[
https://issues.apache.org/jira/browse/IMAGING-332?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17833837#comment-17833837
]
Dominik Stadler commented on IMAGING-332:
-----------------------------------------
This seems to be fixed now via {{Allocator.check()}} being added in
{{BinaryFunctions#readBytes now.}}
> OutOfMemory with invalid PNG input file
> ---------------------------------------
>
> Key: IMAGING-332
> URL: https://issues.apache.org/jira/browse/IMAGING-332
> Project: Commons Imaging
> Issue Type: Bug
> Components: Format: PNG
> Affects Versions: 1.0-alpha3
> Reporter: Dominik Stadler
> Priority: Blocker
> Labels: fuzzer
> Fix For: 1.0.0-alpha5
>
> Attachments: image-2022-08-14-13-50-28-786.png
>
>
> The following snippet will cause an OOM as it tries to allocate a huge
> byte-array.
>
> {code:java}
> byte[] input =
> java.util.Base64.getDecoder().decode("iVBORw0KGgoAAAAbaUNDUMlDQyCrbAAtGHZwQWdQyUNDIKtsAAAYiVBORw0KGgp1AAAASURBVA0KGgoAAAANSUhEUgAAACAAIAQACAJ/2QAAsnMAAAAAAElFTkRCYAAY");
> Imaging.getAllBufferedImages(input); {code}
> All such allocations should be guarded by some limits, see e.g.
> [https://poi.apache.org/apidocs/dev/org/apache/poi/util/IOUtils.html#safelyAllocate-long-int-]
> for how Apache POI supports a configurable limit for allocations.
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
