changeset 6631:3abe390615e3

8013510: Augment image writing code Reviewed-by: bae, prr
author jchen
date Thu, 09 May 2013 11:23:18 -0700
parents 9a7df62c2e7f
children 2cc8437acff9
files src/share/classes/com/sun/imageio/plugins/jpeg/JPEGImageReader.java src/share/classes/com/sun/imageio/plugins/jpeg/JPEGImageWriter.java src/share/native/sun/awt/image/jpeg/imageioJPEG.c
diffstat 3 files changed, 16 insertions(+), 2 deletions(-) [+]
line wrap: on
line diff
--- a/src/share/classes/com/sun/imageio/plugins/jpeg/JPEGImageReader.java	Fri Apr 19 16:50:10 2013 -0700
+++ b/src/share/classes/com/sun/imageio/plugins/jpeg/JPEGImageReader.java	Thu May 09 11:23:18 2013 -0700
@@ -1160,6 +1160,11 @@
             target = imRas;
         }
         int [] bandSizes = target.getSampleModel().getSampleSize();
+        for (int i = 0; i < bandSizes.length; i++) {
+            if (bandSizes[i] <= 0 || bandSizes[i] > 8) {
+                throw new IIOException("Illegal band size: should be 0 < size <= 8");
+            }
+        }
 
         /*
          * If the process is sequential, and we have restart markers,
--- a/src/share/classes/com/sun/imageio/plugins/jpeg/JPEGImageWriter.java	Fri Apr 19 16:50:10 2013 -0700
+++ b/src/share/classes/com/sun/imageio/plugins/jpeg/JPEGImageWriter.java	Thu May 09 11:23:18 2013 -0700
@@ -490,8 +490,8 @@
             // handle <= 8-bit samples.  We now check the band sizes and throw
             // an exception for images, such as USHORT_GRAY, with > 8 bits
             // per sample.
-            if (bandSizes[i] > 8) {
-                throw new IIOException("Sample size must be <= 8");
+            if (bandSizes[i] <= 0 || bandSizes[i] > 8) {
+                throw new IIOException("Illegal band size: should be 0 < size <= 8");
             }
             // 4450894 part 2: We expand IndexColorModel images to full 24-
             // or 32-bit in grabPixels() for each scanline.  For indexed
--- a/src/share/native/sun/awt/image/jpeg/imageioJPEG.c	Fri Apr 19 16:50:10 2013 -0700
+++ b/src/share/native/sun/awt/image/jpeg/imageioJPEG.c	Thu May 09 11:23:18 2013 -0700
@@ -2675,6 +2675,15 @@
     bandSize = (*env)->GetIntArrayElements(env, bandSizes, NULL);
 
     for (i = 0; i < numBands; i++) {
+        if (bandSize[i] <= 0 || bandSize[i] > JPEG_BAND_SIZE) {
+            (*env)->ReleaseIntArrayElements(env, bandSizes,
+                                            bandSize, JNI_ABORT);
+            JNU_ThrowByName(env, "javax/imageio/IIOException", "Invalid Image");
+            return JNI_FALSE;;
+        }
+    }
+
+    for (i = 0; i < numBands; i++) {
         if (bandSize[i] != JPEG_BAND_SIZE) {
             if (scale == NULL) {
                 scale = (UINT8**) calloc(numBands, sizeof(UINT8*));