image/png: nil deref

[dvyukov]

go version devel +8ea2438 Fri Apr 17 13:44:30 2015 +0300 linux/amd64

The following program crashes with nil deref:

package main

import (
    "bytes"
    "encoding/hex"
    "image/png"
)

func main() {
    data, _ := hex.DecodeString("89504e470d0a1a0a0000000d49484452000000300000003008060000005702f9" +
        "870000000467414d41000186a031e8965f000000e5494441545885d596c10a83" +
        "301044a7e0417fcb7eb7fdadf6961e06039286266693cc7a188645e43dd6a08f" +
        "1042003e2fe09aef6472737e183d27335fcee2f35a77b702ebce742870a23397" +
        "f3edf2705dd10160f3b2815fe8ecf2027974a6b0c03f74a6e4192843e75c6c03" +
        "35e8ec3202f5e84c0181bbe8cca967a00d9df3491bb040671f2e6087ce1c2860" +
        "8d1e05f8c7ee0f1d00b667e70df44467ef26d01fbd9bc028f42860f71d188bce" +
        "fb8d3630039dbd59601e7ab3c06cf428507f0634d039afdc80123a7bb1801e7a" +
        "b1802a7a14c89f016d74ce331bf080ce9e08f8414f04bca133bfe642fe5e4e20" +
        "bec50000000049454e44ae426082")
    img, err := png.Decode(bytes.NewReader(data))
    if err != nil {
        return
    }
    var w bytes.Buffer
    err = png.Encode(&w, img)
    if err != nil {
        panic(err)
    }
}

panic: runtime error: invalid memory address or nil pointer dereference
[signal 0xb code=0x1 addr=0x28 pc=0x45f4fb]

goroutine 1 [running]:
runtime.gopanic(0x527700, 0xc20800a270)
    src/runtime/panic.go:477 +0x402 fp=0xc208041cb0 sp=0xc208041c30
runtime.panicmem()
    src/runtime/panic.go:42 +0x52 fp=0xc208041cd8 sp=0xc208041cb0
runtime.sigpanic()
    src/runtime/sigpanic_unix.go:24 +0x2bf fp=0xc208041d28 sp=0xc208041cd8
image/png.(*Encoder).Encode(0xc20800a620, 0x7f66bc63a470, 0xc20804a070, 0x0, 0x0, 0x0, 0x0)
    src/image/png/writer.go:484 +0x4b fp=0xc208041e90 sp=0xc208041d28
image/png.Encode(0x7f66bc63a470, 0xc20804a070, 0x0, 0x0, 0x0, 0x0)
    src/image/png/writer.go:476 +0x6c fp=0xc208041ed0 sp=0xc208041e90
main.main()
    png.go:25 +0x1aa fp=0xc208041f90 sp=0xc208041ed0

[syst3mw0rm]

png.Decode should either return non-nil image.Image object or non-nil error. Both img and err are nil in this case.