On Tue, 21 Apr 2026 18:33:42 GMT, Phil Race <[email protected]> wrote:
>> src/java.desktop/share/classes/java/awt/image/MultiPixelPackedSampleModel.java
>> line 171:
>>
>>> 169: throw new IllegalArgumentException("scanlineStride must be
>>> > 0");
>>> 170: }
>>> 171: if (((numberOfBits * w) /
>>> DataBuffer.getDataTypeSize(dataType)) > scanlineStride) {
>>
>> It looks like there might be an integer overflow here:
>>
>> e.g. `new java.awt.image.MultiPixelPackedSampleModel(3, 77777777, 2, 32, 1,
>> 0)` is constructed successfully while it should not.
>
> thanks, I remember that crossing my mind but then forgot about it.
> Fixed now, I think.
The second constructor can get overflow in intermediate calculation as well:
new MultiPixelPackedSampleModel(TYPE_BYTE, 1<<29, 1, 4, 1<<28, 0);
new MultiPixelPackedSampleModel(TYPE_BYTE, 1<<29, 1, 4);
both should end in the same MultiPixelPackedSampleModel, but 4arg constructor
thrown an exception.
Also the new javadoc should probably include the casts used in the code?
* @throws RasterFormatException if
* {@code ((numberOfBits * w) +
DataBuffer.getDataTypeSize(dataType) - 1)
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/30826#discussion_r3262668527
