From 12050dfe61a725441c02c681e3e89af2e66d64ba Mon Sep 17 00:00:00 2001
From: Harald Kuhr <harald.kuhr@gmail.com>
Date: Thu, 9 Mar 2017 20:33:11 +0100
Subject: [PATCH] #328 CCITTFaxDecoderStream AIOOBE fix

---
 .../plugins/tiff/CCITTFaxDecoderStream.java   |   6 +++---
 .../tiff/CCITTFaxDecoderStreamTest.java       |  20 +++++++++++++++++-
 .../plugins/tiff/TIFFImageReaderTest.java     |   1 +
 .../resources/tiff/ccitt-too-many-changes.tif | Bin 0 -> 1849 bytes
 4 files changed, 23 insertions(+), 4 deletions(-)
 create mode 100644 imageio/imageio-tiff/src/test/resources/tiff/ccitt-too-many-changes.tif

diff --git a/imageio/imageio-tiff/src/main/java/com/twelvemonkeys/imageio/plugins/tiff/CCITTFaxDecoderStream.java b/imageio/imageio-tiff/src/main/java/com/twelvemonkeys/imageio/plugins/tiff/CCITTFaxDecoderStream.java
index 16ac23b8..7ca032a2 100644
--- a/imageio/imageio-tiff/src/main/java/com/twelvemonkeys/imageio/plugins/tiff/CCITTFaxDecoderStream.java
+++ b/imageio/imageio-tiff/src/main/java/com/twelvemonkeys/imageio/plugins/tiff/CCITTFaxDecoderStream.java
@@ -88,8 +88,8 @@ final class CCITTFaxDecoderStream extends FilterInputStream {
                 fillOrder, "Expected fill order 1  or 2: %s"
         );
 
-        this.changesReferenceRow = new int[columns + 1];
-        this.changesCurrentRow = new int[columns + 1];
+        this.changesReferenceRow = new int[columns + 2];
+        this.changesCurrentRow = new int[columns + 2];
 
         switch (type) {
             case TIFFExtension.COMPRESSION_CCITT_T4:
@@ -220,7 +220,7 @@ final class CCITTFaxDecoderStream extends FilterInputStream {
         }
     }
 
-    private int getNextChangingElement(final int a0, final boolean white) throws IOException {
+    private int getNextChangingElement(final int a0, final boolean white) {
         int start = (lastChangingElement & 0xFFFF_FFFE) + (white ? 0 : 1);
         if (start > 2) {
             start -= 2;
diff --git a/imageio/imageio-tiff/src/test/java/com/twelvemonkeys/imageio/plugins/tiff/CCITTFaxDecoderStreamTest.java b/imageio/imageio-tiff/src/test/java/com/twelvemonkeys/imageio/plugins/tiff/CCITTFaxDecoderStreamTest.java
index 599d26f7..d5ded55a 100644
--- a/imageio/imageio-tiff/src/test/java/com/twelvemonkeys/imageio/plugins/tiff/CCITTFaxDecoderStreamTest.java
+++ b/imageio/imageio-tiff/src/test/java/com/twelvemonkeys/imageio/plugins/tiff/CCITTFaxDecoderStreamTest.java
@@ -233,7 +233,8 @@ public class CCITTFaxDecoderStreamTest {
         // Produces an CCITT Stream with 9 changes on 8 columns.
         byte[] data = new byte[] {(byte) 0b10101010};
         ByteArrayOutputStream imageOutput = new ByteArrayOutputStream();
-        OutputStream outputSteam = new CCITTFaxEncoderStream(imageOutput, 8, 1, TIFFExtension.COMPRESSION_CCITT_T6, 1, 0L);
+        OutputStream outputSteam = new CCITTFaxEncoderStream(imageOutput,
+                8, 1, TIFFExtension.COMPRESSION_CCITT_T6, 1, 0L);
         outputSteam.write(data);
         outputSteam.close();
 
@@ -243,4 +244,21 @@ public class CCITTFaxDecoderStreamTest {
         byte decoded = (byte) inputStream.read();
         assertEquals(data[0], decoded);
     }
+
+    @Test
+    public void testMoreChangesThanColumnsFile() throws IOException {
+        // See https://github.com/haraldk/TwelveMonkeys/issues/328
+        // 26 changes on 24 columns: H0w1b, H1w1b, ..., H1w0b
+        InputStream stream = getClass().getResourceAsStream("/tiff/ccitt-too-many-changes.tif");
+
+        // Skip bytes before StripOffsets: 86
+        for (int i = 0; i < 86; i++) {
+            stream.read();
+        }
+
+        InputStream inputStream = new CCITTFaxDecoderStream(stream,
+                24, TIFFExtension.COMPRESSION_CCITT_T6, 1, 0L);
+        byte decoded = (byte) inputStream.read();
+        assertEquals((byte) 0b10101010, decoded);
+    }
 }
diff --git a/imageio/imageio-tiff/src/test/java/com/twelvemonkeys/imageio/plugins/tiff/TIFFImageReaderTest.java b/imageio/imageio-tiff/src/test/java/com/twelvemonkeys/imageio/plugins/tiff/TIFFImageReaderTest.java
index f902c61d..1591bd60 100644
--- a/imageio/imageio-tiff/src/test/java/com/twelvemonkeys/imageio/plugins/tiff/TIFFImageReaderTest.java
+++ b/imageio/imageio-tiff/src/test/java/com/twelvemonkeys/imageio/plugins/tiff/TIFFImageReaderTest.java
@@ -109,6 +109,7 @@ public class TIFFImageReaderTest extends ImageReaderAbstractTest<TIFFImageReader
                 new TestData(getClassLoaderResource("/tiff/ccitt_tolessrows.tif"), new Dimension(6, 6)), // CCITT, metadata claiming 6 rows, stream contains only 4
                 new TestData(getClassLoaderResource("/tiff/fivepages-scan-causingerrors.tif"), new Dimension(2480, 3518)), // B/W, CCITT T4
                 new TestData(getClassLoaderResource("/tiff/CCITTgetNextChangingElement.tif"), new Dimension(2402,195)),
+                new TestData(getClassLoaderResource("/tiff/ccitt-too-many-changes.tif"), new Dimension(24,153)),
                 // CIELab
                 new TestData(getClassLoaderResource("/tiff/ColorCheckerCalculator.tif"), new Dimension(798, 546)), // CIELab 8 bit/sample
                 // Gray
diff --git a/imageio/imageio-tiff/src/test/resources/tiff/ccitt-too-many-changes.tif b/imageio/imageio-tiff/src/test/resources/tiff/ccitt-too-many-changes.tif
new file mode 100644
index 0000000000000000000000000000000000000000..4521cfd35ebe2fbf1d2c7b58d3b680623eeb6883
GIT binary patch
literal 1849
zcmebEWzb?^VBlb2V`N}p0kVJ;g9IZZoIR6~nSmKB4wPkNgR(&af^aoqjN&jh+hd><
zgW8I|ju)ut;cj1(%Rb9J1XLQCAcUav6ierBkm%w7he<4)3Q$6Mk(F}WTa(MaMss08
zKuK4=fTw)AAkkh&r~zQ3K(<J4x$J9lssv^*P+Y{)d5Q&C)D&Sb3#XEm@*;~opyJD#
wmypDPCI>tMiE3OyI8Q(Y<b_dZkA^lRrHm$$(JYB5k48(95nOIJa4<9g0M{8lUjP6A

literal 0
HcmV?d00001