JDK-5030624 : Corrupt JPEG causes JVM crash
  • Type: Bug
  • Component: client-libs
  • Sub-Component: 2d
  • Affected Version: 1.4.2_04
  • Priority: P3
  • Status: Closed
  • Resolution: Duplicate
  • OS: solaris_9
  • CPU: sparc
  • Submitted: 2004-04-13
  • Updated: 2006-04-03
  • Resolved: 2006-04-03
Related Reports
Duplicate :  
Description
A JPEG file with some corrupt data causes the JVM to crash. Note that other programs such as xv are able to nevertheless load the image.

A test case and image demonstrating the problem are attached.

Here's the output from running the program:

java J2DImageTest 3026A.jpg

Unexpected Signal : 11 occurred at PC=0xFEDB25EC
Function=[Unknown. Nearest: JVM_IsSameClassPackage+0x705C]
Library=/import/jai/jdks/solaris2-sparc/j2sdk1.4.2_04/jre/lib/sparc/client/libjvm.so

Current Java thread:
        at sun.awt.image.codec.JPEGImageDecoderImpl.readJPEGStream(Native Method)
        - locked <0xf1955858> (a sun.awt.image.codec.JPEGImageDecoderImpl)
        at sun.awt.image.codec.JPEGImageDecoderImpl.decodeAsBufferedImage(JPEGImageDecoderImpl.java:210)
        - locked <0xf1955858> (a sun.awt.image.codec.JPEGImageDecoderImpl)
        at J2DImageTest.<init>(J2DImageTest.java:36)
        at J2DImageTest.main(J2DImageTest.java:60)

Dynamic libraries:
0x10000         java
0xff370000      /usr/lib//libthread.so.1
0xff3a0000      /usr/lib//libdl.so.1
0xff280000      /usr/lib//libc.so.1
0xff270000      /usr/platform/SUNW,Ultra-80/lib/libc_psr.so.1
0xfec00000      /import/jai/jdks/solaris2-sparc/j2sdk1.4.2_04/jre/lib/sparc/client/libjvm.so
0xff220000      /usr/lib//libCrun.so.1
0xff200000      /usr/lib//libsocket.so.1
0xff100000      /usr/lib//libnsl.so.1
0xff0b0000      /usr/lib//libm.so.1
0xff1e0000      /usr/lib//libsched.so.1
0xff250000      /usr/lib//libw.so.1
0xff090000      /usr/lib//libmp.so.2
0xff050000      /import/jai/jdks/solaris2-sparc/j2sdk1.4.2_04/jre/lib/sparc/native_threads/libhpi.so
0xfebd0000      /import/jai/jdks/solaris2-sparc/j2sdk1.4.2_04/jre/lib/sparc/libverify.so
0xfeb90000      /import/jai/jdks/solaris2-sparc/j2sdk1.4.2_04/jre/lib/sparc/libjava.so
0xfeb70000      /import/jai/jdks/solaris2-sparc/j2sdk1.4.2_04/jre/lib/sparc/libzip.so
0xf9a00000      /import/jai/jdks/solaris2-sparc/j2sdk1.4.2_04/jre/lib/sparc/libawt.so
0xfc580000      /import/jai/jdks/solaris2-sparc/j2sdk1.4.2_04/jre/lib/sparc/libmlib_image.so
0xfe810000      /import/jai/jdks/solaris2-sparc/j2sdk1.4.2_04/jre/lib/sparc/motif21/libmawt.so
0xf1580000      /usr/dt/lib/libXm.so.4
0xfe390000      /usr/openwin/lib/libXt.so.4
0xfe2d0000      /usr/openwin/lib/libXext.so.0
0xfe2b0000      /usr/openwin/lib/libXtst.so.1
0xf9900000      /usr/openwin/lib/libX11.so.4
0xfc7a0000      /usr/openwin/lib/libdps.so.5
0xfe1e0000      /usr/openwin/lib/libSM.so.6
0xfe1b0000      /usr/openwin/lib/libICE.so.6
0xf1280000      /import/jai/jdks/solaris2-sparc/j2sdk1.4.2_04/jre/lib/sparc/libfontmanager.so
0xfc6a0000      /usr/lib//liblayout.so
0xfbfb0000      /import/jai/jdks/solaris2-sparc/j2sdk1.4.2_04/jre/lib/sparc/libjpeg.so

Heap at VM Abort:
Heap

 def new generation   total 2112K, used 1431K [0xf1800000, 0xf1a20000, 0xf1f10000)
  eden space 2048K,  69% used [0xf1800000, 0xf1965cb0, 0xf1a00000)
  from space 64K,   0% used [0xf1a00000, 0xf1a00000, 0xf1a10000)
  to   space 64K,   0% used [0xf1a10000, 0xf1a10000, 0xf1a20000)
 tenured generation   total 1408K, used 0K [0xf1f10000, 0xf2070000, 0xf5800000)
   the space 1408K,   0% used [0xf1f10000, 0xf1f10000, 0xf1f10200, 0xf2070000)
 compacting perm gen  total 4096K, used 1873K [0xf5800000, 0xf5c00000, 0xf9800000)
   the space 4096K,  45% used [0xf5800000, 0xf59d4780, 0xf59d4800, 0xf5c00000)

Local Time = Mon Apr 12 18:29:34 2004
Elapsed Time = 1
#
# HotSpot Virtual Machine Error : 11
# Error ID : 4F530E43505002EF 01
# Please report this error at
# http://java.sun.com/cgi-bin/bugreport.cgi
#
# Java VM: Java HotSpot(TM) Client VM (1.4.2_04-b05 mixed mode)
#
# An error report file has been saved as hs_err_pid20100.log.
# Please refer to the file for further information.
#
Abort

Note that 1.5-beta seems to have fixed this problem. It prints out the following and loads the image:

Corrupt JPEG data: 14 extraneous bytes before marker 0xdb

Comments
EVALUATION Image attached to this bug has exactly same peculiarity as test case for the 4836529 - the content of APP0 marker is erased. The issue with crash in JPEG decoder caused by erased APP0 marker was resolved by fix for 4836529 in jdk 5.0 (tiger) build 05.
03-04-2006

EVALUATION Name: osR10079 Date: 04/12/2004 Images decoding is under 2D team responsibilities. Thus reassign the bug to the 2D team. ###@###.### 2004-04-13 ====================================================================== Name: abR10136 Date: 04/13/2004 This problem was fixed in the Tiger as part of fix for 4836529. ======================================================================
30-09-2004