From 92cf16b425ffe4336f5c0879d27ccda3983e7658 Mon Sep 17 00:00:00 2001
From: Brian Burkhalter <bpb@openjdk.org>
Date: Fri, 2 Sep 2016 11:29:02 -0700
Subject: [PATCH] 8154075: [TIFF] AIOOB Exception from TIFFLZWDecompressor

For banded images make sure the step in the horizontal differencing predictor calculations for Deflate and LZW compression is unity (1) instead of the number of samples per pixel.

Reviewed-by: prr
---
 .../plugins/tiff/TIFFDeflateDecompressor.java      | 12 ++++++++----
 .../imageio/plugins/tiff/TIFFLZWDecompressor.java  | 14 ++++++++------
 2 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/jdk/src/java.desktop/share/classes/com/sun/imageio/plugins/tiff/TIFFDeflateDecompressor.java b/jdk/src/java.desktop/share/classes/com/sun/imageio/plugins/tiff/TIFFDeflateDecompressor.java
index ecbd38a4d3a..1ce7d56c1c7 100644
--- a/jdk/src/java.desktop/share/classes/com/sun/imageio/plugins/tiff/TIFFDeflateDecompressor.java
+++ b/jdk/src/java.desktop/share/classes/com/sun/imageio/plugins/tiff/TIFFDeflateDecompressor.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2005, 2015, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2005, 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -101,13 +101,17 @@ public class TIFFDeflateDecompressor extends TIFFDecompressor {
 
         if (predictor ==
             BaselineTIFFTagSet.PREDICTOR_HORIZONTAL_DIFFERENCING) {
+            int step = planar || samplesPerPixel == 1 ? 1 : samplesPerPixel;
+            int samplesPerRow = step * srcWidth;
 
+            int off = bufOffset + step;
             for (int j = 0; j < srcHeight; j++) {
-                int count = bufOffset + samplesPerPixel * (j * srcWidth + 1);
-                for (int i=samplesPerPixel; i<srcWidth*samplesPerPixel; i++) {
-                    buf[count] += buf[count - samplesPerPixel];
+                int count = off;
+                for (int i = step; i < samplesPerRow; i++) {
+                    buf[count] += buf[count - step];
                     count++;
                 }
+                off += samplesPerRow;
             }
         }
 
diff --git a/jdk/src/java.desktop/share/classes/com/sun/imageio/plugins/tiff/TIFFLZWDecompressor.java b/jdk/src/java.desktop/share/classes/com/sun/imageio/plugins/tiff/TIFFLZWDecompressor.java
index cbf3b504f63..340179f7e8d 100644
--- a/jdk/src/java.desktop/share/classes/com/sun/imageio/plugins/tiff/TIFFLZWDecompressor.java
+++ b/jdk/src/java.desktop/share/classes/com/sun/imageio/plugins/tiff/TIFFLZWDecompressor.java
@@ -162,16 +162,18 @@ class TIFFLZWDecompressor extends TIFFDecompressor {
 
         if (predictor ==
             BaselineTIFFTagSet.PREDICTOR_HORIZONTAL_DIFFERENCING) {
+            int step = planar || samplesPerPixel == 1 ? 1 : samplesPerPixel;
 
+            int samplesPerRow = step * srcWidth;
+
+            int off = dstOffset + step;
             for (int j = 0; j < srcHeight; j++) {
-
-                int count = dstOffset + samplesPerPixel * (j * srcWidth + 1);
-
-                for (int i = samplesPerPixel; i < srcWidth * samplesPerPixel; i++) {
-
-                    dstData[count] += dstData[count - samplesPerPixel];
+                int count = off;
+                for (int i = step; i < samplesPerRow; i++) {
+                    dstData[count] += dstData[count - step];
                     count++;
                 }
+                off += samplesPerRow;
             }
         }