The legacy AWT JPEG decoder can write a synthetic two-byte JPEG EOI marker beyond the input buffer in sun_jpeg_fill_suspended_buffer().
The function retains unconsumed input bytes and reads into the remaining space. Its capacity check permits one remaining byte, but the EOF path writes two bytes. With a 1024-byte input buffer, offset 1023, and read() returning EOF, the second marker byte is written at index 1024. The path also requires available() to report more bytes than remaining_skip before the read; a stream whose availability estimate is inconsistent with the subsequent EOF can satisfy this condition. Truncated input must be rejected or handled without writing outside the input array. --------- - [x] I confirm that I make this contribution in accordance with the [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai). ------------- Commit messages: - 8394262: AWT JPEG decoder may write past the input buffer when handling truncated progressive images Changes: https://git.openjdk.org/jdk/pull/33313/files Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=33313&range=00 Issue: https://bugs.openjdk.org/browse/JDK-8394262 Stats: 10 lines in 1 file changed: 7 ins; 0 del; 3 mod Patch: https://git.openjdk.org/jdk/pull/33313.diff Fetch: git fetch https://git.openjdk.org/jdk.git pull/33313/head:pull/33313 PR: https://git.openjdk.org/jdk/pull/33313
