{"record":{"id":"d000df8b99265fe3","repo":"SixLabors/ImageSharp","slug":"the-icon-directory-contains-an-invalid-image-resource-range","errorCode":null,"errorMessage":"The icon directory contains an invalid image resource range.","messagePattern":"The icon directory contains an invalid image resource range\\.","errorType":"exception","errorClass":"InvalidImageContentException","httpStatus":null,"severity":"error","filePath":"src/ImageSharp/Formats/Icon/IconDecoderCore.cs","lineNumber":353,"sourceCode":"    /// <summary>\n    /// Creates a seekable view bounded to one directory entry's declared payload.\n    /// </summary>\n    /// <param name=\"frameStream\">The reusable bounded payload stream.</param>\n    /// <param name=\"stream\">The containing icon stream.</param>\n    /// <param name=\"basePosition\">The absolute start of the icon resource.</param>\n    /// <param name=\"entry\">The directory entry describing the payload.</param>\n    private void SetFrameStreamBounds(IconFrameStream frameStream, BufferedReadStream stream, long basePosition, in IconDirEntry entry)\n    {\n        long available = stream.Length - basePosition;\n        uint directorySize = (uint)(IconDir.Size + (this.fileHeader.Count * IconDirEntry.Size));\n\n        // Offsets are relative to the icon resource and must not point into its directory or at or beyond its containing stream.\n        if (entry.Reserved is not 0\n            || entry.BytesInRes is 0\n            || entry.ImageOffset < directorySize\n            || entry.ImageOffset >= available)\n        {\n            throw new InvalidImageContentException(\"The icon directory contains an invalid image resource range.\");\n        }\n\n        long remaining = available - entry.ImageOffset;\n        long length = entry.BytesInRes;\n        if (length > remaining)\n        {\n            if (this.fileHeader.Count is not 1)\n            {\n                // Clamping a multi-entry resource could expose the next image payload to the current child decoder.\n                throw new InvalidImageContentException(\"The icon directory contains an invalid image resource range.\");\n            }\n\n            // Some established single-image ICO files overstate BytesInRes but contain a complete payload.\n            // The containing stream is still a safe hard boundary because no sibling image can follow it.\n            length = remaining;\n        }\n\n        frameStream.Reset(basePosition + entry.ImageOffset, length);","sourceCodeStart":335,"sourceCodeEnd":371,"githubUrl":"https://github.com/SixLabors/ImageSharp/blob/59ce6af6fc29027cda277ef62d4d1694a8acce91/src/ImageSharp/Formats/Icon/IconDecoderCore.cs#L335-L371","documentation":"Thrown in SetFrameStreamBounds when a directory entry violates resource-range invariants: Reserved is nonzero, BytesInRes is zero, or ImageOffset points into the directory itself or at/beyond the end of the containing stream. SixLabors.ImageSharp throws InvalidImageContentException because the entry cannot designate a valid embedded image payload.","triggerScenarios":"Calling Image.Load or Image.Identify on an ICO/CUR whose ICONDIRENTRY has Reserved != 0, BytesInRes == 0, ImageOffset < directory size, or ImageOffset >= stream length — e.g. corrupted directory entries or maliciously crafted offsets.","commonSituations":"Corrupted or hand-edited .ico files; files truncated after the directory so offsets exceed the stream; icon generators writing incorrect offsets; fuzzed/attacker-supplied icon inputs.","solutions":["Verify each entry: ImageOffset must be >= 6 + 16*Count and ImageOffset + BytesInRes must fit within the file","Re-export the icon with a reliable tool","Catch InvalidImageContentException and reject/treat the file as corrupt","If you generate ICO files, compute offsets from actual written payload positions, not estimates"],"exampleFix":"// before\nvar image = Image.Load(\"suspicious.ico\");\n// after\ntry\n{\n    var image = Image.Load(\"suspicious.ico\");\n}\ncatch (InvalidImageContentException)\n{\n    // directory entry points outside the icon resource\n    throw new InvalidOperationException(\"Corrupt ICO directory entry\");\n}","handlingStrategy":"try-catch","validationCode":"// each entry must satisfy: ImageOffset >= 6 + 16*count and ImageOffset + BytesInRes <= fileLength\nstatic bool EntryRangeIsValid(ReadOnlySpan<byte> ico)\n{\n    ushort count = (ushort)(ico[4] | (ico[5] << 8));\n    for (int i = 0; i < count; i++)\n    {\n        int e = 6 + 16 * i;\n        uint offset = BitConverter.ToUInt32(ico.Slice(e + 12, 4));\n        uint size = BitConverter.ToUInt32(ico.Slice(e + 8, 4));\n        if (size == 0 || offset < 6 + 16L * count || offset + size > (uint)ico.Length) return false;\n    }\n    return true;\n}","typeGuard":"static bool IsInvalidImageContent(Exception ex) => ex is InvalidImageContentException;","tryCatchPattern":"try\n{\n    var image = Image.Load(icoStream);\n}\ncatch (InvalidImageContentException)\n{\n    // entry points outside the icon resource\n    RejectCorruptIcon(icoPath);\n}","preventionTips":["Validate directory entry offsets and sizes against file length before loading","Treat untrusted icons as hostile input; validate first","Regenerate icons whose entries have Reserved != 0"],"tags":["icon","ico","resource-range","invalid-image-content"],"backgroundTag":"invalid-image-content","analyzedSha":"59ce6af6fc29027cda277ef62d4d1694a8acce91","analyzedAt":"2026-09-13T18:34:59.331Z","contentChangedAt":"2026-09-13T18:34:59.331Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}