Copilot commented on code in PR #6:
URL: https://github.com/apache/pdfbox-jbig2/pull/6#discussion_r4501124675
##########
src/main/java/org/apache/pdfbox/jbig2/segments/SymbolDictionary.java:
##########
@@ -405,6 +405,15 @@ public ArrayList<Bitmap> getDictionary()
}
/* 6.5.5 1) */
+ final long totalSymbols = (long) amountOfImportedSymbols +
amountOfNewSymbols;
+ if (amountOfNewSymbols < 0 || amountOfImportedSymbols < 0 ||
+ amountOfExportSymbolss < 0 || totalSymbols > Integer.MAX_VALUE
||
+ amountOfExportSymbolss > totalSymbols)
Review Comment:
This check runs after `resetIntegerCoderStatistics()`, which already
allocates using the header-derived symbol count. For an arithmetic/refinement
dictionary with new=0x40000001 and exported=0xffffffff, `getSbSymCodeLen()`
returns 31 and `new CX(1 << 31, 1)` throws `NegativeArraySizeException` before
the negative exported-count check executes. Move the validation ahead of
integer-coder initialization so these malformed headers produce the intended
checked exception.
##########
src/main/java/org/apache/pdfbox/jbig2/segments/PatternDictionary.java:
##########
@@ -125,6 +125,12 @@ private void checkInput() throws
InvalidHeaderValueException
{
throw new InvalidHeaderValueException("Width/Heigth must be
greater than zero.");
}
+ // Guard the int arithmetic on grayMax: (grayMax + 1) is used as a
collection
+ // capacity and (grayMax + 1) * hdpWidth as a bitmap width.
+ if (grayMax < 0 || ((long) grayMax + 1) * hdpWidth > Integer.MAX_VALUE)
+ {
+ throw new InvalidHeaderValueException("Invalid GRAYMAX value: " +
grayMax);
Review Comment:
The GRAYMAX guard runs during `init()`, where
`SegmentHeader.getSegmentData()` wraps its checked exception in
`RuntimeException`, so malformed input still escapes the reader's `IOException`
handling. It also misses byte-count overflow: GRAYMAX=0x1ffffff, HDPW=8,
HDPH=64 passes the width check but requires 2^31 bytes and triggers `Bitmap`'s
unchecked exception. Move validation to `getDictionary()`, check both
collective width and rounded stride × height, and add negative/overflow
boundary tests including reader-level `IOException` behavior.
##########
src/main/java/org/apache/pdfbox/jbig2/Bitmap.java:
##########
@@ -51,10 +51,19 @@ public class Bitmap
*/
public Bitmap(int width, int height)
{
+ if (width < 0 || height < 0)
+ {
+ throw new IllegalArgumentException(
+ "Bitmap dimensions must not be negative: " + width + "x" +
height);
+ }
this.height = height;
this.width = width;
- this.rowStride = (width + 7) >> 3;
-
+ this.rowStride = (int) (((long) width + 7) >> 3);
+ if ((long) this.height * this.rowStride > Integer.MAX_VALUE)
Review Comment:
The widened stride calculation admits widths that downstream decoders still
cannot handle: `Bitmap(Integer.MAX_VALUE, 1)` passes, but `GenericRegion`
overflows its padded width and skips pixel decoding. The MMR path also
overflows `new int[width + 5]` for this width. Reject widths above
`Integer.MAX_VALUE - 7` until those decoder calculations support them.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
