[IMAGING-215] ArrayIndexOutOfBoundsException in DhtSegment

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.0-alpha1
• Fix Version/s: 1.0-alpha1
• Component/s: Format: JPEG
• Labels: security
• Assignee: Bruno P. Kinoshita
• Reporter: floyd
• Created: 07/Feb/18 14:25
• Updated: 07/Aug/20 04:32
• Resolved: 10/Feb/18 10:16

Description

I simply ran the Kelinci AFL-based Java fuzzer with the common immaging as explained here (with better input files than the author, fuzzing is all about corpus data):

https://github.com/isstac/kelinci/tree/master/examples/commons-imaging

I found the following issue when parsing the attached file:

 

Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: 0
	at org.apache.commons.imaging.formats.jpeg.segments.DhtSegment$HuffmanTable.<init>(DhtSegment.java:79)
	at org.apache.commons.imaging.formats.jpeg.segments.DhtSegment.<init>(DhtSegment.java:173)
	at org.apache.commons.imaging.formats.jpeg.segments.DhtSegment.<init>(DhtSegment.java:146)
	at org.apache.commons.imaging.formats.jpeg.decoder.JpegDecoder.visitSegment(JpegDecoder.java:219)
	at org.apache.commons.imaging.formats.jpeg.JpegUtils.traverseJFIF(JpegUtils.java:89)
	at org.apache.commons.imaging.formats.jpeg.decoder.JpegDecoder.decode(JpegDecoder.java:437)
	at org.apache.commons.imaging.formats.jpeg.JpegImageParser.getBufferedImage(JpegImageParser.java:97)
	at driver.Driver.main(Driver.java:23)

The rest is as described in the link, I also used commons-imaging-1.0-RC7.tar.gz

The parser doesn't declare that an ArrayIndexOutOfBoundsException could be thrown.