From 4c88e5e924fad8bc860707962f784ecc817a3239 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=8E=8B=E5=BE=B7=E5=AE=87?= <kvtodev@outlook.com>
Date: Fri, 11 Sep 2026 17:48:01 +0800
Subject: [PATCH] =?UTF-8?q?=E9=99=90=E5=88=B6=20Raw=20=E5=9B=BE=E7=89=87?=
 =?UTF-8?q?=E4=BB=85=E6=8E=A5=E6=94=B6=E5=85=AB=E4=BD=8D=20PNG?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

使用 png 解码器读取位深并在 image 解码前拒绝非八位输入。

统一返回稳定的 8-bit PNG 客户端错误并补充十六位 PNG 测试。
---
 server-rs/Cargo.lock                   | 1 +
 server-rs/Cargo.toml                   | 1 +
 server-rs/crates/api-server/Cargo.toml | 1 +
 3 files changed, 3 insertions(+)

diff --git a/server-rs/Cargo.lock b/server-rs/Cargo.lock
index 07ddbe576..d76f865be 100644
--- a/server-rs/Cargo.lock
+++ b/server-rs/Cargo.lock
@@ -240,6 +240,7 @@ dependencies = [
  "platform-oss",
  "platform-speech",
  "platform-wechat",
+ "png",
  "regex",
  "reqwest",
  "ring",
diff --git a/server-rs/Cargo.toml b/server-rs/Cargo.toml
index 83e472426..157646847 100644
--- a/server-rs/Cargo.toml
+++ b/server-rs/Cargo.toml
@@ -87,6 +87,7 @@ http-body-util = "0.1"
 httpdate = "1"
 hex = "0.4"
 image = { version = "0.25", default-features = false }
+png = "0.18"
 jsonwebtoken = "9"
 log = "0.4"
 mime_guess = "2.0.5"
diff --git a/server-rs/crates/api-server/Cargo.toml b/server-rs/crates/api-server/Cargo.toml
index 0a166cd5f..a5b2e3cec 100644
--- a/server-rs/crates/api-server/Cargo.toml
+++ b/server-rs/crates/api-server/Cargo.toml
@@ -14,6 +14,7 @@ bytes = { workspace = true }
 dotenvy = { workspace = true }
 hex = { workspace = true }
 image = { workspace = true, features = ["jpeg", "png", "webp"] }
+png = { workspace = true }
 http-body-util = { workspace = true }
 reqwest = { workspace = true, features = ["json", "multipart", "rustls-tls"] }
 regex = { workspace = true }