On Tue, 3 Nov 2026 05:09:32 GMT, Jayathirth D V <[email protected]> wrote:
> While reading a TIFF image with LZW compression, we start reading the content > of LZW strip data without veryfing whether we actually have the needed bytes. > This ends up throwing ArrayIndexOutOfBoundsException, in case of > ImageIO.read() we wrap this ArrayIndexOutOfBoundsException into IIOException > but if we use the reader directly application will see the AIOOBE. > > TIFF 6.0 mentions that each LZW strip should contain clear & eoi code: > https://www.itu.int/itudoc/itu-t/com16/tiff-fx/docs/tiff6.pdf#page=61. So the > fix now checks these minimal requirements before reading the strip data array. > > TIFF spec doesn't mandate that strip byte count should be positive. So we > actually allow 0 strip byte count value and this causes issues in other > compression types. Initially i tried restricting the byte count to be > positive but these needs more analysis. So i have created > [JDK-8396412](https://bugs.openjdk.org/browse/JDK-8396412). > > Testing is green with this update. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai). Marked as reviewed by azvegint (Reviewer). src/java.desktop/share/classes/com/sun/imageio/plugins/tiff/TIFFLZWDecompressor.java line 135: > 133: byte[] ddata, int dstOffset) > 134: throws IOException { > 135: // TIFF spec requires atleast 9 bit ClearCode & 9 bit EOI code Suggestion: // TIFF spec requires at least 9 bit ClearCode & 9 bit EOI code ------------- PR Review: https://git.openjdk.org/jdk/pull/33689#pullrequestreview-5751437729 PR Review Comment: https://git.openjdk.org/jdk/pull/33689#discussion_r4454107966
