alhudz opened a new pull request, #552: URL: https://github.com/apache/commons-imaging/pull/552
Reading the PCX decoder I noticed `getBufferedImage` sizes the pixel buffer with int multiplies of `xSize`/`ySize`, which both come from uint16 header fields and can reach 65536. For 24/32-bit and 8-bit/3-plane images `rowLength * ySize`, `xSize * ySize` and `ySize * bytesPerImageRow` overflow int and wrap small, so the value slips past the `Allocator` 1 GB guard and an undersized buffer feeds an out-of-bounds `arraycopy`. Computing in long lets the existing `Allocator.byteArray(long)` overload reject the real size instead. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
