From acad978f7122d9fcd2e97ab6350e894556c16d64 Mon Sep 17 00:00:00 2001
From: Oliver Schmidtmer <O.Schmidtmer@elo.com>
Date: Fri, 28 Jul 2017 12:52:15 +0200
Subject: [PATCH] An invalid IFD pointer caused creating an empty IFD Directory

---
 .../imageio/metadata/tiff/TIFFReader.java         |   5 ++++-
 .../imageio/metadata/tiff/TIFFReaderTest.java     |   9 +++++++++
 .../src/test/resources/tiff/ifd-end-pointer.tif   | Bin 0 -> 266 bytes
 3 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 imageio/imageio-metadata/src/test/resources/tiff/ifd-end-pointer.tif

diff --git a/imageio/imageio-metadata/src/main/java/com/twelvemonkeys/imageio/metadata/tiff/TIFFReader.java b/imageio/imageio-metadata/src/main/java/com/twelvemonkeys/imageio/metadata/tiff/TIFFReader.java
index cda9f231..224619f7 100644
--- a/imageio/imageio-metadata/src/main/java/com/twelvemonkeys/imageio/metadata/tiff/TIFFReader.java
+++ b/imageio/imageio-metadata/src/main/java/com/twelvemonkeys/imageio/metadata/tiff/TIFFReader.java
@@ -135,7 +135,10 @@ public final class TIFFReader extends MetadataReader {
                 CompoundDirectory next = (CompoundDirectory) readDirectory(pInput, nextOffset, true);
 
                 for (int i = 0; i < next.directoryCount(); i++) {
-                    ifds.add((IFD) next.getDirectory(i));
+                    if(next.getDirectory(i).size() > 0) {
+                        // Linked directories might be empty if nextOffset is after EOF, so skip them
+                        ifds.add((IFD) next.getDirectory(i));
+                    }
                 }
             }
         }
diff --git a/imageio/imageio-metadata/src/test/java/com/twelvemonkeys/imageio/metadata/tiff/TIFFReaderTest.java b/imageio/imageio-metadata/src/test/java/com/twelvemonkeys/imageio/metadata/tiff/TIFFReaderTest.java
index eeb7f36c..0ba7813f 100644
--- a/imageio/imageio-metadata/src/test/java/com/twelvemonkeys/imageio/metadata/tiff/TIFFReaderTest.java
+++ b/imageio/imageio-metadata/src/test/java/com/twelvemonkeys/imageio/metadata/tiff/TIFFReaderTest.java
@@ -311,4 +311,13 @@ public class TIFFReaderTest extends MetadataReaderAbstractTest {
             assertTrue(directory.getEntryById(32934).getValue() instanceof EOFException);
         }
     }
+
+    @Test
+    public void testReadIDFPointerBeyondEOF() throws IOException {
+        try (ImageInputStream stream = ImageIO.createImageInputStream(getResource("/tiff/ifd-end-pointer.tif"))) {
+            CompoundDirectory directory = (CompoundDirectory) createReader().read(stream);
+            assertEquals(1, directory.directoryCount());
+            assertEquals(15, directory.size());
+        }
+    }
 }
diff --git a/imageio/imageio-metadata/src/test/resources/tiff/ifd-end-pointer.tif b/imageio/imageio-metadata/src/test/resources/tiff/ifd-end-pointer.tif
new file mode 100644
index 0000000000000000000000000000000000000000..dc6feba7867a36cdabe6679ee2bb3dbfc78ffb43
GIT binary patch
literal 266
zcmebD)M5}|U|?Vo|JuO8(7?dYz`)4Nzz7s!17b!fn+3>bg0ew!%t+#FP&QDQfeT5E
zAR`Od91ftk5R$kk5?c()2AMAoRnHD&%OI)I1hSccVnEk0*fFw#*{6U!dmtO+##=!A
z|33r612<+7Ak%>%j87CqHyrw^0iqLj$btC|#>T>6@w7BG5WQgLOimDO!*!h*L<0bS
CB^1~I

literal 0
HcmV?d00001