diff --git a/src/share/classes/com/sun/imageio/plugins/gif/GIFImageReader.java b/src/share/classes/com/sun/imageio/plugins/gif/GIFImageReader.java index 0a278e0a1f96a4d041f8b04d5c1ebf5647f172a8..3df5e4d1769a1c4c185f26df516ed1fda6d89eb6 100644 --- a/src/share/classes/com/sun/imageio/plugins/gif/GIFImageReader.java +++ b/src/share/classes/com/sun/imageio/plugins/gif/GIFImageReader.java @@ -911,6 +911,10 @@ public class GIFImageReader extends ImageReader { try { // Read and decode the image data, fill in theImage this.initCodeSize = stream.readUnsignedByte(); + // GIF allows max 8 bpp, so anything larger is bogus for the roots. + if (this.initCodeSize < 1 || this.initCodeSize > 8) { + throw new IIOException("Bad code size:" + this.initCodeSize); + } // Read first data block this.blockLength = stream.readUnsignedByte(); @@ -1009,7 +1013,6 @@ public class GIFImageReader extends ImageReader { processReadAborted(); return theImage; } catch (IOException e) { - e.printStackTrace(); throw new IIOException("I/O error reading image!", e); } } diff --git a/test/javax/imageio/plugins/gif/GIFCodeSizeTest.java b/test/javax/imageio/plugins/gif/GIFCodeSizeTest.java new file mode 100644 index 0000000000000000000000000000000000000000..d72508716f2507bb2f4a1cd543b15ef40b0ae2b2 --- /dev/null +++ b/test/javax/imageio/plugins/gif/GIFCodeSizeTest.java @@ -0,0 +1,52 @@ +/* + * Copyright (c) 2020, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +/** + * @test + * @bug 8238842 + * @summary Test incorrect code size results in IOException + */ + +import java.io.ByteArrayInputStream; +import java.io.IOException; +import javax.imageio.ImageIO; + +public class GIFCodeSizeTest { + + static final byte[] DATA = { + (byte)0x47, (byte)0x49, (byte)0x46, (byte)0x38, (byte)0x37, + (byte)0x61, (byte)0x02, (byte)0x00, (byte)0x02, (byte)0x00, + (byte)0x80, (byte)0x00, (byte)0x80, (byte)0x00, (byte)0xff, + (byte)0xff, (byte)0x00, (byte)0x00, (byte)0x00, (byte)0x2c, + (byte)0x00, (byte)0x00, (byte)0x01, (byte)0x00, (byte)0x02, + (byte)0x00, (byte)0x02, (byte)0x00, (byte)0x00, (byte)0x12, + (byte)0x02, (byte)0x84, (byte)0x51, (byte)0x00, (byte)0x3b + }; + + public static void main(String[] args) /*throws Exception */{ + try { + ImageIO.read(new ByteArrayInputStream(DATA)); + } catch (IOException e) { + } + } +}