[
https://issues.apache.org/jira/browse/IMAGING-203?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16306213#comment-16306213
]
Bruno P. Kinoshita commented on IMAGING-203:
--------------------------------------------
Commit: 4701b96281124b9ccd6ecd35c3f16aa73345f315
> JPEG segment size not validated
> -------------------------------
>
> Key: IMAGING-203
> URL: https://issues.apache.org/jira/browse/IMAGING-203
> Project: Commons Imaging
> Issue Type: Bug
> Components: Format: JPEG
> Reporter: Rody Kersten
> Assignee: Bruno P. Kinoshita
> Fix For: 1.0
>
> Attachments: NegSegmentSize.JPG, NegSegmentSize.patch
>
>
> Using my AFL-based fuzzer for Java, Kelinci
> (https://github.com/isstac/kelinci) I found that a NegativeArraySizeException
> may be throw when attempting to read an invalid JPEG image.
> Each JPEG segment starts with a two-byte unsigned integer specifying the
> segment size. Segments are parsed by
> org.apache.commons.imaging.formats.jpeg.JpegUtils.traverseJFIF(). As the
> specified size includes these two bytes, the method subtracts 2 from the size
> before it is used. It then attempts to allocate a buffer for the segment,
> which fails if the specified size is 0 or 1. The method should throw an
> ImageReadException instead.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
