On Fri, 16 Oct 2026 07:21:52 GMT, Timofei Fedotov <[email protected]> wrote:
>> The legacy AWT JPEG decoder can write a synthetic two-byte JPEG EOI marker >> beyond the input buffer in sun_jpeg_fill_suspended_buffer(). >> >> The function retains unconsumed input bytes and reads into the remaining >> space. Its capacity check permits one remaining byte, but the EOF path >> writes two bytes. With a 1024-byte input buffer, offset 1023, and read() >> returning EOF, the second marker byte is written at index 1024. The path >> also requires available() to report more bytes than remaining_skip before >> the read; a stream whose availability estimate is inconsistent with the >> subsequent EOF can satisfy this condition. >> >> Truncated input must be rejected or handled without writing outside the >> input array. >> >> --------- >> - [x] I confirm that I make this contribution in accordance with the >> [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai). > > Timofei Fedotov has updated the pull request incrementally with one > additional commit since the last revision: > > Add test ping! ------------- PR Comment: https://git.openjdk.org/jdk/pull/33313#issuecomment-6361916234
