[IMAGING-326] Use JDK's multiplyExact to avoid integer overflows

• Type: Improvement
• Status: Open
• Priority: Blocker
• Resolution: Unresolved
• Affects Version/s: 1.0-alpha2
• Fix Version/s: 1.0.0-alpha6
• Component/s: imaging.*
• Assignee: Bruno P. Kinoshita
• Reporter: Bruno P. Kinoshita
• Created: 23/Jan/22 01:49
• Updated: 18/Apr/24 14:54

Description

See PR https://github.com/apache/commons-imaging/pull/196#discussion_r790148843 for context.

Integer overflow is a common source of problems in Imaging. The work on this issue is to address when that could happen and prevent it of doing so.

Java 8 includes methods like multiplyExact  which are convenient for us.

NOTE: we should start fixing it by the integer overflow in the PR linked above. Then go over the rest of the code, applying it to other places where integers are multipled/added/etc, and where the values could result in OOM or other annoying security issues (i.e. we don't need to blindly replace every + operation by addExactly).

-Bruno

Issue Links

• is related to: IMAGING-325 Prevent possible OOM error in BmpImageParser