Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8191073

JpegImageReader throws IndexOutOfBoundsException when trying to read image data from tables-only image

    Details

    • Subcomponent:
    • Resolved In Build:
      b01
    • CPU:
      x86_64
    • OS:
      generic

      Backports

        Description

        FULL PRODUCT VERSION :
        openjdk version "9.0.1"
        OpenJDK Runtime Environment (build 9.0.1+11)
        OpenJDK 64-Bit Server VM (build 9.0.1+11, mixed mode)

        ADDITIONAL OS VERSION INFORMATION :
        Ubuntu Linux 64-bit

        A DESCRIPTION OF THE PROBLEM :
        The ImageReader com.sun.imageio.plugins.jpeg.JPEGImageReader throws an IndexOutOfBoundsException in calls from method checkTablesOnly() when reading a malformed JPEG file whose header indicates that it is tables-only. This happens when attempting to flush the image input stream up to the last image, but when the length of the list `imagePositions` is zero. This exception is not documented in the API call to ImageIO.read() or ImageReader.read(); instead, the reader should throw an IOException indicating that the image input stream is malformed.


        This bug was found using AFL.

        STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
        Compile and run the test program attached below.

        EXPECTED VERSUS ACTUAL BEHAVIOR :
        EXPECTED -
        An IOException should be thrown (specifically, a javax.imagio.IIOException).
        ACTUAL -
        A java.lang.IndexOutOfBoundsException is thrown (on JDK 8 and below, an ArrayIndexOutOfBoundsException is thrown).

        ERROR MESSAGES/STACK TRACES THAT OCCUR :
        at java.base/jdk.internal.util.Preconditions.outOfBounds(Preconditions.java:64)
        at java.base/jdk.internal.util.Preconditions.outOfBoundsCheckIndex(Preconditions.java:70)
        at java.base/jdk.internal.util.Preconditions.checkIndex(Preconditions.java:248)
        at java.base/java.util.Objects.checkIndex(Objects.java:372)
        at java.base/java.util.ArrayList.get(ArrayList.java:440)
        at java.desktop/com.sun.imageio.plugins.jpeg.JPEGImageReader.checkTablesOnly(JPEGImageReader.java:378)
        at java.desktop/com.sun.imageio.plugins.jpeg.JPEGImageReader.gotoImage(JPEGImageReader.java:493)
        at java.desktop/com.sun.imageio.plugins.jpeg.JPEGImageReader.readHeader(JPEGImageReader.java:716)
        at java.desktop/com.sun.imageio.plugins.jpeg.JPEGImageReader.readInternal(JPEGImageReader.java:1173)
        at java.desktop/com.sun.imageio.plugins.jpeg.JPEGImageReader.read(JPEGImageReader.java:1153)
        at java.desktop/javax.imageio.ImageIO.read(ImageIO.java:1468)
        at java.desktop/javax.imageio.ImageIO.read(ImageIO.java:1363)
        at JpegReaderOOBIssue.main(JpegReaderOOBIssue.java:25)

        REPRODUCIBILITY :
        This bug can be reproduced always.

        ---------- BEGIN SOURCE ----------
        import java.io.ByteArrayInputStream;
        import java.io.InputStream;
        import java.util.Base64;
        import javax.imageio.ImageIO;

        public class JpegReaderOOBIssue {

        // JPEG image test case (encoded as base64)
        private static String inputImageBase64 = "/9j/4IAQSkZJRgABAQEASABIAAD" +
        "/2wBDAFA3PEY8MlBGQUZaVVBfeMiCeG5uePWvuZHI///////////////////////////" +
        "/////////////////////////2wBDAVVaWnhpeOuCguv////////////////////////" +
        "/////////////////////////////////////////////////wAARCAAgACADASIAAhE" +
        "BAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAECA//EACUQAQACAAUDBAMAAAAAAAAAAAE" +
        "AAhESITGxQXKSA2Fi0SIyUf/EABYBAQEBAAAAAAAAAAAAAAAAAAABA//EABcRAQEBAQA" +
        "AAAAAAAAAAAAAAAEAESH/2gAMAwEAAhEDEQA/ANf2VW2OKaWTqnRhl97eb9wrs91uWPE" +
        "BUX+EtmrssvvbzfuJWjVG2tg1svLLtgJ0Uxwmd96d5zE7tVdnutyxm5JVoo0u6rpXHdW" +
        "LP8PU8WIjtRuvVZN96d5zDP8AD1PFhre1Apc/Ida4RAdv/9k=";

        public static void main(String[] args) throws java.io.IOException {
        // Convert test case into input stream
        byte[] inputBytes = Base64.getDecoder().decode(inputImageBase64);
        InputStream in = new ByteArrayInputStream(inputBytes);

        // Attempt to read JPEG
        ImageIO.read(in); // Throws IndexOutOfBoundsException!
        }
        }
        ---------- END SOURCE ----------

          Attachments

            Issue Links

              Activity

                People

                • Assignee:
                  jdv Jayathirth D V
                  Reporter:
                  webbuggrp Webbug Group
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  5 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved: