JDK-4836529 : Reading corrupted JPEG cause VM crash
  • Type: Bug
  • Component: client-libs
  • Sub-Component: 2d
  • Affected Version: 1.0,1.4.2_04
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • OS: generic,solaris_9
  • CPU: generic,sparc
  • Submitted: 2003-03-24
  • Updated: 2003-04-21
  • Resolved: 2003-04-21
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
Other
5.0 tigerFixed
Related Reports
Duplicate :  
JDK-5030624 - Corrupt JPEG causes JVM crash
Relates :  
JDK-4845461 - ImageIO fails to read a corrupted JPEG image
Relates :  
JDK-6409831 - Virus alerts on JPEGVmCrashTest.jpg and APP0_erased.jpg
Relates :  
JDK-4980124 - Native JVM crash in JPEG API when processing corrupt image files
Description

Name: abR10136			Date: 03/24/2003



 This testcase can be used to reproduce problem:

================ BEGIN OF TESTCASE ======================
import javax.media.jai.JAI;
import javax.media.jai.RenderedOp;

public class FileTest {

	public static void main(String args[]) {

	// Read the image from the designated path.
	RenderedOp img =  JAI.create("fileload", args[0]);
	System.out.println("width = "+img.getWidth());

	}
}
================  END OF TESTCASE  ======================

 The testcase image are attached.

 The daeth log:
=============== BEGIN OF CRASH DUMP =====================

I:\java2d\bae\bugs\jpeg_vm_crash>k:\JDK1.4.2b03\windows-i586\bin\java FileTest c
rash.jpg

Unexpected Signal : EXCEPTION_ACCESS_VIOLATION occurred at PC=0x6D4A523B
Function=jni_ReleaseStringUTFChars+0x6C8
Library=k:\JDK1.4.2b03\windows-i586\jre\bin\client\jvm.dll
Source file = D:/BUILD_AREA/jdk1.4.2/hotspot\src\share\vm\prims\jni.cpp : 1519


Current Java thread:
        at sun.awt.image.codec.JPEGImageDecoderImpl.readJPEGStream(Native Method
)
        - locked <0x02baf828> (a sun.awt.image.codec.JPEGImageDecoderImpl)
        at sun.awt.image.codec.JPEGImageDecoderImpl.decodeAsBufferedImage(JPEGIm
ageDecoderImpl.java:210)
        - locked <0x02baf828> (a sun.awt.image.codec.JPEGImageDecoderImpl)
        at com.sun.media.jai.codecimpl.JPEGImage.<init>(JPEGImageDecoder.java:11
4)
        - locked <0x02baf248> (a java.lang.Object)
        at com.sun.media.jai.codecimpl.JPEGImageDecoder.decodeAsRenderedImage(JP
EGImageDecoder.java:53)
        at com.sun.media.jai.opimage.CodecRIFUtil.create(CodecRIFUtil.java:96)
        at com.sun.media.jai.opimage.JPEGRIF.create(JPEGRIF.java:52)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.
java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces
sorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:324)
        at javax.media.jai.FactoryCache.invoke(FactoryCache.java:130)
        at javax.media.jai.OperationRegistry.invokeFactory(OperationRegistry.jav
a:1682)
        at javax.media.jai.ThreadSafeOperationRegistry.invokeFactory(ThreadSafeO
perationRegistry.java:481)
        at javax.media.jai.registry.RIFRegistry.create(RIFRegistry.java:340)
        at com.sun.media.jai.opimage.StreamRIF.create(StreamRIF.java:110)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.
java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces
sorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:324)
        at javax.media.jai.FactoryCache.invoke(FactoryCache.java:130)
        at javax.media.jai.OperationRegistry.invokeFactory(OperationRegistry.jav
a:1682)
        at javax.media.jai.ThreadSafeOperationRegistry.invokeFactory(ThreadSafeO
perationRegistry.java:481)
        at javax.media.jai.registry.RIFRegistry.create(RIFRegistry.java:340)
        at com.sun.media.jai.opimage.FileLoadRIF.create(FileLoadRIF.java:122)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.
java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces
sorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:324)
        at javax.media.jai.FactoryCache.invoke(FactoryCache.java:130)
        at javax.media.jai.OperationRegistry.invokeFactory(OperationRegistry.jav
a:1682)
        at javax.media.jai.ThreadSafeOperationRegistry.invokeFactory(ThreadSafeO
perationRegistry.java:481)
        at javax.media.jai.registry.RIFRegistry.create(RIFRegistry.java:340)
        at javax.media.jai.RenderedOp.createInstance(RenderedOp.java:830)
        - locked <0x02c310a8> (a javax.media.jai.RenderedOp)
        at javax.media.jai.RenderedOp.createRendering(RenderedOp.java:878)
        - locked <0x02c310a8> (a javax.media.jai.RenderedOp)
        at javax.media.jai.RenderedOp.getWidth(RenderedOp.java:2190)
        at FileTest.main(FileTest.java:10)

