[
https://issues.apache.org/jira/browse/IMAGING-384?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tim Scheckenbach updated IMAGING-384:
-------------------------------------
Description:
Calling
{code:java}
Imaging.getBufferedImage(new
File("crash-15da8bfcef6196e1792786d69303dcca78c7006a"));
{code}
on the attached PNG results in:
{code:java}
java.awt.color.CMMException: LCMS error 13: Couldn't link the profiles
at java.desktop/sun.java2d.cmm.lcms.LCMS.createNativeTransform(Native
Method)
at java.desktop/sun.java2d.cmm.lcms.LCMS.createTransform(LCMS.java:117)
at
java.desktop/sun.java2d.cmm.lcms.LCMSTransform.doTransform(LCMSTransform.java:149)
at
java.desktop/sun.java2d.cmm.lcms.LCMSTransform.colorConvert(LCMSTransform.java:668)
at
java.desktop/java.awt.image.ColorModel.getGray8TosRGB8LUT(ColorModel.java:1823)
at
java.desktop/java.awt.image.ComponentColorModel.setupLUTs(ComponentColorModel.java:449)
at
java.desktop/java.awt.image.ComponentColorModel.<init>(ComponentColorModel.java:301)
at
java.desktop/java.awt.image.ComponentColorModel.<init>(ComponentColorModel.java:353)
at
org.apache.commons.imaging.ColorTools.deriveColorModel(ColorTools.java:248)
at
org.apache.commons.imaging.ColorTools.deriveColorModel(ColorTools.java:228)
at
org.apache.commons.imaging.ColorTools.deriveColorModel(ColorTools.java:215)
at
org.apache.commons.imaging.ColorTools.relabelColorSpace(ColorTools.java:317)
at
org.apache.commons.imaging.ColorTools.convertBetweenColorSpaces(ColorTools.java:66)
at
org.apache.commons.imaging.formats.png.PngImageParser.getBufferedImage(PngImageParser.java:313)
at
org.apache.commons.imaging.formats.png.PngImageParser.getBufferedImage(PngImageParser.java:75)
{code}
The image is a 1x1 PNG with IHDR colour type 0 (greyscale) and an {{iCCP}}
chunk holding a
132-byte profile: the 128-byte ICC header plus a tag count of zero. It declares
{{dataColorSpace = 'GRAY'}} and carries no tags at all, so it has no white
point, no tone
reproduction curve and no matrix tags.
After some investigation: {{PngImageParser:237-244}} guards only the parsing of
the profile,
{code:java}
try {
iccProfile = ICC_Profile.getInstance(bytes);
} catch (final IllegalArgumentException iae) {
throw new ImagingException("The image data does not correspond to a valid
ICC Profile", iae);
}
{code}
and {{ICC_Profile.getInstance}} validates only the 128-byte header, so the
tagless profile is
accepted and applied at line 313. Here the colour space is *consistent* with
the image – a
one-component grey space against a one-band raster – so nothing rejects it.
{{{}ComponentColorModel{}}}'s constructor then eagerly calls {{{}setupLUTs{}}},
which builds a
grey-to-sRGB lookup table via {{{}ColorModel.getGray8TosRGB8LUT{}}}; LCMS is
asked to link a
profile with no transform data to sRGB and fails.
The existing try/catch suggests the intent is to report profile problems as
{{{}ImagingException{}}}, but it is scoped to parsing the profile rather than
to using it.
{{CMMException}} extends {{RuntimeException}} and {{Imaging.getBufferedImage}}
is declared as
{{{}throws ImagingException, IOException{}}}, so callers handling the
documented exception types
do not catch this one.
The failure is a property of the profile, not of the colour type: the same
tagless profile
retagged {{'RGB '}} and embedded in a truecolour PNG throws identically.
I have attached the image to the issue.
