Crash in Soul Gate upon specific encounter

[Mimigris]

Reported by Hideki via mail.

In the game Soul Gate, if you load the attached save, and press enter to start the battle, the Player may crash. It does not seem to necessarily constantly happen, but it seems to occur at least on Windows and Android (Hideki mentioned they didn't had this issue when building the Player for Linux).

The crash occurs during the battle against the troop of ID 9, which is called by the event of ID 100 in map 5, present at (0, 19), in the following script:

ConditionalBranch [var 211 == 48]      <- hero X
  ConditionalBranch [var 212 == 142]   <- hero Y
    ConditionalBranch [switch 911 == OFF]
      ControlSwitches [911 = ON]
      EnemyEncounter [0 9 0 0 0 0]     <- code 10710, troop 9, terrain background
      JumpToLabel [1]

At said moment, the player is at coordinates (48, 142), on a tile with a terrain of ID 2.

While the game has issues with its picture if you try to play (lot of libpng issues requiring conversion to properly play), it is not tied to a picture issue from what I can tell, removing all assets still leads to a crash.

Save01.zip

You can find the original bug report shared by Hideki here, what I wrote is merely a summary:
Bug report.zip

[Ghabry]

Indeed cannot confirm the crash on Linux.

---

In other news:

Wow that IDAT too far back error makes this game unplayable. I wonder what kind of broken picture editor the Japanese gamedevs use...

Asked DeepSeek to investigate this and the working solution is using a custom Huffman Parser and hooking the PNG parsing through one of the callback functions:

Kinda disgusted by the code but it works... Now that there is a "solution" can likely by simplified further.

diff --git a/src/image_png.cpp b/src/image_png.cpp
index 776ce65..fab70dc 100644
--- a/src/image_png.cpp
+++ b/src/image_png.cpp
@@ -22,20 +22,48 @@
 #include <csetjmp>
 #include <vector>
 #include <fstream>
+#include <string>
 
 #include "output.h"
 #include "image_png.h"
 
+// State shared between the libpng read callbacks and the lenient fallback
+// decoder used when libpng rejects the IDAT stream.
+struct PNGReadContext {
+	// Read source (one of the two, depending on the overload).
+	png_bytep* buffer_pos = nullptr;                  // memory-buffer mode
+	Filesystem_Stream::InputStream* stream = nullptr; // stream mode
+	// Raw IDAT payload, captured while libpng parses the file.
+	std::vector<uint8_t> idat;
+	// Last libpng error message (filled in by on_png_error).
+	std::string error_msg;
+};
+
 static void read_data(png_structp png_ptr, png_bytep data, png_size_t length) {
-	png_bytep* bufp = (png_bytep*) png_get_io_ptr(png_ptr);
-	memcpy(data, *bufp, length);
-	*bufp += length;
+	PNGReadContext* ctx = static_cast<PNGReadContext*>(png_get_io_ptr(png_ptr));
+	memcpy(data, *ctx->buffer_pos, length);
+	*ctx->buffer_pos += length;
+#ifdef PNG_IO_STATE_SUPPORTED
+	// Reuse libpng's chunk parsing to capture the IDAT payload for the
+	// lenient fallback decoder.  png_IDAT is an internal libpng symbol, so
+	// compare against the public numeric chunk type instead (0x49 'I',
+	// 0x44 'D', 0x41 'A', 0x54 'T').
+	if (png_get_io_chunk_type(png_ptr) == 0x49444154u) {
+		ctx->idat.insert(ctx->idat.end(), data, data + length);
+	}
+#endif
 }
 
 static void read_data_istream(png_structp png_ptr, png_bytep data, png_size_t length) {
-	auto* bufp = reinterpret_cast<Filesystem_Stream::InputStream*>(png_get_io_ptr(png_ptr));
-	if (bufp != nullptr && *bufp) {
-		bufp->read(reinterpret_cast<char*>(data), length);
+	PNGReadContext* ctx = static_cast<PNGReadContext*>(png_get_io_ptr(png_ptr));
+	if (ctx->stream != nullptr && *ctx->stream) {
+		ctx->stream->read(reinterpret_cast<char*>(data), length);
+		std::streamsize n = ctx->stream->gcount();
+#ifdef PNG_IO_STATE_SUPPORTED
+		if (png_get_io_chunk_type(png_ptr) == 0x49444154u && n > 0) {
+			ctx->idat.insert(ctx->idat.end(), data, data + n);
+		}
+#endif
 	}
 }
 
