Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-4980124

Native JVM crash in JPEG API when processing corrupt image files

    Details

    • Subcomponent:
      2d
    • Resolved In Build:
      beta
    • CPU:
      generic
    • OS:
      solaris_9

      Description


      A simple JAI 1.1.2 application will crash when loading and processing an invalid image file (.jpg tested). The application programmer has no known way to handle this - an exception should be thrown that we can catch.

      Worse than an uncaught exception, the result of simply processing an invalid file is a crash of the native JVM.

      The testcase and test file are attached:

      /// Testcase:

      import java.awt.image.RenderedImage;
      import java.io.ByteArrayInputStream;
      import java.io.File;
      import java.io.FileInputStream;
      import java.io.IOException;
      import java.io.InputStream;

      import javax.media.jai.JAI;

      import com.sun.media.jai.codec.MemoryCacheSeekableStream;
      import com.sun.media.jai.codec.SeekableStream;


      public class JAICrashTest {

              public static void main(String[] args) throws IOException {
                      String fileName = args[0];
                      byte[] data = loadFile(fileName);
                      InputStream istream = new ByteArrayInputStream(data);
                      int availableBytes = istream.available();
                      // Load the source image from a Stream.
                      SeekableStream st = new MemoryCacheSeekableStream(istream);
                      st.read(new byte[availableBytes], 0, availableBytes);
                      RenderedImage im = JAI.create("stream", st);
                      if( (im.getWidth() <= 0 || im.getHeight() <= 0)){
                              System.out.println("Something wrong..");
                              return;
                      }
                      System.out.println("Okay..");
              }

              public static byte[] loadFile(String name) throws IOException
          {
                               File f= new File(name);
                               byte[] result = new byte[(int) f.length()];
                               FileInputStream is = new FileInputStream(f);
                               is.read(result);
                               is.close();
                               return result;
              }

      }


      //// Output:

      sr-egmp03-07(5.9)$ cat ./go
      export JAI_HOME=/home/kevinwa/javastuff/jai-1_1_2/lib
      export CLASSPATH=$JAI_HOME/jai_core.jar:$JAI_HOME/jai_codec.jar:$JAI_HOME/mlibwrapper_jai.jar:$CLASSPATH
      export LD_LIBRARY_PATH=$JAI_HOME:$CLASSPATH:$LD_LIBRARY_PATH
      java JAICrashTest 00000005.jpg

      sr-egmp03-07(5.9)$ ./go

      Unexpected Signal : 11 occurred at PC=0xFEDB24BC
      Function=[Unknown. Nearest: JVM_IsSameClassPackage+0x7050]
      Library=/net/cafebabe.uk/export/apps/products/java/jdk/prodn/j2sdk1.4.2_03/jre/lib/sparc/client/libjvm.so

      Current Java thread:
              at sun.awt.image.codec.JPEGImageDecoderImpl.readJPEGStream(Native Method)
              - locked <0xf19a1268> (a sun.awt.image.codec.JPEGImageDecoderImpl)
              at sun.awt.image.codec.JPEGImageDecoderImpl.decodeAsBufferedImage(JPEGImageDecoderImpl.java:210)
              - locked <0xf19a1268> (a sun.awt.image.codec.JPEGImageDecoderImpl)
              at com.sun.media.jai.codecimpl.JPEGImage.<init>(JPEGImageDecoder.java:114)
              - locked <0xf19a0770> (a java.lang.Object)
              at com.sun.media.jai.codecimpl.JPEGImageDecoder.decodeAsRenderedImage(JPEGImageDecoder.java:53)
              at com.sun.media.jai.opimage.CodecRIFUtil.create(CodecRIFUtil.java:96)
              at com.sun.media.jai.opimage.JPEGRIF.create(JPEGRIF.java:52)
              at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
              at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
              at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
              at java.lang.reflect.Method.invoke(Method.java:324)
              at javax.media.jai.FactoryCache.invoke(FactoryCache.java:130)
              at javax.media.jai.OperationRegistry.invokeFactory(OperationRegistry.java:1682)
              at javax.media.jai.ThreadSafeOperationRegistry.invokeFactory(ThreadSafeOperationRegistry.java:481)
              at javax.media.jai.registry.RIFRegistry.create(RIFRegistry.java:340)
              at com.sun.media.jai.opimage.StreamRIF.create(StreamRIF.java:110)
              at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
              at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
              at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
              at java.lang.reflect.Method.invoke(Method.java:324)
              at javax.media.jai.FactoryCache.invoke(FactoryCache.java:130)
              at javax.media.jai.OperationRegistry.invokeFactory(OperationRegistry.java:1682)
              at javax.media.jai.ThreadSafeOperationRegistry.invokeFactory(ThreadSafeOperationRegistry.java:481)
              at javax.media.jai.registry.RIFRegistry.create(RIFRegistry.java:340)
              at javax.media.jai.RenderedOp.createInstance(RenderedOp.java:830)
              - locked <0xf191c870> (a javax.media.jai.RenderedOp)
              at javax.media.jai.RenderedOp.createRendering(RenderedOp.java:878)
              - locked <0xf191c870> (a javax.media.jai.RenderedOp)
              at javax.media.jai.RenderedOp.getWidth(RenderedOp.java:2190)
              at JAICrashTest.main(JAICrashTest.java:27)

