Test files › Images › png-bad-crc.png
PNG with a bad CRC checksum
Structurally complete PNG with a single corrupted byte inside the IDAT chunk CRC.
↓ Download png-bad-crc.png| Filename | png-bad-crc.png |
| Format | PNG |
| Size | 1.3 KB (1,309 bytes) |
| MIME type | image/png |
| SHA-256 | 10bcc5c930180c7276678fada6ab4bb9bb4768f559f2e942190fdb265e869c29 |
What this file catchesDecoders that skip CRC verification entirely. Useful for confirming your library actually validates integrity rather than assuming it.
Handle it in code
Each snippet below was run against this exact file with Python 3.14.4 and Node 24.15.0 when this page was built, and the output shown is what it printed.
Python
Walk the chunks and verify each CRC. Browsers tolerate damage that strict decoders reject, so check before you store or process the image.
import struct, zlib
with open("png-bad-crc.png", "rb") as f:
data = f.read()
if data[:8] != b"\x89PNG\r\n\x1a\n":
raise SystemExit("not a PNG")
pos = 8
while True:
if pos + 8 > len(data):
raise SystemExit("truncated: the file ends before an IEND chunk")
length, ctype = struct.unpack(">I4s", data[pos:pos + 8])
end = pos + 12 + length
if end > len(data):
raise SystemExit(f"truncated: the {ctype.decode()} chunk needs {length} bytes")
if zlib.crc32(data[pos + 4:end - 4]) != struct.unpack(">I", data[end - 4:end])[0]:
raise SystemExit(f"bad CRC in the {ctype.decode()} chunk")
if ctype == b"IEND":
break
pos = end
print("chunk structure is valid")Run against this file, it prints: bad CRC in the IDAT chunk
Related guides and tools
Sample PNG fileFile signaturesMIME typesUpload validation checklistCheck a file's real typeVerify its SHA-256
Download & verify
curl -fsSL -o "png-bad-crc.png" "https://files.hexaqa.com/image/png-bad-crc.png"
curl -fsSL "https://files.hexaqa.com/image/png-bad-crc.png" | sha256sum
# expect: 10bcc5c930180c7276678fada6ab4bb9bb4768f559f2e942190fdb265e869c29