Repository: go
Issue: image/png: `fatal error: runtime: out of memory` via `(*decoder).parseIDAT`
Labels: NeedsInvestigation

<!--
Please answer these questions before submitting your issue. Thanks!
-->

### What version of Go are you using (`go version`)?

<pre>
$ go version
go version go1.17.8 linux/amd64
</pre>

### Does this issue reproduce with the latest release?

Yes

### What operating system and processor architecture are you using (`go env`)?

<details><summary><code>go env</code> Output</summary><br><pre>
$ go env
GO111MODULE="auto"
GOARCH="amd64"
GOBIN="/home/zjx/workspace/gowork/bin"
GOCACHE="/home/zjx/.cache/go-build"
GOENV="/home/zjx/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/zjx/workspace/gowork/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/zjx/workspace/gowork"
GOPRIVATE=""
GOPROXY="https://goproxy.cn,direct"
GOROOT="/home/zjx/.local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/home/zjx/.local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17.8"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/zjx/workspace/gowork/src/go-fdg-exmaples/std/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build1878510231=/tmp/go-build -gno-record-gcc-switches"
</pre></details>


### What did you do?

<!--
If possible, provide a recipe for reproducing the error.
A complete runnable program is good.
A link on go.dev/play is best.
-->
I attempt to decode an png data, and the details can be seen at:

[go.dev/play](https://go.dev/play/p/_nutPRVWz04)


### What did you expect to see?

It decodes the data successfully or just returns an error

### What did you see instead?
It triggered a fatal error like:

<details><summary><code>go env</code> Output</summary><br><pre>
fatal error: runtime: out of memory

runtime stack:
runtime.throw({0x4af45e, 0x31ce0000000})
        /home/zjx/.local/go/src/runtime/panic.go:1198 +0x71
runtime.sysMap(0xc000400000, 0x426780, 0x7fff08857758)
        /home/zjx/.local/go/src/runtime/mem_linux.go:169 +0x96
runtime.(*mheap).grow(0x5652e0, 0x18e70000)
        /home/zjx/.local/go/src/runtime/mheap.go:1393 +0x225
runtime.(*mheap).allocSpan(0x5652e0, 0x18e70000, 0x0, 0x1)
        /home/zjx/.local/go/src/runtime/mheap.go:1179 +0x165
runtime.(*mheap).alloc.func1()
        /home/zjx/.local/go/src/runtime/mheap.go:913 +0x69
runtime.systemstack()
        /home/zjx/.local/go/src/runtime/asm_amd64.s:383 +0x49

goroutine 1 [running]:
runtime.systemstack_switch()
        /home/zjx/.local/go/src/runtime/asm_amd64.s:350 fp=0xc00010da00 sp=0xc00010d9f8 pc=0x458e20
runtime.(*mheap).alloc(0x0, 0xc00010daa8, 0x6f, 0x0)
        /home/zjx/.local/go/src/runtime/mheap.go:907 +0x73 fp=0xc00010da50 sp=0xc00010da00 pc=0x422ab3
runtime.(*mcache).allocLarge(0x40b3fe, 0x31ce0000000, 0x87, 0x1)
        /home/zjx/.local/go/src/runtime/mcache.go:227 +0x89 fp=0xc00010dab0 sp=0xc00010da50 pc=0x413949
runtime.mallocgc(0x31ce0000000, 0x499220, 0x1)
        /home/zjx/.local/go/src/runtime/malloc.go:1088 +0x5c5 fp=0xc00010db30 sp=0xc00010dab0 pc=0x40bb45
runtime.makeslice(0xc0001b6000, 0x0, 0xc00010db98)
        /home/zjx/.local/go/src/runtime/slice.go:98 +0x52 fp=0xc00010db58 sp=0xc00010db30 pc=0x444892
image.NewNRGBA64({{0x0, 0x0}, {0xc00010dc18, 0x1000000465c25}})
        /home/zjx/.local/go/src/image/image.go:601 +0x66 fp=0xc00010dbd0 sp=0xc00010db58 pc=0x489fa6
image/png.(*decoder).readImagePass(0xc0000d7000, {0x7f125c277030, 0xc000180050}, 0x0, 0x0)
        /home/zjx/.local/go/src/image/png/reader.go:493 +0x7b6 fp=0xc00010dda0 sp=0xc00010dbd0 pc=0x48c7f6
image/png.(*decoder).decode(0xc0000d7000)
        /home/zjx/.local/go/src/image/png/reader.go:372 +0x1af fp=0xc00010de70 sp=0xc00010dda0 pc=0x48bb0f
image/png.(*decoder).parseIDAT(0xc0000d7000, 0xd7078)
        /home/zjx/.local/go/src/image/png/reader.go:849 +0x25 fp=0xc00010de88 sp=0xc00010de70 pc=0x48f6e5
image/png.(*decoder).parseChunk(0xc0000d7000)
        /home/zjx/.local/go/src/image/png/reader.go:908 +0x128 fp=0xc00010def8 sp=0xc00010de88 pc=0x48f888
image/png.Decode({0x4cb540, 0xc0001a6000})
        /home/zjx/.local/go/src/image/png/reader.go:967 +0x11b fp=0xc00010df60 sp=0xc00010def8 pc=0x48fe5b
main.main()
        /home/zjx/workspace/gowork/src/go-fdg-exmaples/std/image/png/pocTestIncolplete/poc.go:9 +0x56 fp=0xc00010df80 sp=0xc00010df60 pc=0x4903b6
runtime.main()
        /home/zjx/.local/go/src/runtime/proc.go:255 +0x227 fp=0xc00010dfe0 sp=0xc00010df80 pc=0x4324a7
runtime.goexit()
        /home/zjx/.local/go/src/runtime/asm_amd64.s:1581 +0x1 fp=0xc00010dfe8 sp=0xc00010dfe0 pc=0x45af01
exit status 2

</pre></details>

Found by [go-fuzz](https://github.com/dvyukov/go-fuzz),