JPEG decoder fails or corrupts the image when a stray TEM marker or reserved marker bytes appear in the stream #3237

using SixLabors.ImageSharp;
using SixLabors.ImageSharp.Formats.Jpeg;
using SixLabors.ImageSharp.PixelFormats;

static byte[] EncodeGradient(JpegEncoder encoder)
{
    using Image<Rgba32> image = new(32, 24);
    for (int y = 0; y < 24; y++)
    {
        for (int x = 0; x < 32; x++)
        {
            image[x, y] = new Rgba32((byte)(x * 8), (byte)(y * 10), (byte)((x + y) * 4));
        }
    }

    using MemoryStream ms = new();
    image.SaveAsJpeg(ms, encoder);
    return ms.ToArray();
}

// Inserts the junk bytes before every RSTn marker in the entropy-coded data after the first SOS header.
static byte[] InsertBeforeRestartMarkers(byte[] jpg, byte[] junk)
{
    int i = 2;
    while (jpg[i + 1] != 0xDA)
    {
        i += 2 + ((jpg[i + 2] << 8) | jpg[i + 3]);
    }

    i += 2 + ((jpg[i + 2] << 8) | jpg[i + 3]);

    List<byte> result = [.. jpg[..i]];
    for (; i < jpg.Length; i++)
    {
        if (jpg[i] == 0xFF && i + 1 < jpg.Length && jpg[i + 1] is >= 0xD0 and <= 0xD7)
        {
            result.AddRange(junk);
        }

        result.Add(jpg[i]);
    }

    return [.. result];
}

// 1. TEM marker straight after the APP0 segment, which follows SOI.
byte[] clean = EncodeGradient(new JpegEncoder { ColorType = JpegColorType.YCbCrRatio420 });
int app0End = 4 + ((clean[4] << 8) | clean[5]);
byte[] withTem = [.. clean[..app0End], 0xFF, 0x01, .. clean[app0End..]];
Image.Identify(withTem);                                    // InvalidImageContentException
using (Image<Rgba32> image = Image.Load<Rgba32>(withTem)) { } // InvalidImageContentException

// 2. FF 12 before every restart marker.
foreach ((bool progressive, bool interleaved) in new[] { (false, true), (false, false), (true, false) })
{
    byte[] original = EncodeGradient(new JpegEncoder
    {
        ColorType = JpegColorType.YCbCrRatio420,
        Progressive = progressive,
        Interleaved = interleaved,
        RestartInterval = 1
    });

    byte[] corrupt = InsertBeforeRestartMarkers(original, [0xFF, 0x12]);

    using Image<Rgba32> expected = Image.Load<Rgba32>(original);
    using Image<Rgba32> actual = Image.Load<Rgba32>(corrupt); // throws for the second and third layouts

    int differ = 0;
    for (int y = 0; y < 24; y++)
    {
        for (int x = 0; x < 32; x++)
        {
            differ += expected[x, y] == actual[x, y] ? 0 : 1;
        }
    }

    Console.WriteLine($"progressive={progressive} interleaved={interleaved}: {differ} of 768 pixels differ");
}