diff --git a/imageio/imageio-core/src/main/java/com/twelvemonkeys/imageio/ImageReaderBase.java b/imageio/imageio-core/src/main/java/com/twelvemonkeys/imageio/ImageReaderBase.java index a848e072..cafdd327 100644 --- a/imageio/imageio-core/src/main/java/com/twelvemonkeys/imageio/ImageReaderBase.java +++ b/imageio/imageio-core/src/main/java/com/twelvemonkeys/imageio/ImageReaderBase.java @@ -310,8 +310,14 @@ public abstract class ImageReaderBase extends ImageReader { int destWidth = destRegion.x + destRegion.width; int destHeight = destRegion.y + destRegion.height; - if ((long) destWidth * destHeight > Integer.MAX_VALUE) { - throw new IllegalArgumentException(String.format("destination width * height > Integer.MAX_VALUE: %d", (long) destWidth * destHeight)); + long dimension = (long) destWidth * destHeight; + if (dimension > Integer.MAX_VALUE) { + throw new IllegalArgumentException(String.format("destination width * height > Integer.MAX_VALUE: %d", dimension)); + } + + long size = dimension * imageType.getSampleModel().getNumDataElements(); + if (size > Integer.MAX_VALUE) { + throw new IllegalArgumentException(String.format("destination width * height * samplesPerPixel > Integer.MAX_VALUE: %d", size)); } // Create a new image based on the type specifier diff --git a/imageio/imageio-core/src/test/java/com/twelvemonkeys/imageio/ImageReaderBaseTest.java b/imageio/imageio-core/src/test/java/com/twelvemonkeys/imageio/ImageReaderBaseTest.java index ac1353a9..6d04e6fa 100644 --- a/imageio/imageio-core/src/test/java/com/twelvemonkeys/imageio/ImageReaderBaseTest.java +++ b/imageio/imageio-core/src/test/java/com/twelvemonkeys/imageio/ImageReaderBaseTest.java @@ -42,7 +42,9 @@ import java.awt.image.DataBuffer; import java.util.Arrays; import java.util.Collections; import java.util.List; +import java.util.Set; +import static java.util.Collections.singleton; import static org.junit.Assert.*; /** @@ -218,10 +220,17 @@ public class ImageReaderBaseTest { } @Test(expected = IllegalArgumentException.class) - public void testGetDestinationExceedsIntegerMax() throws IIOException { + public void testGetDestinationDimensionExceedsIntegerMax() throws IIOException { ImageReaderBase.getDestination(null, TYPES.iterator(), 3 * Short.MAX_VALUE, 2 * Short.MAX_VALUE); // 6 442 057 734 pixels } + @Test(expected = IllegalArgumentException.class) + public void testGetDestinationStorageExceedsIntegerMax() throws IIOException { + Set byteTypes = singleton(ImageTypeSpecifier.createFromBufferedImageType(BufferedImage.TYPE_3BYTE_BGR)); + ImageReaderBase.getDestination(null, byteTypes.iterator(), Short.MAX_VALUE, Short.MAX_VALUE); // 1 073 676 289 pixels + // => 3 221 028 867 bytes needed in continuous array, not possible + } + @Test public void testHasExplicitDestinationNull() { assertFalse(ImageReaderBase.hasExplicitDestination(null));