> The legacy AWT JPEG decoder can write a synthetic two-byte JPEG EOI marker > beyond the input buffer in sun_jpeg_fill_suspended_buffer(). > > The function retains unconsumed input bytes and reads into the remaining > space. Its capacity check permits one remaining byte, but the EOF path writes > two bytes. With a 1024-byte input buffer, offset 1023, and read() returning > EOF, the second marker byte is written at index 1024. The path also requires > available() to report more bytes than remaining_skip before the read; a > stream whose availability estimate is inconsistent with the subsequent EOF > can satisfy this condition. > > Truncated input must be rejected or handled without writing outside the input > array. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai).
Timofei Fedotov has updated the pull request incrementally with one additional commit since the last revision: Add test ------------- Changes: - all: https://git.openjdk.org/jdk/pull/33313/files - new: https://git.openjdk.org/jdk/pull/33313/files/144a94bc..a2257890 Webrevs: - full: https://webrevs.openjdk.org/?repo=jdk&pr=33313&range=01 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=33313&range=00-01 Stats: 157 lines in 1 file changed: 157 ins; 0 del; 0 mod Patch: https://git.openjdk.org/jdk/pull/33313.diff Fetch: git fetch https://git.openjdk.org/jdk.git pull/33313/head:pull/33313 PR: https://git.openjdk.org/jdk/pull/33313
