> The legacy AWT JPEG decoder can write a synthetic two-byte JPEG EOI marker > beyond the input buffer in sun_jpeg_fill_suspended_buffer(). > > The function retains unconsumed input bytes and reads into the remaining > space. Its capacity check permits one remaining byte, but the EOF path writes > two bytes. With a 1024-byte input buffer, offset 1023, and read() returning > EOF, the second marker byte is written at index 1024. The path also requires > available() to report more bytes than remaining_skip before the read; a > stream whose availability estimate is inconsistent with the subsequent EOF > can satisfy this condition. > > Truncated input must be rejected or handled without writing outside the input > array. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai).
Timofei Fedotov has updated the pull request incrementally with one additional commit since the last revision: Correct text of test license ------------- Changes: - all: https://git.openjdk.org/jdk/pull/33313/files - new: https://git.openjdk.org/jdk/pull/33313/files/a2257890..c55344f9 Webrevs: - full: https://webrevs.openjdk.org/?repo=jdk&pr=33313&range=02 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=33313&range=01-02 Stats: 3 lines in 1 file changed: 0 ins; 2 del; 1 mod Patch: https://git.openjdk.org/jdk/pull/33313.diff Fetch: git fetch https://git.openjdk.org/jdk.git pull/33313/head:pull/33313 PR: https://git.openjdk.org/jdk/pull/33313
