[jira] [Created] (IMAGING-388) Imaging.getBufferedImage causes an ArrayIndexOutOfBoundsException in BitParser.getSample on a greyscale PNG whose IHDR width overflows the scanline-size multiply

["Tim Scheckenbach (Jira)" <ji...@apache.org>]

Tim Scheckenbach created IMAGING-388:
----------------------------------------

             Summary: Imaging.getBufferedImage causes an ArrayIndexOutOfBoundsException in BitParser.getSample on a greyscale PNG whose IHDR width overflows the scanline-size multiply
                 Key: IMAGING-388
                 URL: https://issues.apache.org/jira/browse/IMAGING-388
             Project: Commons Imaging
          Issue Type: Bug
          Components: Format: PNG
    Affects Versions: 1.0.0-alpha7
            Reporter: Tim Scheckenbach
         Attachments: crash-273c4eec501fa92b0bd4b7443bc4af901937b3b0

Calling
{code:java}
Imaging.getBufferedImage(new File("crash-273c4eec501fa92b0bd4b7443bc4af901937b3b0"));
{code}
on the attached PNG results in:
{code}
java.lang.ArrayIndexOutOfBoundsException: Index 9 out of bounds for length 9
	at org.apache.commons.imaging.formats.png.BitParser.getSample(BitParser.java:38)
	at org.apache.commons.imaging.formats.png.BitParser.getSampleAsByte(BitParser.java:56)
	at org.apache.commons.imaging.formats.png.AbstractScanExpediter.getRgb(AbstractScanExpediter.java:99)
	at org.apache.commons.imaging.formats.png.ScanExpediterSimple.drive(ScanExpediterSimple.java:48)
	at org.apache.commons.imaging.formats.png.PngImageParser.getBufferedImage(PngImageParser.java:303)
	at org.apache.commons.imaging.formats.png.PngImageParser.getBufferedImage(PngImageParser.java:75)
{code}

The image is a 536870921x1 PNG with IHDR colour type 0 (greyscale), bit depth 8 and no interlace. Bit depth 8 on greyscale is legal, and the greyscale raster is about 512 MB, so it sits under Allocator's 1 GB cap and decoding proceeds.

After some investigation: {{ScanExpediterSimple.drive}} sizes each scanline with a 32-bit multiply,
{code:java}
final int bitsPerScanLine = bitsPerPixel * width;
final int pixelBytesPerScanLine = getBitsToBytesRoundingUp(bitsPerScanLine);
{code}
{{8 * 536870921 = 4294967368}}, which wraps to {{72}}. {{(72 + 7) / 8 = 9}}, so the scanline buffer is 9 bytes. The pixel loop still runs {{x}} from {{0}} to {{width - 1}}. At {{x = 9}}, the 8-bit branch of {{BitParser.getSample}} ({{BitParser.java:38}}) reads {{bytes[9]}} and throws. {{BitParser}} never checks that the computed byte index is in range.

{{Imaging.getBufferedImage}} is declared as {{throws ImagingException, IOException}}, so callers handling the documented exception types do not catch this one.

I have attached the image to the issue.

Found by the CISPA Fandango team.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)