Merged in OpenJDK changes.

4 files changed, 218 insertions, 72 deletions

diff --git a/openjdk/sun/awt/image/ByteComponentRaster.java b/openjdk/sun/awt/image/ByteComponentRaster.java
index 912542a7..133a6d68 100644
--- a/openjdk/sun/awt/image/ByteComponentRaster.java
+++ b/openjdk/sun/awt/image/ByteComponentRaster.java
@@ -191,7 +191,7 @@ public class ByteComponentRaster extends SunWritableRaster {
         }
         this.bandOffset = this.dataOffsets[0];
 
-        verify(false);
+        verify();
     }
 
     /**
@@ -850,38 +850,79 @@ public class ByteComponentRaster extends SunWritableRaster {
     }
 
     /**
-     * Verify that the layout parameters are consistent with
-     * the data.  If strictCheck
-     * is false, this method will check for ArrayIndexOutOfBounds conditions.  If
-     * strictCheck is true, this method will check for additional error
-     * conditions such as line wraparound (width of a line greater than
-     * the scanline stride).
-     * @return   String   Error string, if the layout is incompatible with
-     *                    the data.  Otherwise returns null.
+     * Verify that the layout parameters are consistent with the data.
+     *
+     * The method verifies whether scanline stride and pixel stride do not
+     * cause an integer overflow during calculation of a position of the pixel
+     * in data buffer. It also verifies whether the data buffer has enough data
+     *  to correspond the raster layout attributes.
+     *
+     * @throws RasterFormatException if an integer overflow is detected,
+     * or if data buffer has not enough capacity.
      */
-    private void verify (boolean strictCheck) {
-        // Make sure data for Raster is in a legal range
-        for (int i=0; i < dataOffsets.length; i++) {
+    protected final void verify() {
+        /* Need to re-verify the dimensions since a sample model may be
+         * specified to the constructor
+         */
+        if (width <= 0 || height <= 0 ||
+            height > (Integer.MAX_VALUE / width))
+        {
+            throw new RasterFormatException("Invalid raster dimension");
+        }
+
+        for (int i = 0; i < dataOffsets.length; i++) {
             if (dataOffsets[i] < 0) {
-                throw new RasterFormatException("Data offsets for band "+i+
-                                                "("+dataOffsets[i]+
-                                                ") must be >= 0");
+                throw new RasterFormatException("Data offsets for band " + i
+                            + "(" + dataOffsets[i]
+                            + ") must be >= 0");
             }
         }
 
-        int maxSize = 0;
-        int size;
+        // we can be sure that width and height are greater than 0
+        if (scanlineStride < 0 ||
+            scanlineStride > (Integer.MAX_VALUE / height) ||
+            scanlineStride > data.length)
+        {
+            // integer overflow
+            throw new RasterFormatException("Incorrect scanline stride: "
+                    + scanlineStride);
+        }
+        int lastScanOffset = (height - 1) * scanlineStride;
+
+        if (pixelStride < 0 ||
+            pixelStride > (Integer.MAX_VALUE / width) ||
+            pixelStride > data.length)
+        {
+            // integer overflow
+            throw new RasterFormatException("Incorrect pixel stride: "
+                    + pixelStride);
+        }
+        int lastPixelOffset = (width - 1) * pixelStride;
+
+        if (lastPixelOffset > (Integer.MAX_VALUE - lastScanOffset)) {
+            // integer overflow
+            throw new RasterFormatException("Incorrect raster attributes");
+        }
+        lastPixelOffset += lastScanOffset;
+
+        int index;
+        int maxIndex = 0;
+        for (int i = 0; i < numDataElements; i++) {
+            if (dataOffsets[i] > (Integer.MAX_VALUE - lastPixelOffset)) {
+                throw new RasterFormatException("Incorrect band offset: "
+                            + dataOffsets[i]);
+
+            }
+
+            index = lastPixelOffset + dataOffsets[i];
 
-        for (int i=0; i < numDataElements; i++) {
-            size = (height-1)*scanlineStride + (width-1)*pixelStride +
-                dataOffsets[i];
-            if (size > maxSize) {
-                maxSize = size;
+            if (index > maxIndex) {
+                maxIndex = index;
             }
         }
-        if (data.length < maxSize) {
-            throw new RasterFormatException("Data array too small (should be "+
-                                          maxSize+" )");
+        if (data.length <= maxIndex) {
+            throw new RasterFormatException("Data array too small (should be > "
+                    + maxIndex + " )");
         }
     }
 
diff --git a/openjdk/sun/awt/image/BytePackedRaster.java b/openjdk/sun/awt/image/BytePackedRaster.java
index 25c84f42..e9999c4c 100644
--- a/openjdk/sun/awt/image/BytePackedRaster.java
+++ b/openjdk/sun/awt/image/BytePackedRaster.java
@@ -1361,11 +1361,36 @@ public class BytePackedRaster extends SunWritableRaster {
             throw new RasterFormatException("Data offsets must be >= 0");
         }
 