@@ -43,7 +71,11 @@ static void on_png_warning(png_structp, png_const_charp warn_msg) {
 	Output::Debug("libpng: {}", warn_msg);
 }
 
-static void on_png_error(png_structp, png_const_charp error_msg) {
+static void on_png_error(png_structp png_ptr, png_const_charp error_msg) {
+	PNGReadContext* ctx = static_cast<PNGReadContext*>(png_get_error_ptr(png_ptr));
+	if (ctx != nullptr) {
+		ctx->error_msg = error_msg;
+	}
 	Output::Warning("libpng: {}", error_msg);
 }
 
@@ -55,17 +87,544 @@ static void ReadRGBData(png_struct*, png_info*, png_uint_32, png_uint_32, uint32
 static void ReadRGBAData(png_struct*, png_info*, png_uint_32, png_uint_32, uint32_t*);
 
 bool ImagePNG::Read(const void* buffer, bool transparent, ImageOut& output) {
-	return ReadPNGWithReadFunction((png_voidp)&buffer, read_data, transparent, output);
+	PNGReadContext ctx;
+	ctx.buffer_pos = (png_bytep*)&buffer;
+	return ReadPNGWithReadFunction(&ctx, read_data, transparent, output);
 }
 
 bool ImagePNG::Read(Filesystem_Stream::InputStream& stream, bool transparent, ImageOut& output) {
-	return ReadPNGWithReadFunction(&stream, read_data_istream, transparent, output);
+	PNGReadContext ctx;
+	ctx.stream = &stream;
+	return ReadPNGWithReadFunction(&ctx, read_data_istream, transparent, output);
+}
+
+// ---------------------------------------------------------------------------
+// Lenient IDAT decompression (workaround for "invalid distance too far back")
+//
+// Some PNG files in the wild (including the System graphic of the game
+// Nepheshel203) contain a deflate stream whose LZ77 back-references point
+// before the start of the already decompressed output.  Modern zlib rejects
+// such streams with "IDAT: invalid distance too far back", while other
+// decoders (e.g. the one used by Windows) display the image.  libpng offers
+// no option to tolerate this (upstream treats it as a security hardening, see
+// pnggroup/libpng#125), so the only way to make the image display is to
+// inflate the IDAT data ourselves and clamp out-of-range distances (the
+// missing bytes are treated as zeroes).  libpng still does all the normal
+// parsing (IHDR/PLTE/...); this code only replaces the decompression and
+// scanline filter steps that libpng refuses to complete.
+// ---------------------------------------------------------------------------
+
+// Minimal LSB-first bit reader.
+class BitReader {
+public:
+	BitReader(const uint8_t* data, size_t size) : data_(data), size_(size) {}
+
+	unsigned Read(unsigned n) {
+		unsigned v = 0;
+		for (unsigned i = 0; i < n; ++i) {
+			if (pos_ >= size_) {
+				fail_ = true;
+				return 0;
+			}
+			v |= ((data_[pos_] >> bit_) & 1u) << i;
+			if (++bit_ == 8) {
+				bit_ = 0;
+				++pos_;
+			}
+		}
+		return v;
+	}
+
+	void AlignToByte() {
+		while (bit_ != 0 && !fail_) {
+			Read(1);
+		}
+	}
+
+	bool failed() const {
+		return fail_;
+	}
+
+private:
+	const uint8_t* data_;
+	size_t size_;
+	size_t pos_ = 0;
+	unsigned bit_ = 0;
+	bool fail_ = false;
+};
+
+// Canonical Huffman decoder.
+struct HuffmanTable {
+	int max_len = 0;
+	int bl_count[16] = {0};
+	int base_code[16] = {0};
+	// code2sym[l][code - base_code[l]] = symbol, for codes of length l.
+	std::vector<std::vector<int>> code2sym;
+
+	void Build(const std::vector<int>& lengths) {
+		max_len = 0;
+		std::memset(bl_count, 0, sizeof(bl_count));
+		std::memset(base_code, 0, sizeof(base_code));
+		for (size_t sym = 0; sym < lengths.size(); ++sym) {
