JDK-8182461 : IndexOutOfBoundsException when reading indexed color BMP
  • Type: Bug
  • Component: client-libs
  • Sub-Component: javax.imageio
  • Affected Version: 8
  • Priority: P4
  • Status: Resolved
  • Resolution: Fixed
  • OS: generic
  • CPU: x86_64
  • Submitted: 2017-06-08
  • Updated: 2019-03-19
  • Resolved: 2018-08-13
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 8
8u202 b01Fixed
Related Reports
Relates :  
Relates :  
Description
FULL PRODUCT VERSION :
java version "1.8.0_131"
Java(TM) SE Runtime Environment (build 1.8.0_131-b11)
Java HotSpot(TM) 64-Bit Server VM (build 25.131-b11, mixed mode)

ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows [version 6.1.7601]

A DESCRIPTION OF THE PROBLEM :
When loading a BMP image using indexed color model (palette), an  java.lang.IndexOutOfBoundsException occurs.


STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Create a 8BPP indexed color BMP (I have used GIMP for windows)
Try to load it using ImageIO.read method.


EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
a BufferedImage with the BMP content
ACTUAL -
A nice java.lang.IndexOutOfBoundsException: off < 0 || len < 0 || off + len > b.length!

ERROR MESSAGES/STACK TRACES THAT OCCUR :
Exception in thread "main" java.lang.IndexOutOfBoundsException: off < 0 || len < 0 || off + len > b.length!
	at javax.imageio.stream.ImageInputStreamImpl.readFully(ImageInputStreamImpl.java:346)
	at com.sun.imageio.plugins.bmp.BMPImageReader.read8Bit(BMPImageReader.java:1160)
	at com.sun.imageio.plugins.bmp.BMPImageReader.read(BMPImageReader.java:923)
	at javax.imageio.ImageIO.read(ImageIO.java:1448)
...

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
ImageInputStream is = new FileImageInputStream(new File("indexed.bmp"));
BufferedImage img = ImageIO.read(is);

---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
None.
The bug is in BMPImageReader.read(int imageIndex, ImageReadParam param) method, at line 918.
A "break" is missing in the switch case VERSION_4_4_BIT, the reader also execute the next case (VERSION_4_8_BIT) that cause the IndexOutOfBoundsException.
I have tested with a copy of this class, by adding a break at line 918 and it fixes the problem.


Comments
Reproduced the issue in 8u131_b52, issue is not reproducible in latest 9 because the issue is fixed as part of JDK-8033716.
22-06-2017

Checked this for JDK 8u131 and 9 ea b174 and could confirm the issue. Result: ============ 7u80: FAIL 8: FAIL 8u131: FAIL 8u152 ea b03: FAIL 9 ea b174: PASS To verify, run the attached test case with respective JDK versions. Output with JDK 8u131: ====================== >java TestCase Exception in thread "main" java.lang.IndexOutOfBoundsException: off < 0 || len < 0 || off + len > b.length! Output with JDK 9 ea b174: ========================== >java TestCase size (640,480), type : 12 From the description: "The bug is in BMPImageReader.read(int imageIndex, ImageReadParam param) method, at line 918. A "break" is missing in the switch case VERSION_4_4_BIT, the reader also execute the next case (VERSION_4_8_BIT) that cause the IndexOutOfBoundsException. I have tested with a copy of this class, by adding a break at line 918 and it fixes the problem". The issue seems to have fixed for JDK 9, but exists in 8u. https://bugs.openjdk.java.net/browse/JDK-8033716 However, it still exists in 8u. Reference link in 8u-dev: https://java.se.oracle.com/source/xref/jdk8u-dev/jdk/src/share/classes/com/sun/imageio/plugins/bmp/BMPImageReader.java#918 Fix in 9 b06 (JDK-8033716): https://java.se.oracle.com/source/xref/jdk9-dev/jdk/src/java.desktop/share/classes/com/sun/imageio/plugins/bmp/BMPImageReader.java#935
19-06-2017