+        /* Need to re-verify the dimensions since a sample model may be
+         * specified to the constructor
+         */
+        if (width <= 0 || height <= 0 ||
+            height > (Integer.MAX_VALUE / width))
+        {
+            throw new RasterFormatException("Invalid raster dimension");
+        }
+
+
+        /*
+         * pixelBitstride was verified in constructor, so just make
+         * sure that it is safe to multiply it by width.
+         */
+        if ((width - 1) > Integer.MAX_VALUE / pixelBitStride) {
+            throw new RasterFormatException("Invalid raster dimension");
+        }
+
+        if (scanlineStride < 0 ||
+            scanlineStride > (Integer.MAX_VALUE / height) ||
+            scanlineStride > data.length)
+        {
+            throw new RasterFormatException("Invalid scanline stride");
+        }
+
         int lastbit = (dataBitOffset
                        + (height-1) * scanlineStride * 8
                        + (width-1) * pixelBitStride
                        + pixelBitStride - 1);
-        if (lastbit / 8 >= data.length) {
+        if (lastbit < 0 || lastbit / 8 >= data.length) {
             throw new RasterFormatException("raster dimensions overflow " +
                                             "array bounds");
         }
diff --git a/openjdk/sun/awt/image/IntegerComponentRaster.java b/openjdk/sun/awt/image/IntegerComponentRaster.java
index 7c44c6f9..48d6f920 100644
--- a/openjdk/sun/awt/image/IntegerComponentRaster.java
+++ b/openjdk/sun/awt/image/IntegerComponentRaster.java
@@ -201,7 +201,7 @@ public class IntegerComponentRaster extends SunWritableRaster {
                                             " SinglePixelPackedSampleModel");
         }
 
-        verify(false);
+        verify();
     }
 
 
@@ -622,35 +622,75 @@ public class IntegerComponentRaster extends SunWritableRaster {
     }
 
     /**
-     * Verify that the layout parameters are consistent with
-     * the data.  If strictCheck
-     * is false, this method will check for ArrayIndexOutOfBounds conditions.  If
-     * strictCheck is true, this method will check for additional error
-     * conditions such as line wraparound (width of a line greater than
-     * the scanline stride).
-     * @return   String   Error string, if the layout is incompatible with
-     *                    the data.  Otherwise returns null.
+     * Verify that the layout parameters are consistent with the data.
+     *
+     * The method verifies whether scanline stride and pixel stride do not
+     * cause an integer overflow during calculation of a position of the pixel
+     * in data buffer. It also verifies whether the data buffer has enough data
+     *  to correspond the raster layout attributes.
+     *
+     * @throws RasterFormatException if an integer overflow is detected,
+     * or if data buffer has not enough capacity.
      */
-    private void verify (boolean strictCheck) {
+    protected final void verify() {
+        /* Need to re-verify the dimensions since a sample model may be
+         * specified to the constructor
+         */
+        if (width <= 0 || height <= 0 ||
+            height > (Integer.MAX_VALUE / width))
+        {
+            throw new RasterFormatException("Invalid raster dimension");
+        }
+
         if (dataOffsets[0] < 0) {
             throw new RasterFormatException("Data offset ("+dataOffsets[0]+
                                             ") must be >= 0");
         }
 
-        int maxSize = 0;
-        int size;
+        // we can be sure that width and height are greater than 0
+        if (scanlineStride < 0 ||
+            scanlineStride > (Integer.MAX_VALUE / height) ||
+            scanlineStride > data.length)
+        {
+            // integer overflow
+            throw new RasterFormatException("Incorrect scanline stride: "
+                    + scanlineStride);
+        }
+        int lastScanOffset = (height - 1) * scanlineStride;
+
+        if (pixelStride < 0 ||
+            pixelStride > (Integer.MAX_VALUE / width) ||
+            pixelStride > data.length)
+        {
+            // integer overflow
+            throw new RasterFormatException("Incorrect pixel stride: "
+                    + pixelStride);
+        }
+        int lastPixelOffset = (width - 1) * pixelStride;
+
+        if (lastPixelOffset > (Integer.MAX_VALUE - lastScanOffset)) {
+            // integer overflow
+            throw new RasterFormatException("Incorrect raster attributes");
+        }
+        lastPixelOffset += lastScanOffset;
+
+        int index;
+        int maxIndex = 0;
+        for (int i = 0; i < numDataElements; i++) {
+            if (dataOffsets[i] > (Integer.MAX_VALUE - lastPixelOffset)) {
+                throw new RasterFormatException("Incorrect band offset: "
+                            + dataOffsets[i]);
+            }
+
+            index = lastPixelOffset + dataOffsets[i];
 