Found by CISPA Fandango Team
was:
Calling
{code:java}
Imaging.getBufferedImage(new
File("crash-15da8bfcef6196e1792786d69303dcca78c7006a"));
{code}
on the attached PNG results in:
{code}
java.awt.color.CMMException: LCMS error 13: Couldn't link the profiles
at java.desktop/sun.java2d.cmm.lcms.LCMS.createNativeTransform(Native
Method)
at java.desktop/sun.java2d.cmm.lcms.LCMS.createTransform(LCMS.java:117)
at
java.desktop/sun.java2d.cmm.lcms.LCMSTransform.doTransform(LCMSTransform.java:149)
at
java.desktop/sun.java2d.cmm.lcms.LCMSTransform.colorConvert(LCMSTransform.java:668)
at
java.desktop/java.awt.image.ColorModel.getGray8TosRGB8LUT(ColorModel.java:1823)
at
java.desktop/java.awt.image.ComponentColorModel.setupLUTs(ComponentColorModel.java:449)
at
java.desktop/java.awt.image.ComponentColorModel.<init>(ComponentColorModel.java:301)
at
java.desktop/java.awt.image.ComponentColorModel.<init>(ComponentColorModel.java:353)
at
org.apache.commons.imaging.ColorTools.deriveColorModel(ColorTools.java:248)
at
org.apache.commons.imaging.ColorTools.deriveColorModel(ColorTools.java:228)
at
org.apache.commons.imaging.ColorTools.deriveColorModel(ColorTools.java:215)
at
org.apache.commons.imaging.ColorTools.relabelColorSpace(ColorTools.java:317)
at
org.apache.commons.imaging.ColorTools.convertBetweenColorSpaces(ColorTools.java:66)
at
org.apache.commons.imaging.formats.png.PngImageParser.getBufferedImage(PngImageParser.java:313)
at
org.apache.commons.imaging.formats.png.PngImageParser.getBufferedImage(PngImageParser.java:75)
{code}
The image is a 1x1 PNG with IHDR colour type 0 (greyscale) and an {{iCCP}}
chunk holding a
132-byte profile: the 128-byte ICC header plus a tag count of zero. It declares
{{dataColorSpace = 'GRAY'}} and carries no tags at all, so it has no white
point, no tone
reproduction curve and no matrix tags.
After some investigation: {{PngImageParser:237-244}} guards only the parsing of
the profile,
{code:java}
try {
iccProfile = ICC_Profile.getInstance(bytes);
} catch (final IllegalArgumentException iae) {
throw new ImagingException("The image data does not correspond to a valid
ICC Profile", iae);
}
{code}
and {{ICC_Profile.getInstance}} validates only the 128-byte header, so the
tagless profile is
accepted and applied at line 313. Here the colour space is *consistent* with
the image -- a
one-component grey space against a one-band raster -- so nothing rejects it.
{{ComponentColorModel}}'s constructor then eagerly calls {{setupLUTs}}, which
builds a
grey-to-sRGB lookup table via {{ColorModel.getGray8TosRGB8LUT}}; LCMS is asked
to link a
profile with no transform data to sRGB and fails.
The existing try/catch suggests the intent is to report profile problems as
{{ImagingException}}, but it is scoped to parsing the profile rather than to
using it.
{{CMMException}} extends {{RuntimeException}} and {{Imaging.getBufferedImage}}
is declared as
{{throws ImagingException, IOException}}, so callers handling the documented
exception types
do not catch this one.
The failure is a property of the profile, not of the colour type: the same
tagless profile
retagged {{'RGB '}} and embedded in a truecolour PNG throws identically.
I have attached the image to the issue.
