On Mon, 12 Oct 2026 09:59:34 GMT, Timofei Fedotov <[email protected]> wrote:
> The legacy AWT JPEG decoder can write a synthetic two-byte JPEG EOI marker > beyond the input buffer in sun_jpeg_fill_suspended_buffer(). > > The function retains unconsumed input bytes and reads into the remaining > space. Its capacity check permits one remaining byte, but the EOF path writes > two bytes. With a 1024-byte input buffer, offset 1023, and read() returning > EOF, the second marker byte is written at index 1024. The path also requires > available() to report more bytes than remaining_skip before the read; a > stream whose availability estimate is inconsistent with the subsequent EOF > can satisfy this condition. > > Truncated input must be rejected or handled without writing outside the input > array. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai). Thank you for the tip! The test correctly checks my fix. ------------- PR Comment: https://git.openjdk.org/jdk/pull/33313#issuecomment-6210298459