Dynamic libraries:
0x00400000 - 0x00406000         k:\JDK1.4.2b03\windows-i586\bin\java.exe
0x77F80000 - 0x77FFB000         C:\WINNT\System32\ntdll.dll
0x77DB0000 - 0x77E0B000         C:\WINNT\system32\ADVAPI32.dll
0x77E80000 - 0x77F31000         C:\WINNT\system32\KERNEL32.dll
0x77D30000 - 0x77DA1000         C:\WINNT\system32\RPCRT4.dll
0x78000000 - 0x78046000         C:\WINNT\system32\MSVCRT.dll
0x6D430000 - 0x6D556000         k:\JDK1.4.2b03\windows-i586\jre\bin\client\jvm.d
ll
0x77E10000 - 0x77E6F000         C:\WINNT\system32\USER32.dll
0x77F40000 - 0x77F79000         C:\WINNT\system32\GDI32.dll
0x77570000 - 0x775A0000         C:\WINNT\System32\WINMM.dll
0x75E60000 - 0x75E7A000         C:\WINNT\System32\IMM32.DLL
0x6D1D0000 - 0x6D1D7000         k:\JDK1.4.2b03\windows-i586\jre\bin\hpi.dll
0x6D400000 - 0x6D40D000         k:\JDK1.4.2b03\windows-i586\jre\bin\verify.dll
0x6D210000 - 0x6D229000         k:\JDK1.4.2b03\windows-i586\jre\bin\java.dll
0x6D420000 - 0x6D42D000         k:\JDK1.4.2b03\windows-i586\jre\bin\zip.dll
0x6D000000 - 0x6D0FC000         K:\JDK1.4.2b03\windows-i586\jre\bin\awt.dll
0x77800000 - 0x7781E000         C:\WINNT\System32\WINSPOOL.DRV
0x76620000 - 0x76630000         C:\WINNT\system32\MPR.dll
0x77A50000 - 0x77B45000         C:\WINNT\system32\ole32.dll
0x6D100000 - 0x6D123000         K:\JDK1.4.2b03\windows-i586\jre\bin\cmm.dll
0x6D280000 - 0x6D29E000         K:\JDK1.4.2b03\windows-i586\jre\bin\jpeg.dll
0x77920000 - 0x77943000         C:\WINNT\system32\imagehlp.dll
0x72A00000 - 0x72A2D000         C:\WINNT\system32\DBGHELP.dll
0x690A0000 - 0x690AB000         C:\WINNT\System32\PSAPI.DLL

Local Time = Fri Mar 21 21:46:45 2003
Elapsed Time = 14
#
# HotSpot Virtual Machine Error : EXCEPTION_ACCESS_VIOLATION
# Error ID : 4A4E490E43505005EF
# Please report this error at
# http://java.sun.com/cgi-bin/bugreport.cgi
#
# Java VM: Java HotSpot(TM) Client VM (1.4.2-beta-b03 mixed mode)
#
# An error report file has been saved as hs_err_pid6920.log.
# Please refer to the file for further information.
#
===============  END OF CRASH DUMP  =====================


======================================================================
Comments
CONVERTED DATA BugTraq+ Release Management Values COMMIT TO FIX: tiger FIXED IN: tiger INTEGRATED IN: tiger tiger-b05
21-08-2004
EVALUATION Commit to tiger. ###@###.### 2003-03-24 Name: abR10136 Date: 03/25/2003 We attempt to allocate negative-length array and access its first element. This happens when we try to read data following M_APP0 marker. In some cases it can be followed by several zero bytes (I am not sure how legal this is from point of view of JPEG format but this is the case of test image and this is supported by many other jpeg decoders). At the moment sun.awt.image.codec.JPEGImageDecoderImpl coder uses (common for all markers) marker handler kodak_jpeg_read_tag() that rely on assumption that marker is followed by data. It treats value of two zero bytes after M_APP0 market as data length, decrease it by 2 and try to allocate byte array with length -2. The next step is attempt to access first element of allocated array. We can observe crash here because data array was not allocated correctly. The idea of the fix is to skip this zero bytes and handle data only if the data length is positive. ======================================================================
21-08-2004
WORK AROUND Name: abR10136 Date: 03/24/2003 Use Image IO or Toolkit API to load this image. ======================================================================
21-08-2004