This issue looks similar to Bug ID - 712637, so assigning to the concern owner.
@mmoroz -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Another OOM with PNGs... Leon, mind taking a look?

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=6305490540953600

I've also uploaded the testcase to test it against ASan build, since MSan has a large memory overhead.

ClusterFuzz has detected this issue as fixed in range 465939:466781.

Detailed report: https://clusterfuzz.com/testcase?key=5087281351491584

Fuzzer: libfuzzer_blink_png_decoder_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Out-of-memory (exceeds 2048 MB)
Crash Address: 
Crash State:
  blink_png_decoder_fuzzer
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=465908:465939
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=465939:466781

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5087281351491584


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5087281351491584 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This seems to be the same as  issue 673082 . In that issue, we decided to silence the fuzzer. (Note that this is a different fuzzer. That one tests libpng directly, and this one tests blink::PNGImageDecoder, which uses libpng.)

In that issue [1], I pointed out that this is a bug in libpng that has been fixed in version 1.6.25.

There was a related  issue 701957 . In that issue, we decided to update some libpng settings to avoid the OOM. (These settings are ignored for this particular allocation until 1.6.25.)

[1] Specifically: https://bugs.chromium.org/p/chromium/issues/detail?id=673082#c22

Thanks for taking a look! It's also unclear why CF has marked the issue as fixed, this is being tracked as issue 715113.

Bulk-WontFixing these bugs. This was a bug on ClusterFuzz side, see bug 717534. We will start seeing new testcases auto-filed in a day or two. We can't leave these open as ClusterFuzz won't autoverify them after ClusterFuzz-Wrong label.

We have made a bunch of changes on ClusterFuzz side, so resetting ClusterFuzz-Wrong label.