+			int l = lengths[sym];
+			if (l > 0) {
+				++bl_count[l];
+				if (l > max_len) {
+					max_len = l;
+				}
+			}
+		}
+		if (max_len > 15) {
+			max_len = 0;
+			return;
+		}
+		int code = 0;
+		for (int l = 1; l <= max_len; ++l) {
+			code = (code + bl_count[l - 1]) << 1;
+			base_code[l] = code;
+		}
+		code2sym.assign(max_len + 1, {});
+		for (int l = 1; l <= max_len; ++l) {
+			code2sym[l].assign(bl_count[l], -1);
+		}
+		// Assign a code to every symbol in order.  Symbols with the same
+		// length need not be contiguous (e.g. the fixed lit/len table has
+		// 8-bit codes for symbols 0..143 and 280..287), so each symbol gets
+		// its own code instead of a "first symbol" shortcut.
+		std::vector<int> next_code(16, 0);
+		for (int l = 1; l <= max_len; ++l) {
+			next_code[l] = base_code[l];
+		}
+		for (size_t sym = 0; sym < lengths.size(); ++sym) {
+			int l = lengths[sym];
+			if (l > 0) {
+				int c = next_code[l]++;
+				code2sym[l][c - base_code[l]] = static_cast<int>(sym);
+			}
+		}
+	}
+
+	// Returns the decoded symbol or -1 if the code is invalid.
+	int Decode(BitReader& br) const {
+		int code = 0;
+		for (int l = 1; l <= max_len; ++l) {
+			code = (code << 1) | static_cast<int>(br.Read(1));
+			if (bl_count[l] != 0) {
+				int index = code - base_code[l];
+				if (index >= 0 && index < bl_count[l]) {
+					return code2sym[l][index];
+				}
+			}
+		}
+		return -1;
+	}
+};
+
+// Inflate a zlib stream, clamping out-of-range back-references to zeroes.
+// Returns false on any other error or if the output exceeds max_out.
+static bool InflateLenient(const uint8_t* data, size_t size, std::vector<uint8_t>& out, size_t max_out) {
+	BitReader br(data, size);
+
+	// zlib header.  The deflate method must be 8; the FCHECK and window size
+	// are deliberately not validated (the files we work around are already
+	// non-conformant).
+	int cmf = static_cast<int>(br.Read(8));
+	br.Read(8); // FLG
+	if (br.failed() || (cmf & 0x0f) != 8) {
+		return false;
+	}
+
+	bool final = false;
+	while (!final) {
+		final = br.Read(1) != 0;
+		int btype = static_cast<int>(br.Read(2));
+
+		if (btype == 0) {
+			// Stored (uncompressed) block.
+			br.AlignToByte();
+			int len = static_cast<int>(br.Read(16));
+			br.Read(16); // NLEN
+			if (br.failed()) {
+				return false;
+			}
+			for (int i = 0; i < len; ++i) {
+				if (out.size() >= max_out) {
+					return false;
+				}
+				out.push_back(static_cast<uint8_t>(br.Read(8)));
+				if (br.failed()) {
+					return false;
+				}
+			}
+		} else {
+			std::vector<int> litlen;
+			std::vector<int> dist;
+			if (btype == 1) {
+				// Fixed Huffman tables.
+				litlen.assign(288, 0);
+				for (int i = 0; i < 144; ++i) litlen[i] = 8;
+				for (int i = 144; i < 256; ++i) litlen[i] = 9;
+				for (int i = 256; i < 280; ++i) litlen[i] = 7;
+				for (int i = 280; i < 288; ++i) litlen[i] = 8;
+				dist.assign(32, 5);
+			} else if (btype == 2) {
+				// Dynamic Huffman tables.
+				int hlit = static_cast<int>(br.Read(5)) + 257;
+				int hdist = static_cast<int>(br.Read(5)) + 1;
+				int hclen = static_cast<int>(br.Read(4)) + 4;
+				if (hlit > 286 || hdist > 30) {
+					return false;
+				}
+				static const int cl_order[19] = {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
+				std::vector<int> cl_lengths(19, 0);
+				for (int i = 0; i < hclen; ++i) {
+					cl_lengths[cl_order[i]] = static_cast<int>(br.Read(3));
+				}
+				HuffmanTable cl;
