[jdk11u-dev] RFR: 8361748: Enforce limits on the size of an XBM image [v2]

[Andrew John Hughes]

On Fri, 19 Dec 2025 19:33:04 GMT, Francisco Ferrari Bihurriet <fferrari at openjdk.org> wrote:

>> Hi, this is an almost clean backport of openjdk/jdk17u-dev#3901.
>> 
>> The only differences are in context (deleted and surrounding code) due to 11u missing [JDK-8211300: Convert C-style array declarations in JDK client code](https://bugs.openjdk.org/browse/JDK-8211300).
>> 
>> NOTE: as part of this work, I found some issues with the original patch (see [JDK-8373727](https://bugs.openjdk.org/browse/JDK-8373727 "New XBM images parser regression: only the first line of the bitmap array is parsed")), so an additional backport of that fix will be needed too.
>> 
>> #### Testing
>> 
>> The [GitHub Actions testing run (tier1 on various platforms)](https://github.com/franferrax/jdk11u-dev/actions/runs/20177700844) has passed.
>> 
>> In addition, the new `test/jdk/java/awt/image/XBMDecoder/XBMDecoderTest.java` is passing in a local slowdebug build on _Fedora Linux x64_.
>
> Francisco Ferrari Bihurriet has updated the pull request incrementally with one additional commit since the last revision:
> 
>   Update copyright year

Backport looks good, with just differing context and the manually applied copyright header change. In fact, would have been clean if not for [JDK-8211300](https://bugs.openjdk.org/browse/JDK-8211300): "Convert C-style array declarations in JDK client code", the only change to this file in years.

Due to [JDK-8373727](https://bugs.openjdk.org/browse/JDK-8373727), I think we should hold off on approving and integrating this until we know there is a fix for this regression. I don't want us to end up having to back it out of the April release.

-------------

Marked as reviewed by andrew (Reviewer).

PR Review: https://git.openjdk.org/jdk11u-dev/pull/3135#pullrequestreview-3605461745