infernap12/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2026-04-14 17:08:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

7058611: JPG parser bugs found via zzuf fuzzing

Browse Source 
Reviewed-by: prr, vadim
This commit is contained in:
Andrew Brygin 2013-10-14 16:00:03 +04:00
parent a1e06f7eac
commit 9eb9388a81
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
jdk/src/share/classes/com/sun/imageio/plugins/jpeg/MarkerSegment.java
View File

@ -28,6 +28,7 @@ package com.sun.imageio.plugins.jpeg;
import javax.imageio.metadata.IIOInvalidTreeException;
import javax.imageio.metadata.IIOMetadataNode;
import javax.imageio.stream.ImageOutputStream;
import javax.imageio.IIOException;
import java.io.IOException;
@ -60,6 +61,10 @@ class MarkerSegment implements Cloneable {
length = (buffer.buf[buffer.bufPtr++] & 0xff) << 8;
length |= buffer.buf[buffer.bufPtr++] & 0xff;
length -= 2; // JPEG length includes itself, we don't
if (length < 0) {
throw new IIOException("Invalid segment length: " + length);
}
buffer.bufAvail -= 3;
// Now that we know the true length, ensure that we've got it,
// or at least a bufferful if length is too big.

2
jdk/src/share/classes/com/sun/imageio/plugins/jpeg/SOFMarkerSegment.java
View File

@ -78,7 +78,7 @@ class SOFMarkerSegment extends MarkerSegment {
numLines |= buffer.buf[buffer.bufPtr++] & 0xff;
samplesPerLine = (buffer.buf[buffer.bufPtr++] & 0xff) << 8;
samplesPerLine |= buffer.buf[buffer.bufPtr++] & 0xff;
int numComponents = buffer.buf[buffer.bufPtr++];
int numComponents = buffer.buf[buffer.bufPtr++] & 0xff;
componentSpecs = new ComponentSpec [numComponents];
for (int i = 0; i < numComponents; i++) {
componentSpecs[i] = new ComponentSpec(buffer);