From fa49dd93a7b1984f6aae3c0cbf1722fb4e2c0472 Mon Sep 17 00:00:00 2001
From: Harald Kuhr <harald.kuhr@gmail.com>
Date: Tue, 4 Jun 2024 22:52:03 +0200
Subject: [PATCH]  #955: PSD: Fix overflow issue found in GIMP PSD

---
 .../imageio/plugins/psd/PSDUtil.java             |   3 ++-
 .../imageio/plugins/psd/PSDImageReaderTest.java  |   4 +++-
 .../psd/gimp-32x32-packbits-overflow.psd         | Bin 0 -> 4546 bytes
 3 files changed, 5 insertions(+), 2 deletions(-)
 create mode 100644 imageio/imageio-psd/src/test/resources/psd/gimp-32x32-packbits-overflow.psd

diff --git a/imageio/imageio-psd/src/main/java/com/twelvemonkeys/imageio/plugins/psd/PSDUtil.java b/imageio/imageio-psd/src/main/java/com/twelvemonkeys/imageio/plugins/psd/PSDUtil.java
index 18aae338..89333012 100644
--- a/imageio/imageio-psd/src/main/java/com/twelvemonkeys/imageio/plugins/psd/PSDUtil.java
+++ b/imageio/imageio-psd/src/main/java/com/twelvemonkeys/imageio/plugins/psd/PSDUtil.java
@@ -142,7 +142,8 @@ final class PSDUtil {
 
         @Override
         public InputStream nextElement() {
-            return new SubStream(new DecoderStream(createStreamAdapter(stream, byteCounts[index++]), new PackBitsDecoder(), rowLength), rowLength);
+            // Add 128 bytes extra buffer as worst case if the encoder (GIMP) added garbage bytes at the end
+            return new SubStream(new DecoderStream(createStreamAdapter(stream, byteCounts[index++]), new PackBitsDecoder(), rowLength + 128), rowLength);
         }
     }
 }
diff --git a/imageio/imageio-psd/src/test/java/com/twelvemonkeys/imageio/plugins/psd/PSDImageReaderTest.java b/imageio/imageio-psd/src/test/java/com/twelvemonkeys/imageio/plugins/psd/PSDImageReaderTest.java
index 9f6ecbb3..185f47e1 100755
--- a/imageio/imageio-psd/src/test/java/com/twelvemonkeys/imageio/plugins/psd/PSDImageReaderTest.java
+++ b/imageio/imageio-psd/src/test/java/com/twelvemonkeys/imageio/plugins/psd/PSDImageReaderTest.java
@@ -109,7 +109,9 @@ public class PSDImageReaderTest extends ImageReaderAbstractTest<PSDImageReader>
                 // CMYK, uncompressed + contains some uncommon MeSa (instead of 8BIM) resource blocks
                 new TestData(getClassLoaderResource("/psd/fruit-cmyk-MeSa-resource.psd"), new Dimension(400, 191)),
                 // 3 channel, RGB, 32 bit samples
-                new TestData(getClassLoaderResource("/psd/32bit5x5.psd"), new Dimension(5, 5))
+                new TestData(getClassLoaderResource("/psd/32bit5x5.psd"), new Dimension(5, 5)),
+                // 3 channel, RGB, written by GIMP, compressed with PackBits runs longer than the row length
+                new TestData(getClassLoaderResource("/psd/gimp-32x32-packbits-overflow.psd"), new Dimension(32, 32))
                 // TODO: Need more recent ZIP compressed PSD files from CS2/CS3+
         );
     }
diff --git a/imageio/imageio-psd/src/test/resources/psd/gimp-32x32-packbits-overflow.psd b/imageio/imageio-psd/src/test/resources/psd/gimp-32x32-packbits-overflow.psd
new file mode 100644
index 0000000000000000000000000000000000000000..81458ca93bbe121e4586119ba3eb0c1d2f2e7641
GIT binary patch
literal 4546
zcmeHJO=w(I6#g=awqsj6Xci@eGDs8^3!)-j%0z4n20{{{RWoLOl4)RO65h-x6zNLP
zWujQM8)Jeg6gT4Eq6$V@7eY$0+A7wTDwS#*+v&_S&P?8Xe)qm<Q)1Iim%e+s@1A$g
z`OdlLhxhK*NN+z{;Eh&oVY}AC&>DdgTO&JqS{Lj~2rqX&gn(vqH?lS>5)bxmqeV>#
zIh9Uia&3<SnQY$a+ZGA$-1U5T&3W7@+d(}ajwN#AJ^jxNcm{6vyn4br+wm>N*3C3-
z!P}4=&Lx1BuymeEj5~SJL!zI2B|mQHcSW}+cE^&UKN9_jqXUZm$?)SIebLY<ODjOp
z&Ol$cVrv&2PTfGqZ=e&qos4vzkWN=Jla>9zPLEC+`c*?`(gmH(4wL=$!`bKhwRdTC
zVjFg#2feCA90iObjXbt!&x(^npX8BM@EsQ4D^y&lQ6z+T8e_;HX7MmJkdDT3ZgV4#
zKW14i>m$G&r^(X&z?!!JcY>^cK)TaF>nY&t>@t3AN)@k&Ke5c~dLP*M8u0nyWnTOp
z;EUIRO+SyvoS5}vdMhw80$e!&Y}f_ddknbi1ut)s898Q70t3p`v-7}v`+)~ivi;&J
zajzBNdfslS)6AdZJE%2#z4wjFuwB-BV8}@HRM`VVrn9qSPKHJcs!VgN+di7j4?8KR
zkWCt$bRjz`QK!~AY_}QDV;BxnS_Rcl^|yM7v?CpJYHzg2&&qi>+OY|n(II;sxDOAi
zJ2q>E#cjtunjyP~3~~-D=dWOpgWRJPyo9snEy`(r&(l20y$lv{&hTF1A)aHIOLSS|
z4~!O3@^mNb)12X9USOS#I@#bQPFiV{UkOumORNajs8IWK5fy`*<=@hG>y4@qu0fTX
zvO)R%hi<9CMJ}-BHdty(_Hdq;-Kwk@i;KL<zufOwmPVN~*6tub;Tis+(|^WqcuM#y
z(k<#lRcX}}L$KuekGgLw&J4fgc~-gPx+XGvj<bxGZ~;tTlPThcSyp<PlUCZz2_E5Z
z*2AJKyNbNVPZ_KjY#X~}`wi|_CJ!mnB}Mrs-!wU{;tUw#0iDWZ%a#8lCeL-K5+NRB
z#biYB9c8qRUm(mJYvQ@Q$bFV$sxfbEmN{F;Nhp%vtu^J>z6ZHaaW`lzEpW1qAC2u<
z)o4)}`PNuIZa91SF+Y?wc{hEbUS8Q<0r>sp_m|&a{`c#D@%_5p@89j>SN@&n%wNI(
eKl}gZ|J>WWPVu|Lzr9_%z4_k`|8Bqf-Tq&x8j&Ud

literal 0
HcmV?d00001