TMI-119: Fixed endless loop, trying to read 0 bytes at EOF caused by bogus segment lengths...

imageio/imageio-jpeg/src/main/java/com/twelvemonkeys/imageio/plugins/jpeg/JPEGSegmentImageInputStream.java

@@ -271,7 +271,8 @@ final class JPEGSegmentImageInputStream extends ImageInputStreamImpl {
         while (total < len) {
             repositionAsNecessary();
 
-            int count = stream.read(b, off + total, (int) Math.min(len - total, segment.end() - streamPos));
+            long bytesLeft = segment.end() - streamPos; // If no more bytes after reposition, we're at EOF
+            int count = bytesLeft == 0 ? -1 : stream.read(b, off + total, (int) Math.min(len - total, bytesLeft));
 
             if (count == -1) {
                 // EOF

imageio/imageio-jpeg/src/test/java/com/twelvemonkeys/imageio/plugins/jpeg/JPEGImageReaderTest.java

@@ -104,7 +104,8 @@ public class JPEGImageReaderTest extends ImageReaderAbstractTestCase<JPEGImageRe
                 new TestData(getClassLoaderResource("/broken-jpeg/broken-adobe-marker-bad-length.jpg"), new Dimension(1800, 1200)), // Unreadable, segment lengths are wrong
                 new TestData(getClassLoaderResource("/broken-jpeg/broken-invalid-adobe-ycc-gray.jpg"), new Dimension(11, 440)), // Image readable, broken metadata (fixable?)
                 new TestData(getClassLoaderResource("/broken-jpeg/broken-no-sof-ascii-transfer-mode.jpg"), new Dimension(-1, -1)), // Unreadable, can't find SOFn marker
-                new TestData(getClassLoaderResource("/broken-jpeg/broken-sos-before-sof.jpg"), new Dimension(-1, -1)) // Unreadable, can't find SOFn marker
+                new TestData(getClassLoaderResource("/broken-jpeg/broken-sos-before-sof.jpg"), new Dimension(-1, -1)), // Unreadable, can't find SOFn marker
+                new TestData(getClassLoaderResource("/broken-jpeg/broken-adobe-segment-length-beyond-eof.jpg"), new Dimension(-1, -1)) // Unreadable, no EOI
         );
 
         // More test data in specific tests below

imageio/imageio-jpeg/src/test/resources/broken-jpeg/broken-adobe-segment-length-beyond-eof.jpg

@@ -0,0 +1,13 @@
+<EFBFBD><EFBFBD><EFBFBD><EFBFBD> Adobe d<>   
<01><> <20> 
+
+
+
+
+
+
+
+#"""#''''''''''
		
+			
+
+
+