-        for (int i=0; i < numDataElements; i++) {
-            size = (height-1)*scanlineStride + (width-1)*pixelStride +
-                dataOffsets[i];
-            if (size > maxSize) {
-                maxSize = size;
+            if (index > maxIndex) {
+                maxIndex = index;
             }
         }
-        if (data.length < maxSize) {
-            throw new RasterFormatException("Data array too small (should be "+
-                                          maxSize
-                                          +" but is "+data.length+" )");
+        if (data.length <= maxIndex) {
+            throw new RasterFormatException("Data array too small (should be > "
+                    + maxIndex + " )");
         }
     }
 
diff --git a/openjdk/sun/awt/image/ShortComponentRaster.java b/openjdk/sun/awt/image/ShortComponentRaster.java
index f353fa8c..8ec545c5 100644
--- a/openjdk/sun/awt/image/ShortComponentRaster.java
+++ b/openjdk/sun/awt/image/ShortComponentRaster.java
@@ -191,7 +191,7 @@ public class ShortComponentRaster extends SunWritableRaster {
         }
         this.bandOffset = this.dataOffsets[0];
 
-        verify(false);
+        verify();
     }
 
     /**
@@ -784,38 +784,78 @@ public class ShortComponentRaster extends SunWritableRaster {
     }
 
     /**
-     * Verify that the layout parameters are consistent with
-     * the data.  If strictCheck
-     * is false, this method will check for ArrayIndexOutOfBounds conditions.  If
-     * strictCheck is true, this method will check for additional error
-     * conditions such as line wraparound (width of a line greater than
-     * the scanline stride).
-     * @return   String   Error string, if the layout is incompatible with
-     *                    the data.  Otherwise returns null.
+     * Verify that the layout parameters are consistent with the data.
+     *
+     * The method verifies whether scanline stride and pixel stride do not
+     * cause an integer overflow during calculation of a position of the pixel
+     * in data buffer. It also verifies whether the data buffer has enough data
+     *  to correspond the raster layout attributes.
+     *
+     * @throws RasterFormatException if an integer overflow is detected,
+     * or if data buffer has not enough capacity.
      */
-    private void verify (boolean strictCheck) {
-        // Make sure data for Raster is in a legal range
-        for (int i=0; i < dataOffsets.length; i++) {
+    protected final void verify() {
+        /* Need to re-verify the dimensions since a sample model may be
+         * specified to the constructor
+         */
+        if (width <= 0 || height <= 0 ||
+            height > (Integer.MAX_VALUE / width))
+        {
+            throw new RasterFormatException("Invalid raster dimension");
+        }
+
+        for (int i = 0; i < dataOffsets.length; i++) {
             if (dataOffsets[i] < 0) {
-                throw new RasterFormatException("Data offsets for band "+i+
-                                                "("+dataOffsets[i]+
-                                                ") must be >= 0");
+                throw new RasterFormatException("Data offsets for band " + i
+                            + "(" + dataOffsets[i]
+                            + ") must be >= 0");
             }
         }
 
-        int maxSize = 0;
-        int size;
+        // we can be sure that width and height are greater than 0
+        if (scanlineStride < 0 ||
+            scanlineStride > (Integer.MAX_VALUE / height) ||
+            scanlineStride > data.length)
+        {
+            // integer overflow
+            throw new RasterFormatException("Incorrect scanline stride: "
+                    + scanlineStride);
+        }
+        int lastScanOffset = (height - 1) * scanlineStride;
+
+        if (pixelStride < 0 ||
+            pixelStride > (Integer.MAX_VALUE / width) ||
+            pixelStride > data.length)
+        {
+            // integer overflow
+            throw new RasterFormatException("Incorrect pixel stride: "
+                    + pixelStride);
+        }
+        int lastPixelOffset = (width - 1) * pixelStride;
+
+        if (lastPixelOffset > (Integer.MAX_VALUE - lastScanOffset)) {
+            // integer overflow
+            throw new RasterFormatException("Incorrect raster attributes");
+        }
+        lastPixelOffset += lastScanOffset;
+
+        int index;
+        int maxIndex = 0;
+        for (int i = 0; i < numDataElements; i++) {
+            if (dataOffsets[i] > (Integer.MAX_VALUE - lastPixelOffset)) {
+                throw new RasterFormatException("Incorrect band offset: "
+                            + dataOffsets[i]);
+            }
+
+            index = lastPixelOffset + dataOffsets[i];
 
-        for (int i=0; i < numDataElements; i++) {
-            size = (height-1)*scanlineStride + (width-1)*pixelStride +
-                dataOffsets[i];
-            if (size > maxSize) {
-                maxSize = size;
+            if (index > maxIndex) {
+                maxIndex = index;
             }
         }
-        if (data.length < maxSize) {
-            throw new RasterFormatException("Data array too small (should be "+
-                                          maxSize+" )");
+        if (data.length <= maxIndex) {
+            throw new RasterFormatException("Data array too small (should be > "
+                    + maxIndex + " )");
         }
     }