> Imaging.getBufferedImage causes a CMMException "LCMS error 13: Couldn't link
> the profiles" on a PNG whose ICC profile has an empty tag table
> --------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: IMAGING-384
> URL: https://issues.apache.org/jira/browse/IMAGING-384
> Project: Commons Imaging
> Issue Type: Bug
> Components: Format: PNG
> Affects Versions: 1.0.0-alpha7
> Reporter: Tim Scheckenbach
> Priority: Major
> Attachments: crash-15da8bfcef6196e1792786d69303dcca78c7006a
>
>
> Calling
> {code:java}
> Imaging.getBufferedImage(new
> File("crash-15da8bfcef6196e1792786d69303dcca78c7006a"));
> {code}
> on the attached PNG results in:
> {code:java}
> java.awt.color.CMMException: LCMS error 13: Couldn't link the profiles
> at java.desktop/sun.java2d.cmm.lcms.LCMS.createNativeTransform(Native
> Method)
> at java.desktop/sun.java2d.cmm.lcms.LCMS.createTransform(LCMS.java:117)
> at
> java.desktop/sun.java2d.cmm.lcms.LCMSTransform.doTransform(LCMSTransform.java:149)
> at
> java.desktop/sun.java2d.cmm.lcms.LCMSTransform.colorConvert(LCMSTransform.java:668)
> at
> java.desktop/java.awt.image.ColorModel.getGray8TosRGB8LUT(ColorModel.java:1823)
> at
> java.desktop/java.awt.image.ComponentColorModel.setupLUTs(ComponentColorModel.java:449)
> at
> java.desktop/java.awt.image.ComponentColorModel.<init>(ComponentColorModel.java:301)
> at
> java.desktop/java.awt.image.ComponentColorModel.<init>(ComponentColorModel.java:353)
> at
> org.apache.commons.imaging.ColorTools.deriveColorModel(ColorTools.java:248)
> at
> org.apache.commons.imaging.ColorTools.deriveColorModel(ColorTools.java:228)
> at
> org.apache.commons.imaging.ColorTools.deriveColorModel(ColorTools.java:215)
> at
> org.apache.commons.imaging.ColorTools.relabelColorSpace(ColorTools.java:317)
> at
> org.apache.commons.imaging.ColorTools.convertBetweenColorSpaces(ColorTools.java:66)
> at
> org.apache.commons.imaging.formats.png.PngImageParser.getBufferedImage(PngImageParser.java:313)
> at
> org.apache.commons.imaging.formats.png.PngImageParser.getBufferedImage(PngImageParser.java:75)
> {code}
> The image is a 1x1 PNG with IHDR colour type 0 (greyscale) and an {{iCCP}}
> chunk holding a
> 132-byte profile: the 128-byte ICC header plus a tag count of zero. It
> declares
> {{dataColorSpace = 'GRAY'}} and carries no tags at all, so it has no white
> point, no tone
> reproduction curve and no matrix tags.
> After some investigation: {{PngImageParser:237-244}} guards only the parsing
> of the profile,
> {code:java}
> try {
> iccProfile = ICC_Profile.getInstance(bytes);
> } catch (final IllegalArgumentException iae) {
> throw new ImagingException("The image data does not correspond to a valid
> ICC Profile", iae);
> }
> {code}
> and {{ICC_Profile.getInstance}} validates only the 128-byte header, so the
> tagless profile is
> accepted and applied at line 313. Here the colour space is *consistent* with
> the image – a
> one-component grey space against a one-band raster – so nothing rejects it.
> {{{}ComponentColorModel{}}}'s constructor then eagerly calls
> {{{}setupLUTs{}}}, which builds a
> grey-to-sRGB lookup table via {{{}ColorModel.getGray8TosRGB8LUT{}}}; LCMS is
> asked to link a
> profile with no transform data to sRGB and fails.
> The existing try/catch suggests the intent is to report profile problems as
> {{{}ImagingException{}}}, but it is scoped to parsing the profile rather than
> to using it.
> {{CMMException}} extends {{RuntimeException}} and
> {{Imaging.getBufferedImage}} is declared as
> {{{}throws ImagingException, IOException{}}}, so callers handling the
> documented exception types
> do not catch this one.
> The failure is a property of the profile, not of the colour type: the same
> tagless profile
> retagged {{'RGB '}} and embedded in a truecolour PNG throws identically.
> I have attached the image to the issue.
>
> Found by CISPA Fandango Team
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