      Dynamic libraries:
      0x10000 java
      0xff380000 /usr/lib/libthread.so.1
      0xff3b0000 /usr/lib/libdl.so.1
      0xff280000 /usr/lib/libc.so.1
      0xff350000 /usr/platform/SUNW,Ultra-Enterprise/lib/libc_psr.so.1
      0xfec00000 /net/cafebabe.uk/export/apps/products/java/jdk/prodn/j2sdk1.4.2_03/jre/lib/sparc/client/libjvm.so
      0xff230000 /usr/lib/libCrun.so.1
      0xff210000 /usr/lib/libsocket.so.1
      0xff100000 /usr/lib/libnsl.so.1
      0xff0b0000 /usr/lib/libm.so.1
      0xff1e0000 /usr/lib/libsched.so.1
      0xff260000 /usr/lib/libw.so.1
      0xff090000 /usr/lib/libmp.so.2
      0xff070000 /usr/lib/librt.so.1
      0xff050000 /usr/lib/libaio.so.1
      0xff030000 /usr/lib/libmd5.so.1
      0xfebe0000 /usr/platform/SUNW,Ultra-Enterprise/lib/libmd5_psr.so.1
      0xfeba0000 /net/cafebabe.uk/export/apps/products/java/jdk/prodn/j2sdk1.4.2_03/jre/lib/sparc/native_threads/libhpi.so
      0xfeb60000 /net/cafebabe.uk/export/apps/products/java/jdk/prodn/j2sdk1.4.2_03/jre/lib/sparc/libverify.so
      0xfeb20000 /net/cafebabe.uk/export/apps/products/java/jdk/prodn/j2sdk1.4.2_03/jre/lib/sparc/libjava.so
      0xfeaf0000 /net/cafebabe.uk/export/apps/products/java/jdk/prodn/j2sdk1.4.2_03/jre/lib/sparc/libzip.so
      0xf1700000 /net/cafebabe.uk/export/apps/products/java/jdk/prodn/j2sdk1.4.2_03/jre/lib/sparc/libawt.so
      0xfc580000 /net/cafebabe.uk/export/apps/products/java/jdk/prodn/j2sdk1.4.2_03/jre/lib/sparc/libmlib_image.so
      0xfe290000 /net/cafebabe.uk/export/apps/products/java/jdk/prodn/j2sdk1.4.2_03/jre/lib/sparc/motif21/libmawt.so
      0xf1480000 /usr/dt/lib/libXm.so.4
      0xfc790000 /usr/openwin/lib/libXt.so.4
      0xfe1d0000 /usr/openwin/lib/libXext.so.0
      0xfe1b0000 /usr/openwin/lib/libXtst.so.1
      0xf1380000 /usr/openwin/lib/libX11.so.4
      0xfc6a0000 /usr/openwin/lib/libdps.so.5
      0xfbfe0000 /usr/openwin/lib/libSM.so.6
      0xfbfb0000 /usr/openwin/lib/libICE.so.6
      0xfbeb0000 /net/cafebabe.uk/export/apps/products/java/jdk/prodn/j2sdk1.4.2_03/jre/lib/sparc/libcmm.so
      0xfbdb0000 /net/cafebabe.uk/export/apps/products/java/jdk/prodn/j2sdk1.4.2_03/jre/lib/sparc/libjpeg.so

      Heap at VM Abort:
      Heap
       def new generation total 2112K, used 1797K [0xf1800000, 0xf1a20000, 0xf1f10000)
        eden space 2048K, 84% used [0xf1800000, 0xf19b16c0, 0xf1a00000)
        from space 64K, 100% used [0xf1a00000, 0xf1a10000, 0xf1a10000)
        to space 64K, 0% used [0xf1a10000, 0xf1a10000, 0xf1a20000)
       tenured generation total 1408K, used 485K [0xf1f10000, 0xf2070000, 0xf5800000)
         the space 1408K, 34% used [0xf1f10000, 0xf1f895a8, 0xf1f89600, 0xf2070000)
       compacting perm gen total 4096K, used 3317K [0xf5800000, 0xf5c00000, 0xf9800000)
         the space 4096K, 81% used [0xf5800000, 0xf5b3d790, 0xf5b3d800, 0xf5c00000)

      Local Time = Mon Jan 19 11:05:20 2004
      Elapsed Time = 8
      #
      # HotSpot Virtual Machine Error : 11
      # Error ID : 4F530E43505002EF 01
      # Please report this error at
      # http://java.sun.com/cgi-bin/bugreport.cgi
      #
      # Java VM: Java HotSpot(TM) Client VM (1.4.2_03-b02 mixed mode)
      #
      # An error report file has been saved as hs_err_pid62954.log.
      # Please refer to the file for further information.
      #
      ./go[4]: 62954 Abort
      sr-egmp03-07(5.9)$


      Testcase .java and .class file are attached, with sample bad JPG.
      Customer has provided addtional stack traces, attached.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                bae Andrew Brygin
                Reporter:
                kevinw Kevin Walls
              • Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:
                  Imported:
                  Indexed: