From 31cb3f58bf65518cf3b9e35cd09405af693a38bd Mon Sep 17 00:00:00 2001
Date: Thu, 21 Nov 2019 11:49:57 +0000
Subject: [PATCH] 8190332: PngReader throws NegativeArraySizeException/OOM
 error when IHDR width is very large

Summary: <imageio>: PngReader throws NegativeArraySizeException/OOM error when IHDR width is very large
LLT:
Bug url: https://bugs.openjdk.java.net/browse/JDK-8190332
---
 .../sun/imageio/plugins/png/PNGImageReader.java    | 27 +++++--
 .../plugins/png/PngLargeIHDRDimensionTest.java     | 86 ++++++++++++++++++++++
 2 files changed, 106 insertions(+), 7 deletions(-)
 create mode 100644 test/jdk/javax/imageio/plugins/png/PngLargeIHDRDimensionTest.java

diff --git a/jdk/src/share/classes/com/sun/imageio/plugins/png/PNGImageReader.java b/jdk/src/share/classes/com/sun/imageio/plugins/png/PNGImageReader.java
index 7da36e14b1..02a11d45f4 100644
--- a/jdk/src/share/classes/com/sun/imageio/plugins/png/PNGImageReader.java
+++ b/jdk/src/share/classes/com/sun/imageio/plugins/png/PNGImageReader.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -1305,14 +1305,18 @@ public class PNGImageReader extends ImageReader {
             this.pixelStream = new DataInputStream(is);
 
             /*
-             * NB: the PNG spec declares that valid range for width
+             * PNG spec declares that valid range for width
              * and height is [1, 2^31-1], so here we may fail to allocate
              * a buffer for destination image due to memory limitation.
              *
-             * However, the recovery strategy for this case should be
-             * defined on the level of application, so we will not
-             * try to estimate the required amount of the memory and/or
-             * handle OOM in any way.
+             * If the read operation triggers OutOfMemoryError, the same
+             * will be wrapped in an IIOException at PNGImageReader.read
+             * method.
+             *
+             * The recovery strategy for this case should be defined at
+             * the level of application, so we will not try to estimate
+             * the required amount of the memory and/or handle OOM in
+             * any way.
              */
             theImage = getDestination(param,
                                       getImageTypes(0),
@@ -1611,7 +1615,16 @@ public class PNGImageReader extends ImageReader {
             throw new IndexOutOfBoundsException("imageIndex != 0!");
         }
 
-        readImage(param);
+        try {
+            readImage(param);
+        } catch (IOException |
+                 IllegalStateException |
+                 IllegalArgumentException e)
+        {
+            throw e;
+        } catch (Throwable e) {
+            throw new IIOException("Caught exception during read: ", e);
+        }
         return theImage;
     }
 
diff --git a/test/jdk/javax/imageio/plugins/png/PngLargeIHDRDimensionTest.java b/test/jdk/javax/imageio/plugins/png/PngLargeIHDRDimensionTest.java
new file mode 100644
index 0000000000..118a41f04f
--- /dev/null
+++ b/test/jdk/javax/imageio/plugins/png/PngLargeIHDRDimensionTest.java
@@ -0,0 +1,86 @@
+/*
+ * Copyright (c) 2017, 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug     8190332
+ * @summary Test verifies whether PNGImageReader throws IIOException
+ *          or not when IHDR width value is very high.
+ * @run     main PngLargeIHDRDimensionTest
+ */
+
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+import java.util.Base64;
+import javax.imageio.IIOException;
+import javax.imageio.ImageIO;
+
+public class PngLargeIHDRDimensionTest {
+
+    /*
+     * IHDR width is very large and when we try to create buffer to store
+     * image information of each row it overflows and we get
+     * NegativeArraySizeException without the fix for this bug.
+     */
+    private static String negativeArraySizeExceptionInput = "iVBORw0KGgoAAAANS"
+            + "UhEUg////0AAAABEAIAAAA6fptVAAAACklEQVQYV2P4DwABAQEAWk1v8QAAAAB"
+            + "JRU5ErkJgggo=";
+
+    /*
+     * IHDR width is ((2 to the power of 31) - 2), which is the maximum VM
+     * limit to create an array we get OutOfMemoryError without the fix
+     * for this bug.
+     */
+    private static String outOfMemoryErrorInput = "iVBORw0KGgoAAAANSUhEUgAAAAF/"
+            + "///+CAAAAAA6fptVAAAACklEQVQYV2P4DwABAQEAWk1v8QAAAABJRU5"
+            + "ErkJgggo=";
+
+    private static InputStream input;
+    private static Boolean firstTestFailed = true, secondTestFailed = true;
+    public static void main(String[] args) throws java.io.IOException {
+        byte[] inputBytes = Base64.getDecoder().
+                decode(negativeArraySizeExceptionInput);
+        input = new ByteArrayInputStream(inputBytes);
+
+        try {
+            ImageIO.read(input);
+        } catch (IIOException e) {
+            firstTestFailed = false;
+        }
+
+        inputBytes = Base64.getDecoder().decode(outOfMemoryErrorInput);
+        input = new ByteArrayInputStream(inputBytes);
+
+        try {
+            ImageIO.read(input);
+        } catch (IIOException e) {
+            secondTestFailed = false;
+        }
+
+        if (firstTestFailed || secondTestFailed) {
+            throw new RuntimeException("Test doesn't throw required"
+                    + " IIOException");
+        }
+    }
+}
+
-- 
2.12.3