diff --git a/imageio/imageio-jpeg/src/main/java/com/twelvemonkeys/imageio/plugins/jpeg/JPEGImageReader.java b/imageio/imageio-jpeg/src/main/java/com/twelvemonkeys/imageio/plugins/jpeg/JPEGImageReader.java index 2f13164d..68bc347e 100644 --- a/imageio/imageio-jpeg/src/main/java/com/twelvemonkeys/imageio/plugins/jpeg/JPEGImageReader.java +++ b/imageio/imageio-jpeg/src/main/java/com/twelvemonkeys/imageio/plugins/jpeg/JPEGImageReader.java @@ -560,11 +560,13 @@ public class JPEGImageReader extends ImageReaderBase { switch (adobeDCT.getTransform()) { case AdobeDCTSegment.YCC: if (startOfFrame.components.length != 3) { + // This probably means the Adobe marker is bogus break; } return JPEGColorSpace.YCbCr; case AdobeDCTSegment.YCCK: if (startOfFrame.components.length != 4) { + // This probably means the Adobe marker is bogus break; } return JPEGColorSpace.YCCK; @@ -789,7 +791,13 @@ public class JPEGImageReader extends ImageReaderBase { if (!jfif.isEmpty()) { JPEGSegment segment = jfif.get(0); - return JFIFSegment.read(segment.data()); + + if (segment.length() >= 9) { + return JFIFSegment.read(segment.data()); + } + else { + processWarningOccurred("Bogus JFIF segment, ignoring"); + } } return null; @@ -800,7 +808,12 @@ public class JPEGImageReader extends ImageReaderBase { if (!jfxx.isEmpty()) { JPEGSegment segment = jfxx.get(0); - return JFXXSegment.read(segment.data(), segment.length()); + if (segment.length() >= 1) { + return JFXXSegment.read(segment.data(), segment.length()); + } + else { + processWarningOccurred("Bogus JFXX segment, ignoring"); + } } return null; diff --git a/imageio/imageio-jpeg/src/test/java/com/twelvemonkeys/imageio/plugins/jpeg/JPEGImageReaderTest.java b/imageio/imageio-jpeg/src/test/java/com/twelvemonkeys/imageio/plugins/jpeg/JPEGImageReaderTest.java index 23c02566..f513b07d 100644 --- a/imageio/imageio-jpeg/src/test/java/com/twelvemonkeys/imageio/plugins/jpeg/JPEGImageReaderTest.java +++ b/imageio/imageio-jpeg/src/test/java/com/twelvemonkeys/imageio/plugins/jpeg/JPEGImageReaderTest.java @@ -88,7 +88,8 @@ public class JPEGImageReaderTest extends ImageReaderAbstractTestCase getBrokenTestData() { return Arrays.asList( - new TestData(getClassLoaderResource("/jpeg/broken-bogus-segment-length.jpg"), new Dimension(467, 612)), - new TestData(getClassLoaderResource("/jpeg/broken-adobe-marker-bad-length.jpg"), new Dimension(1800, 1200)), - new TestData(getClassLoaderResource("/jpeg/broken-invalid-adobe-ycc-gray.jpg"), new Dimension(11, 440)) + new TestData(getClassLoaderResource("/broken-jpeg/broken-bogus-segment-length.jpg"), new Dimension(467, 612)), + new TestData(getClassLoaderResource("/broken-jpeg/broken-adobe-marker-bad-length.jpg"), new Dimension(1800, 1200)), + new TestData(getClassLoaderResource("/broken-jpeg/broken-invalid-adobe-ycc-gray.jpg"), new Dimension(11, 440)) ); // More test data in specific tests below @@ -493,7 +494,7 @@ public class JPEGImageReaderTest extends ImageReaderAbstractTestCase