From 6abffd442d6865a72056b305a31a604b83d087d8 Mon Sep 17 00:00:00 2001
From: Curtis 'Fjord' Hawthorne <fjord@openai.com>
Date: Fri, 6 Nov 2026 20:48:17 +0000
Subject: [PATCH] Test rejection of PNGs with readable dimensions but corrupt
 pixels (#59980)

Add a regression test that corrupts a PNG's compressed pixel data while
preserving readable dimensions. Verify that `load_for_prompt_bytes` returns
`ImageProcessingError::Decode` in `ORIGINAL_DETAIL` mode even when the image
is small enough to pass through without resizing.

GitOrigin-RevId: 92d9239b469d3e3cf4437eb6fecbf7c11d0bcc7a
---
 codex-rs/utils/image/src/image_tests.rs | 28 +++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/codex-rs/utils/image/src/image_tests.rs b/codex-rs/utils/image/src/image_tests.rs
index 0527de0f90..693c0fefd4 100644
--- a/codex-rs/utils/image/src/image_tests.rs
+++ b/codex-rs/utils/image/src/image_tests.rs
@@ -323,6 +323,34 @@ async fn fails_cleanly_for_invalid_images() {
     ));
 }
 
+#[test]
+fn rejects_png_with_readable_dimensions_and_corrupt_pixels() {
+    let image = ImageBuffer::from_pixel(100, 100, Rgba([10u8, 20, 30, 255]));
+    let mut bytes = image_bytes(&image, ImageFormat::Png);
+    let idat = bytes
+        .windows(4)
+        .position(|chunk_type| chunk_type == b"IDAT")
+        .expect("PNG has an IDAT chunk");
+    // Damage the compressed pixel data while keeping the PNG header intact.
+    bytes[idat + 4] ^= 0xff;
+
+    let dimensions = ImageReader::with_format(Cursor::new(&bytes), ImageFormat::Png)
+        .into_dimensions()
+        .expect("dimensions should still be readable");
+    assert_eq!(dimensions, (100, 100));
+
+    let error = load_for_prompt_bytes(
+        Path::new("corrupt.png"),
+        bytes,
+        PromptImageMode::ORIGINAL_DETAIL,
+    )
+    .expect_err("even a PNG small enough to pass through must have decodable pixels");
+    assert!(
+        matches!(error, ImageProcessingError::Decode { .. }),
+        "{error}"
+    );
+}
+
 #[tokio::test(flavor = "multi_thread")]
 async fn reprocesses_updated_file_contents() {
     IMAGE_CACHE.clear();