[OpenJDK 2D-Dev]  RFR JDK-8190332: PngReader throws NegativeArraySizeException/OOM error when IHDR width is very large
Jayathirth D V
jayathirth.d.v at oracle.com
Mon Nov 13 09:23:18 UTC 2017
Please review the following fix in JDK10 :
Bug : https://bugs.openjdk.java.net/browse/JDK-8190332
Webrev : http://cr.openjdk.java.net/~jdv/8190332/webrev.00/
Two types of issues are fixed under the same solution, so HYPERLINK "https://bugs.openjdk.java.net/browse/JDK-8190511"JDK-8190511 is closed as duplicate of this issue.
1) PNGImageReader throws OOM error when IHDR width equals/or greater than VM's array size limit.
2) PNGImageReader throws NegativeArraySizeException when IHDR width value is very high.
Root cause :
1) VM doesn't allow creation of array with Size >= ((2 to the power of 31) - 2) so we throw OOM error.
2) We use width from IHDR to calculate needed "bytesPerRow" value as "(inputBands*passWidth*bitDepth + 7)/8". When IHDR width is very high we overflow the integer size of bytesPerRow and when we try to create array using bytesPerRow it throws NegativeArraySizeException.
According to PNG spec maximum value that can be stored in IHDR width/height is (2 to the power of 31). We can't support PNG images with so large height/width, because based on other parameters like inputsBands, bitDepth we will definitely overflow than the maximum buffer value of VM. Also PNG is not a preferred format for such kind of large images.
Instead of catching these OOMError/NegativeArraySizeException at many different levels in PNGImageReader we can catch Throwable at higher level and convert OOMError/ NegativeArraySizeException into IIOException.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the 2d-dev