From 6c9deb8768ab822ee228a1eee8e1b33113568ca9 Mon Sep 17 00:00:00 2001
From: Harald Kuhr <harald.kuhr@gmail.com>
Date: Wed, 23 Nov 2016 20:40:48 +0100
Subject: [PATCH] #274 Fixed bug in 16 -> 8 bit downsampling of DQT, causing
 "Bogus marker length" IIOException

---
 .../imageio/plugins/jpeg/JPEGSegmentImageInputStream.java      | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/imageio/imageio-jpeg/src/main/java/com/twelvemonkeys/imageio/plugins/jpeg/JPEGSegmentImageInputStream.java b/imageio/imageio-jpeg/src/main/java/com/twelvemonkeys/imageio/plugins/jpeg/JPEGSegmentImageInputStream.java
index f7a2a727..80fe0739 100644
--- a/imageio/imageio-jpeg/src/main/java/com/twelvemonkeys/imageio/plugins/jpeg/JPEGSegmentImageInputStream.java
+++ b/imageio/imageio-jpeg/src/main/java/com/twelvemonkeys/imageio/plugins/jpeg/JPEGSegmentImageInputStream.java
@@ -361,7 +361,6 @@ final class JPEGSegmentImageInputStream extends ImageInputStreamImpl {
             return stream.read(b, off, len);
         }
 
-
         @Override
         public String toString() {
             return String.format("0x%04x[%d-%d]", marker, realStart, realEnd());
@@ -409,7 +408,7 @@ final class JPEGSegmentImageInputStream extends ImageInputStreamImpl {
             byte[] replacementData = new byte[length];
 
             int numQTs = length / 128;
-            int newSegmentLength = 2 + 1 + 64 * numQTs;
+            int newSegmentLength = 2 + (1 + 64) * numQTs; // Len + (qtInfo + qtSize) * numQTs
 
             replacementData[0] = (byte) ((JPEG.DQT >> 8) & 0xff);
             replacementData[1] = (byte) (JPEG.DQT & 0xff);