Tim Scheckenbach created IMAGING-385:
----------------------------------------
Summary: Imaging.getBufferedImage throws IllegalArgumentException
"Dimensions (width=2359300 height=65538) are too large" because ImageBuilder
sizes its pixel array with an overflowing int multiply
Key: IMAGING-385
URL: https://issues.apache.org/jira/browse/IMAGING-385
Project: Commons Imaging
Issue Type: Bug
Components: Format: BMP
Affects Versions: 1.0.0-alpha7
Reporter: Tim Scheckenbach
Attachments: crash-e506da5ae78242d1f3308a35980e95123dde479c
Calling
{code:java}
Imaging.getBufferedImage(new
File("crash-e506da5ae78242d1f3308a35980e95123dde479c"));
{code}
on the attached 90-byte BMP results in:
{code}
java.lang.IllegalArgumentException: Dimensions (width=2359300 height=65538) are
too large
at java.desktop/java.awt.image.SampleModel.<init>(SampleModel.java:131)
at
java.desktop/java.awt.image.SinglePixelPackedSampleModel.<init>(SinglePixelPackedSampleModel.java:144)
at
java.desktop/java.awt.image.Raster.createPackedRaster(Raster.java:915)
at
org.apache.commons.imaging.common.ImageBuilder.makeBufferedImage(ImageBuilder.java:240)
at
org.apache.commons.imaging.common.ImageBuilder.getBufferedImage(ImageBuilder.java:147)
at
org.apache.commons.imaging.formats.bmp.BmpImageParser.getBufferedImage(BmpImageParser.java:155)
at
org.apache.commons.imaging.formats.bmp.BmpImageParser.getBufferedImage(BmpImageParser.java:121)
{code}
The file is a BITMAPINFOHEADER BMP: 2359300 x 65538, 4 bpp, {{BI_RLE4}}. The
RLE payload is only {{EOL}}, two {{(0,0)}} deltas, and {{EOF}}, so
{{PixelParserRle.processImage}} returns without writing any pixels.
{{ImageBuilder}} constructs as:
{code:java}
checkDimensions(width, height); // only rejects width/height <= 0
data = Allocator.intArray(width * height);
{code}
{{2359300 * 65538}} is {{154623803400}}, which wraps in {{int}} to {{4980744}}.
{{Allocator}} then checks {{4980744 * 4 = 19922976}} bytes against the 1 GB
limit and allows a 19 MB array. The object still stores the original width and
height.
{{BmpImageParser.getBufferedImage}} then calls
{{imageBuilder.getBufferedImage()}}, which passes those header dimensions to
{{Raster.createPackedRaster}}. JDK {{SampleModel}} throws
{{IllegalArgumentException}} when {{(long) width * height}} is greater than
{{Integer.MAX_VALUE}}.
{{Imaging.getBufferedImage}} is declared as {{throws ImagingException,
IOException}}, so callers handling the documented exception types do not catch
this one.
I have attached the image to the issue.
Found by the CISPA Fandango Team.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
