diff options
Diffstat (limited to 'openjdk/sun/awt/image/BytePackedRaster.java')
-rw-r--r-- | openjdk/sun/awt/image/BytePackedRaster.java | 27 |
1 files changed, 26 insertions, 1 deletions
diff --git a/openjdk/sun/awt/image/BytePackedRaster.java b/openjdk/sun/awt/image/BytePackedRaster.java index 25c84f42..e9999c4c 100644 --- a/openjdk/sun/awt/image/BytePackedRaster.java +++ b/openjdk/sun/awt/image/BytePackedRaster.java @@ -1361,11 +1361,36 @@ public class BytePackedRaster extends SunWritableRaster { throw new RasterFormatException("Data offsets must be >= 0"); } + /* Need to re-verify the dimensions since a sample model may be + * specified to the constructor + */ + if (width <= 0 || height <= 0 || + height > (Integer.MAX_VALUE / width)) + { + throw new RasterFormatException("Invalid raster dimension"); + } + + + /* + * pixelBitstride was verified in constructor, so just make + * sure that it is safe to multiply it by width. + */ + if ((width - 1) > Integer.MAX_VALUE / pixelBitStride) { + throw new RasterFormatException("Invalid raster dimension"); + } + + if (scanlineStride < 0 || + scanlineStride > (Integer.MAX_VALUE / height) || + scanlineStride > data.length) + { + throw new RasterFormatException("Invalid scanline stride"); + } + int lastbit = (dataBitOffset + (height-1) * scanlineStride * 8 + (width-1) * pixelBitStride + pixelBitStride - 1); - if (lastbit / 8 >= data.length) { + if (lastbit < 0 || lastbit / 8 >= data.length) { throw new RasterFormatException("raster dimensions overflow " + "array bounds"); } |