Skip to content

Commit efcdcc7

Browse files
committed
8270893: IndexOutOfBoundsException while reading large TIFF file
Reviewed-by: prr, serb
1 parent 977b8c4 commit efcdcc7

2 files changed

Lines changed: 83 additions & 7 deletions

File tree

src/java.desktop/share/classes/com/sun/imageio/plugins/tiff/TIFFIFD.java

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2005, 2020, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2005, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -319,7 +319,7 @@ private static int readFieldValue(ImageInputStream stream,
319319
while (bytesToRead != 0) {
320320
int sz = Math.min(bytesToRead, UNIT_SIZE);
321321
byte[] unit = new byte[sz];
322-
stream.readFully(unit, bytesRead, sz);
322+
stream.readFully(unit, 0, sz);
323323
bufs.add(unit);
324324
bytesRead += sz;
325325
bytesToRead -= sz;
@@ -455,7 +455,7 @@ private static int readFieldValue(ImageInputStream stream,
455455
while (shortsToRead != 0) {
456456
int sz = Math.min(shortsToRead, SSHORT_TILE_SIZE);
457457
short[] unit = new short[sz];
458-
stream.readFully(unit, shortsRead, sz);
458+
stream.readFully(unit, 0, sz);
459459
bufs.add(unit);
460460
shortsRead += sz;
461461
shortsToRead -= sz;
@@ -486,7 +486,7 @@ private static int readFieldValue(ImageInputStream stream,
486486
while (intsToRead != 0) {
487487
int sz = Math.min(intsToRead, INT_TILE_SIZE);
488488
int[] unit = new int[sz];
489-
stream.readFully(unit, intsToRead, sz);
489+
stream.readFully(unit, 0, sz);
490490
bufs.add(unit);
491491
intsRead += sz;
492492
intsToRead -= sz;
@@ -518,7 +518,7 @@ private static int readFieldValue(ImageInputStream stream,
518518
while (srationalsToRead != 0) {
519519
int sz = Math.min(srationalsToRead, SRATIONAL_TILE_SIZE);
520520
int[] unit = new int[sz * 2];
521-
stream.readFully(unit, (srationalsToRead * 2), (sz * 2));
521+
stream.readFully(unit, 0, (sz * 2));
522522
bufs.add(unit);
523523
srationalsRead += sz;
524524
srationalsToRead -= sz;
@@ -552,7 +552,7 @@ private static int readFieldValue(ImageInputStream stream,
552552
while (floatsToRead != 0) {
553553
int sz = Math.min(floatsToRead, FLOAT_TILE_SIZE);
554554
float[] unit = new float[sz];
555-
stream.readFully(unit, floatsToRead, sz);
555+
stream.readFully(unit, 0, sz);
556556
bufs.add(unit);
557557
floatsRead += sz;
558558
floatsToRead -= sz;
@@ -583,7 +583,7 @@ private static int readFieldValue(ImageInputStream stream,
583583
while (doublesToRead != 0) {
584584
int sz = Math.min(doublesToRead, DOUBLE_TILE_SIZE);
585585
double[] unit = new double[sz];
586-
stream.readFully(unit, doublesToRead, sz);
586+
stream.readFully(unit, 0, sz);
587587
bufs.add(unit);
588588
doublesRead += sz;
589589
doublesToRead -= sz;
Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
/*
2+
* Copyright (c) 2021, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation.
8+
*
9+
* This code is distributed in the hope that it will be useful, but WITHOUT
10+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12+
* version 2 for more details (a copy is included in the LICENSE file that
13+
* accompanied this code).
14+
*
15+
* You should have received a copy of the GNU General Public License version
16+
* 2 along with this work; if not, write to the Free Software Foundation,
17+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18+
*
19+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20+
* or visit www.oracle.com if you need additional information or have any
21+
* questions.
22+
*/
23+
24+
/*
25+
* @test
26+
* @bug 8270893
27+
* @summary Ensure that we don't throw IndexOutOfBoundsException when
28+
* we read TIFF tag with content more than 1024000 bytes
29+
* @run main LargeTIFFTagTest
30+
*/
31+
32+
import javax.imageio.ImageIO;
33+
import javax.imageio.ImageReader;
34+
import javax.imageio.stream.ImageInputStream;
35+
import java.io.ByteArrayInputStream;
36+
import java.io.IOException;
37+
import java.util.Iterator;
38+
39+
public class LargeTIFFTagTest {
40+
public static void main(String[] args) throws IOException {
41+
// TIFF stream length to hold 22 bytes of TIFF header
42+
// plus 1024002 bytes of data in one TIFFTag
43+
int length = 1024024;
44+
byte[] ba = new byte[length];
45+
// Little endian TIFF stream with header and only one
46+
// IFD entry at offset 22 having count value 1024002.
47+
byte[] header = new byte[] { (byte)0x49, (byte) 0x49,
48+
(byte)0x2a, (byte)0x00, (byte)0x08, (byte)0x00,
49+
(byte)0x00, (byte)0x00, (byte)0x01, (byte)0x00,
50+
(byte)0x73, (byte)0x87, (byte)0x07, (byte)0x00,
51+
(byte)0x02, (byte)0xA0, (byte)0x0F, (byte)0x00,
52+
(byte)0x16, (byte)0x00, (byte)0x00, (byte)0x00};
53+
// copy first 22 bytes of TIFF header to byte array
54+
for (int i = 0; i < 22; i++) {
55+
ba[i] = header[i];
56+
}
57+
ByteArrayInputStream bais = new ByteArrayInputStream(ba);
58+
ImageInputStream stream = ImageIO.createImageInputStream(bais);
59+
Iterator<ImageReader> readers = ImageIO.getImageReaders(stream);
60+
61+
if(readers.hasNext()) {
62+
ImageReader reader = readers.next();
63+
reader.setInput(stream);
64+
try {
65+
reader.readAll(0, null);
66+
} catch (IllegalArgumentException e) {
67+
// do nothing we expect IllegalArgumentException but we
68+
// should not throw IndexOutOfBoundsException.
69+
System.out.println(e.toString());
70+
System.out.println("Caught IllegalArgumentException ignore it");
71+
}
72+
} else {
73+
throw new RuntimeException("No readers available for TIFF format");
74+
}
75+
}
76+
}

0 commit comments

Comments
 (0)