+				cl.Build(cl_lengths);
+				std::vector<int> lengths;
+				lengths.reserve(hlit + hdist);
+				while (static_cast<int>(lengths.size()) < hlit + hdist) {
+					int s = cl.Decode(br);
+					if (s < 0 || br.failed()) {
+						return false;
+					}
+					if (s < 16) {
+						lengths.push_back(s);
+					} else if (s == 16) {
+						if (lengths.empty()) {
+							return false;
+						}
+						int prev = lengths.back();
+						int rep = static_cast<int>(br.Read(2)) + 3;
+						for (int k = 0; k < rep; ++k) lengths.push_back(prev);
+					} else if (s == 17) {
+						int rep = static_cast<int>(br.Read(3)) + 3;
+						for (int k = 0; k < rep; ++k) lengths.push_back(0);
+					} else { // 18
+						int rep = static_cast<int>(br.Read(7)) + 11;
+						for (int k = 0; k < rep; ++k) lengths.push_back(0);
+					}
+					if (br.failed()) {
+						return false;
+					}
+				}
+				litlen.assign(lengths.begin(), lengths.begin() + hlit);
+				dist.assign(lengths.begin() + hlit, lengths.end());
+			} else {
+				return false; // reserved block type
+			}
+
+			HuffmanTable lt;
+			lt.Build(litlen);
+			HuffmanTable dt;
+			dt.Build(dist);
+
+			for (;;) {
+				int sym = lt.Decode(br);
+				if (sym < 0 || br.failed()) {
+					return false;
+				}
+				if (sym < 256) {
+					if (out.size() >= max_out) {
+						return false;
+					}
+					out.push_back(static_cast<uint8_t>(sym));
+				} else if (sym == 256) {
+					break;
+				} else {
+					int li = sym - 257;
+					if (li < 0 || li >= 29) {
+						return false;
+					}
+					static const int len_base[29] = {3,4,5,6,7,8,9,10,11,13,15,17,19,23,27,31,35,43,51,59,67,83,99,115,131,163,195,227,258};
+					static const int len_extra[29] = {0,0,0,0,0,0,0,0,1,1,1,1,2,2,2,2,3,3,3,3,4,4,4,4,5,5,5,5,0};
+					int length = len_base[li] + static_cast<int>(br.Read(len_extra[li]));
+					int dsym = dt.Decode(br);
+					if (dsym < 0 || dsym >= 30 || br.failed()) {
+						return false;
+					}
+					static const int dist_base[30] = {1,2,3,4,5,7,9,13,17,25,33,49,65,97,129,193,257,385,513,769,1025,1537,2049,3073,4097,6145,8193,12289,16385,24577};
+					static const int dist_extra[30] = {0,0,0,0,1,1,2,2,3,3,4,4,5,5,6,6,7,7,8,8,9,9,10,10,11,11,12,12,13,13};
+					int distance = dist_base[dsym] + static_cast<int>(br.Read(dist_extra[dsym]));
+					if (br.failed()) {
+						return false;
+					}
+					// Copy the back-reference.  If it reaches before the start
+					// of the output the missing bytes read as zeroes.
+					size_t start = (static_cast<size_t>(distance) > out.size())
+						? out.size() : out.size() - static_cast<size_t>(distance);
+					for (int k = 0; k < length; ++k) {
+						if (out.size() >= max_out) {
+							return false;
+						}
+						size_t idx = start + k;
+						out.push_back((idx < out.size()) ? out[idx] : 0);
+					}
+				}
+			}
+		}
+	}
+	return true;
+}
+
+// Reverse a single PNG scanline filter.
+static void UnfilterRow(uint8_t filter_type, uint8_t* row, const uint8_t* prev, size_t bpp, size_t rowbytes) {
+	switch (filter_type) {
+		case 0: // None
+			break;
+		case 1: // Sub
+			for (size_t i = bpp; i < rowbytes; ++i) {
+				row[i] = static_cast<uint8_t>(row[i] + row[i - bpp]);
+			}
+			break;
+		case 2: // Up
+			for (size_t i = 0; i < rowbytes; ++i) {
+				row[i] = static_cast<uint8_t>(row[i] + prev[i]);
+			}
+			break;
+		case 3: // Average
+			for (size_t i = 0; i < rowbytes; ++i) {
+				int a = (i >= bpp) ? row[i - bpp] : 0;
+				int b = prev[i];
+				row[i] = static_cast<uint8_t>(row[i] + ((a + b) >> 1));
+			}
+			break;
+		case 4: // Paeth
+			for (size_t i = 0; i < rowbytes; ++i) {
+				int a = (i >= bpp) ? row[i - bpp] : 0;
+				int b = prev[i];
+				int c = (i >= bpp) ? prev[i - bpp] : 0;
+				int p = a + b - c;
+				int pa = std::abs(p - a);
+				int pb = std::abs(p - b);
+				int pc = std::abs(p - c);
+				int pr = (pa <= pb && pa <= pc) ? a : (pb <= pc ? b : c);
+				row[i] = static_cast<uint8_t>(row[i] + pr);
+			}
+			break;
+	}
+}
+
+// Unpack a scanline of `w` pixels of `depth` bits (1/2/4/8) into one byte per
+// pixel, MSB first (same as libpng's png_set_packing).
+static void UnpackPixels(const uint8_t* in, int depth, uint8_t* out, uint32_t w) {
+	if (depth == 8) {
+		std::memcpy(out, in, w);
+		return;
+	}
+	const uint32_t per_byte = 8 / depth;
+	const uint8_t mask = static_cast<uint8_t>((1u << depth) - 1);
+	for (uint32_t i = 0; i < w; ++i) {
+		uint8_t byte = in[i / per_byte];
+		int shift = 8 - depth * static_cast<int>((i % per_byte) + 1);
+		out[i] = static_cast<uint8_t>((byte >> shift) & mask);
+	}
+}
+
+static bool IsInvalidDistanceError(const std::string& msg) {
+	// libpng prefixes the zlib message with the chunk name, e.g.
+	// "IDAT: invalid distance too far back".  Compare case-insensitively.
+	std::string lower = msg;
+	for (size_t i = 0; i < lower.size(); ++i) {
+		char c = lower[i];
+		if (c >= 'A' && c <= 'Z') {
+			lower[i] = static_cast<char>(c - 'A' + 'a');
+		}
+	}
+	return lower.find("distance too far back") != std::string::npos;
+}
+
+// Decode a PNG whose IDAT stream modern zlib rejects with "invalid distance
+// too far back".  The image header and palette are supplied by libpng (which
+// parsed them before the error); only the non-interlaced colour types are
+// supported.  Returns false on failure.
+static bool DecodePNGWorkaround(
+	const std::vector<uint8_t>& idat,
+	uint32_t w, uint32_t h,
+	int bit_depth, int color_type, int interlace,
+	const std::vector<uint8_t>& plte,
+	bool transparent,
+	ImageOut& output
+) {
+	if (interlace != 0 || w == 0 || h == 0 || (uint64_t)w * h > 0x10000000ULL) {
+		return false;
+	}
+
+	const int depth = bit_depth;
+	size_t rowbytes = 0;
+	size_t bpp = 0; // bytes per pixel used by the scanline filters
+	int out_bpp = 0;
+	switch (color_type) {
+		case PNG_COLOR_TYPE_PALETTE: // 3
+			if (depth != 1 && depth != 2 && depth != 4 && depth != 8) return false;
+			rowbytes = (static_cast<size_t>(w) * depth + 7) / 8;
+			bpp = 1;
+			out_bpp = 8;
+			break;
+		case PNG_COLOR_TYPE_GRAY: // 0
+			if (depth != 1 && depth != 2 && depth != 4 && depth != 8 && depth != 16) return false;
+			rowbytes = (static_cast<size_t>(w) * depth + 7) / 8;
+			bpp = (depth == 16) ? 2 : 1;
+			out_bpp = 8;
+			break;
+		case PNG_COLOR_TYPE_GRAY_ALPHA: // 4
+			if (depth != 8 && depth != 16) return false;
+			rowbytes = static_cast<size_t>(w) * depth * 2 / 8;
+			bpp = depth / 8 * 2;
+			out_bpp = 8;
+			break;
+		case PNG_COLOR_TYPE_RGB: // 2
+			if (depth != 8 && depth != 16) return false;
+			rowbytes = static_cast<size_t>(w) * depth * 3 / 8;
+			bpp = depth / 8 * 3;
+			out_bpp = 24;
+			break;
+		case PNG_COLOR_TYPE_RGB_ALPHA: // 6
+			if (depth != 8 && depth != 16) return false;
+			rowbytes = static_cast<size_t>(w) * depth * 4 / 8;
+			bpp = depth / 8 * 4;
+			out_bpp = 32;
+			break;
+		default:
+			return false;
+	}
+
+	uint64_t expected = (static_cast<uint64_t>(rowbytes) + 1) * h;
