A python script to see if images have residual data after cropping (CVE-2023-21036).

detect_bad_crop.ps1

if ($args.Count -eq 0) {
    Write-Host "Usage: $($MyInvocation.MyCommand.Name) png_file1 png_file2 ..."
    exit 1
}

# Byte arrays can be defined with decimal or hex.
$PNG_SIGNATURE = [byte[]]@(137, 80, 78, 71, 13, 10, 26, 10)
[byte[]] $STANDARD_IEND = @(0x00, 0x00, 0x00, 0x00, 0x49, 0x45, 0x4E, 0x44, 0xAE, 0x42, 0x60, 0x82)

# Notes:
#[System.Text.Encoding]::ASCII.GetString($STANDARD_IEND)
#((Get-Content (Resolve-Path $fn) -Encoding ASCII) -like "*IEND*").Length
foreach ($filename in $args) {
    try {
        $f = Resolve-Path $filename
        $all_bytes = [System.IO.File]::ReadAllBytes($f)
        #all_bytes = Get-Content $f -Encoding byte

        $count = 0

        for ($i = 0; $i -le ($all_bytes.Length - $STANDARD_IEND.Length); $i++) {
            for ($j = 0; $j -lt $STANDARD_IEND.Length -and $all_bytes[$i + $j] -eq $STANDARD_IEND[$j]; $j++) {}
            if ($j -ge $STANDARD_IEND.Length) { 
                #Write-Host $i
                $count++
            } 
        }

        #OR
        #([regex]::Matches($bs, $s )).count

        if ($count -gt 1) {
            # Additional data found after footer likely.
            Write-Host $filename $count
        }
    } 
    catch {
        Write-Error "Failed to process $(filename):  $_"
    }
}