[IMAGING-25] integer overflow unhandled

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Later
• Affects Version/s: 0.94-incubator
• Component/s: Format: JPEG

Environment

win32, 32 bit operating systems

• Assignee: Unassigned
• Reporter: Greg Squires
• Created: 09/Feb/09 18:45
• Updated: 19/May/22 04:29
• Resolved: 22/Jul/12 13:13

Description

This function can throw an Exception in ByteSourceArray.java due to a negative byte[] allocation size. The length argument has been found to wrap when called from IccProfileParser.java.

In 64bit machines, issues related to incorrect metadata, or ICC data can lead to incorrect and excess memory allocations. These large numbers however cause 32bit negative signed values.

public byte[] getBlock(int start, int length) throws IOException

{ if (start + length > bytes.length) throw new IOException("Could not read block (block start: " + start + ", block length: " + length + ", data length: " + bytes.length + ")."); byte result[] = new byte[length]; System.arraycopy(bytes, start, result, 0, length); return result; }