+	size_t max_out = 0x40000000u; // 1 GiB safety cap
+	uint64_t want = expected * 2 + 64;
+	if (want < max_out) {
+		max_out = static_cast<size_t>(want);
+	}
+
+	std::vector<uint8_t> inflated;
+	if (!InflateLenient(idat.data(), idat.size(), inflated, max_out)) {
+		return false;
+	}
+	if (inflated.size() < expected) {
+		return false;
+	}
+
+	std::vector<uint8_t> row(rowbytes);
+	std::vector<uint8_t> prev(rowbytes, 0);
+	std::vector<uint8_t> indices(w);
+
+	uint8_t* pixels = static_cast<uint8_t*>(malloc(w * h * 4));
+	if (pixels == nullptr) {
+		return false;
+	}
+
+	const uint8_t* src = inflated.data();
+	for (uint32_t y = 0; y < h; ++y) {
+		uint8_t filter_type = src[0];
+		std::memcpy(row.data(), src + 1, rowbytes);
+		src += rowbytes + 1;
+		UnfilterRow(filter_type, row.data(), prev.data(), bpp, rowbytes);
+
+		uint8_t* dst = pixels + y * static_cast<size_t>(w) * 4;
+		switch (color_type) {
+			case PNG_COLOR_TYPE_PALETTE: {
+				UnpackPixels(row.data(), depth, indices.data(), w);
+				for (uint32_t x = 0; x < w; ++x) {
+					uint8_t idx = indices[x];
+					uint8_t r = 0, g = 0, b = 0;
+					if (static_cast<size_t>(idx) * 3 + 2 < plte.size()) {
+						r = plte[idx * 3];
+						g = plte[idx * 3 + 1];
+						b = plte[idx * 3 + 2];
+					}
+					uint8_t a = (idx == 0 && transparent) ? 0 : 255;
+					dst[x * 4 + 0] = r;
+					dst[x * 4 + 1] = g;
+					dst[x * 4 + 2] = b;
+					dst[x * 4 + 3] = a;
+				}
+				break;
+			}
+			case PNG_COLOR_TYPE_GRAY: {
+				if (depth == 16) {
+					for (uint32_t x = 0; x < w; ++x) {
+						uint8_t gray = row[x * 2];
+						uint8_t a = (transparent && gray == 0) ? 0 : 255;
+						dst[x * 4 + 0] = gray;
+						dst[x * 4 + 1] = gray;
+						dst[x * 4 + 2] = gray;
+						dst[x * 4 + 3] = a;
+					}
+				} else {
+					UnpackPixels(row.data(), depth, indices.data(), w);
+					for (uint32_t x = 0; x < w; ++x) {
+						uint8_t gray = indices[x];
+						uint8_t a = (transparent && gray == 0) ? 0 : 255;
+						dst[x * 4 + 0] = gray;
+						dst[x * 4 + 1] = gray;
+						dst[x * 4 + 2] = gray;
+						dst[x * 4 + 3] = a;
+					}
+				}
+				break;
+			}
+			case PNG_COLOR_TYPE_GRAY_ALPHA: {
+				for (uint32_t x = 0; x < w; ++x) {
+					const uint8_t* p = row.data() + x * bpp;
+					uint8_t gray = p[0];
+					uint8_t alpha = (depth == 16) ? p[2] : p[1];
+					dst[x * 4 + 0] = gray;
+					dst[x * 4 + 1] = gray;
+					dst[x * 4 + 2] = gray;
+					dst[x * 4 + 3] = alpha;
+				}
+				break;
+			}
+			case PNG_COLOR_TYPE_RGB: {
+				for (uint32_t x = 0; x < w; ++x) {
+					const uint8_t* p = row.data() + x * bpp;
+					if (depth == 16) {
+						dst[x * 4 + 0] = p[0];
+						dst[x * 4 + 1] = p[2];
+						dst[x * 4 + 2] = p[4];
+					} else {
+						dst[x * 4 + 0] = p[0];
+						dst[x * 4 + 1] = p[1];
+						dst[x * 4 + 2] = p[2];
+					}
+					dst[x * 4 + 3] = 255;
+				}
+				break;
+			}
+			case PNG_COLOR_TYPE_RGB_ALPHA: {
+				for (uint32_t x = 0; x < w; ++x) {
+					const uint8_t* p = row.data() + x * bpp;
+					if (depth == 16) {
+						dst[x * 4 + 0] = p[0];
+						dst[x * 4 + 1] = p[2];
+						dst[x * 4 + 2] = p[4];
+						dst[x * 4 + 3] = p[6];
+					} else {
+						dst[x * 4 + 0] = p[0];
+						dst[x * 4 + 1] = p[1];
+						dst[x * 4 + 2] = p[2];
+						dst[x * 4 + 3] = p[3];
+					}
+				}
+				break;
+			}
+		}
+
+		prev.swap(row);
+	}
+
+	output.pixels = pixels;
+	output.width = w;
+	output.height = h;
+	output.bpp = out_bpp;
+	return true;
 }
 
 static bool ReadPNGWithReadFunction(png_voidp user_data, png_rw_ptr fn, bool transparent, ImageOut& output) {
 	output.pixels = nullptr;
 
-	png_struct *png_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, on_png_error, on_png_warning);
+	png_struct *png_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, user_data, on_png_error, on_png_warning);
 	if (png_ptr == NULL) {
 		Output::Warning("Couldn't allocate PNG structure");
 		return false;
@@ -73,12 +632,48 @@ static bool ReadPNGWithReadFunction(png_voidp user_data, png_rw_ptr fn, bool tra
 
 	png_info *info_ptr = png_create_info_struct(png_ptr);
 	if (info_ptr == NULL) {
+		png_destroy_read_struct(&png_ptr, &info_ptr, NULL);
 		Output::Warning("Couldn't allocate PNG info structure");
 		return false;
 	}
 
 	if (setjmp(png_jmpbuf(png_ptr))) {
+		// libpng refused to decode the file (e.g. "IDAT: invalid distance too
+		// far back", which rejects files that Windows can still display).
+		// Retry with a lenient inflater that treats out-of-range LZ77
+		// distances as zeroes.  The image header and palette were already
+		// parsed by libpng, so reuse them before destroying the structures.
+		PNGReadContext* ctx = static_cast<PNGReadContext*>(user_data);
+
+		png_uint_32 w = 0, h = 0;
+		int bit_depth = 0, color_type = 0, interlace = 0;
+		png_get_IHDR(png_ptr, info_ptr, &w, &h, &bit_depth, &color_type, &interlace, NULL, NULL);
+
+		std::vector<uint8_t> plte;
+		png_colorp palette = NULL;
+		int num_palette = 0;
+		png_get_PLTE(png_ptr, info_ptr, &palette, &num_palette);
+		if (palette != NULL && num_palette > 0) {
+			plte.reserve(static_cast<size_t>(num_palette) * 3);
+			for (int i = 0; i < num_palette; ++i) {
+				plte.push_back(palette[i].red);
+				plte.push_back(palette[i].green);
+				plte.push_back(palette[i].blue);
+			}
+		}
+
 		png_destroy_read_struct(&png_ptr, &info_ptr, NULL);
+		free(output.pixels);
+		output.pixels = nullptr;
+
+		if (IsInvalidDistanceError(ctx->error_msg)) {
+			Output::Warning("libpng: {} - retrying with a lenient inflater", ctx->error_msg);
+		}
+
+		if (!ctx->idat.empty() &&
+			DecodePNGWorkaround(ctx->idat, w, h, bit_depth, color_type, interlace, plte, transparent, output)) {
+			return true;
+		}
 		return false;
 	}