> While reading a TIFF image with LZW compression, we start reading the content > of LZW strip data without veryfing whether we actually have the needed bytes. > This ends up throwing ArrayIndexOutOfBoundsException, in case of > ImageIO.read() we wrap this ArrayIndexOutOfBoundsException into IIOException > but if we use the reader directly application will see the AIOOBE. > > TIFF 6.0 mentions that each LZW strip should contain clear & eoi code: > https://www.itu.int/itudoc/itu-t/com16/tiff-fx/docs/tiff6.pdf#page=61. So the > fix now checks these minimal requirements before reading the strip data array. > > TIFF spec doesn't mandate that strip byte count should be positive. So we > actually allow 0 strip byte count value and this causes issues in other > compression types. Initially i tried restricting the byte count to be > positive but these needs more analysis. So i have created > [JDK-8396412](https://bugs.openjdk.org/browse/JDK-8396412). > > Testing is green with this update. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai).
Jayathirth D V has updated the pull request incrementally with one additional commit since the last revision: Update src/java.desktop/share/classes/com/sun/imageio/plugins/tiff/TIFFLZWDecompressor.java Co-authored-by: Aleksandr Zvegintsev <[email protected]> ------------- Changes: - all: https://git.openjdk.org/jdk/pull/33689/files - new: https://git.openjdk.org/jdk/pull/33689/files/20f295f6..225e5936 Webrevs: - full: https://webrevs.openjdk.org/?repo=jdk&pr=33689&range=01 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=33689&range=00-01 Stats: 1 line in 1 file changed: 0 ins; 0 del; 1 mod Patch: https://git.openjdk.org/jdk/pull/33689.diff Fetch: git fetch https://git.openjdk.org/jdk.git pull/33689/head:pull/33689 PR: https://git.openjdk.org/jdk/pull/33689
