Images: refuse a zlib stream that asks for a preset dictionary (FDICT)

[nathanpond]

What this changes

A zlib header with the FDICT bit set asks for a preset dictionary rather than being corrupt.
zlib answers Z_NEED_DICT and .NET raises ZLibException — an IOException, outside the
InvalidDataException family that both image inflaters caught and outside every clause of the
ImageReader.TryRead net. Two bytes of a PNG IDAT or a TIFF Deflate strip therefore took the
whole conversion down. Both decoders now refuse it as the ImageFormatException each already
raises for a corrupt stream, and the net gains the type behind them.

The catch says IOException rather than ZLibException because the latter cannot be named: it
is public in System.IO.Compression but absent from the net10.0 reference assembly, so it does
not exist at compile time. The width costs nothing on these paths — the only stream is a
MemoryStream over a byte array already in hand, which performs no I/O, so an IOException
there can only have come from the inflater. That reasoning is written out at each site.

Found by the scheduled fuzz job:
run 33303663302, target image.
The TIFF half was not in the crash — it was found by reading, and confirmed by a test that fails
without the fix.

Linked issue

Refs #296

How it was verified

• dotnet build n8PDF.sln -c Release -warnaserror is clean (warnings are errors)
• dotnet test n8PDF.sln -c Release passes, with the external checkers on
  (N8PDF_REQUIRE_QPDF=1 N8PDF_REQUIRE_FONTTOOLS=1 N8PDF_REQUIRE_FRIBIDI=1) — 4833 passed,
  0 failed, 6 skipped (the 3-D chart instrument probes). Run on the Mac with Word, so all 143
  comparison fixtures ran, not CI's 97.
• No golden trace moved — this changes only which exceptions are refused, never output.
• No new PackageReference in src/n8PDF; the public surface is unchanged.

Each of the three new tests was confirmed to fail without the fix, with
System.IO.Compression.ZLibException — including the TIFF one, so that hole was real rather than
hypothetical.

FUZZ_TARGET=image ... replay passes over a freshly seeded corpus (6 inputs, 0 escaped).

Notes for the reviewer

• Tests are at the decoders (PngHostileTests, ImageDecoderHostileTests) so the TryRead net
  cannot swallow the evidence, per the standing rule from Images/PngDecoder: IDAT is inflated into an unbounded MemoryStream with no cap against the header's expected size #2/Images/PngDecoder: InvalidDataException from ZLibStream on a corrupt IDAT escapes uncaught and aborts the conversion #7/Images/TiffDecoder: malformed Deflate strip data throws InvalidDataException straight out of the decoder #35, plus libFuzzer's minimised
  unit asserted through TryRead.
• The minimised unit is seeded by fuzz/Program.cs rather than committed: fuzz/corpus/ is
  gitignored, and CI carries the corpus in the Actions cache, seeding only when it is empty. The
  issue's acceptance criterion said "commit it to fuzz/corpus/image/" — that was written before
  I noticed the gitignore, and seeding is the equivalent durable mechanism.
• PdfFilters.FlateDecode shares the shape but is deliberately left alone: it only ever reads
  bytes we wrote ourselves, so it is not on the attack surface.

🤖 Generated with Claude Code

https://claude.ai/code/session_01W69hdtqDC6ewHMXnZdAysZ