This repository provides an MVCE for WPF issue "CroppedBitmap crashes with AccessViolationException".
It comprises a small WPF .NET 5 Visual Studio project with a single window, containing all code necessary to reproduce the issue.
-
Download this repository
-
Open, compile and debug the Visual Studio solution contained therein
-
After the compiled program's main window opens, click the "Save" toolbar button located in the upper right corner of the main window: This will call the
MainWindow::SaveImage()
method. -
Select a destination to save the expected PNG file to: The program will now try to convert the main window's content to a PNG file.
The resulting PNG file is supposed to have a size of
310,000 * 2,000
pixels. -
The WPF Runtime will refuse to encode a PNG image being this large: The PNG standard, however, allows image sizes of up to 232 * 232 pixels.
-
In the message dialog above, hit
[Yes]
to have the program split the image into slices of approx. 20,000 pixels width each. -
The WPF Runtime will then run into an
AccessViolationException
: -
Despite the fact that the corresponding member function is being decorated with the
HandleProcessCorruptedStateExceptionsAttribute
, the exception is not getting caught.
- Large PNG files cannot be encoded/created by
PngBitmapEncoder
. - Saving a PNG file larger than
20,000 * 2,000
pixels raises anAccessViolationException
. - The
AccessViolationException
cannot be caught. Thetry-catch
construct I added toSaveTiledImage
doesn't catch the exception although I have added theHandleProcessCorruptedStateExceptionsAttribute
to the corresponding method. The program is just getting aborted without any chance for me to catch the exception.
Eventually, this could be a security vulnerability.