB);
  await transform(fB);
  await transform(fB);
  await transform(fB);
  await transform(fB);
  await transform(fB);
  await transform(fB);
}

main().catch(e => console.error(e));

Here are the given inputs:

Do you have any ideas or suggestions on how to proceed with this?

Thanks

[lovell]

@jcupitt Should the logic for DISPOSE_DO_NOT in gifload set pixel values to zero when rendering the first frame, rather than the current approach of doing nothing?

[jcupitt]

I added something to 0 pages before load, does that fix it?

[lovell]

@jcupitt Thanks for the fast response John, your change looks good to me.

[makepanic]

Thanks for the quick fix.

@jcupitt do you know if this fix will land in libvips 8.7.0 or is it outside the current release window?

[jcupitt]

It's just snuck under the wire, so yes, in 8.7.0. Assuming it works!

[lovell]

sharp v0.21.0 is now available with a prebuilt libvips v8.7.0 that contains the upstream fix.

[makepanic]

Thanks,

I can confirm that it works with latest sharp + libvips.

Great job :+1: