JDK-8211795 : ArrayIndexOutOfBoundsException in PNGImageReader after JDK-6788458
  • Type: Bug
  • Component: client-libs
  • Sub-Component: javax.imageio
  • Affected Version: 11,12
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2018-10-05
  • Updated: 2022-07-08
  • Resolved: 2018-11-20
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 11 JDK 12
11.0.16Fixed 12 b23Fixed
Related Reports
Relates :  
Description
The fix for JDK-6788458 causes PNGImageReader to throw an ArrayIndexOutOfBoundsException reading some pngs that it previously accepted.

===
import javax.imageio.ImageIO;
import java.awt.image.BufferedImage;
import java.io.File;
import java.io.IOException;

public class Image {
  public static void main(String[] args) throws IOException {
    BufferedImage image = ImageIO.read(new File(args[0]));
    ImageIO.write(image, "PNG", new File(args[1]));
  }
}
===

$ javac image.java
$ java Image add_white.png output.png
...
Exception in thread "main" javax.imageio.IIOException: Caught exception during read: 
	at java.desktop/com.sun.imageio.plugins.png.PNGImageReader.read(PNGImageReader.java:1817)
	at java.desktop/javax.imageio.ImageIO.read(ImageIO.java:1468)
	at java.desktop/javax.imageio.ImageIO.read(ImageIO.java:1315)
	at Image.main(Image.java:8)
Caused by: java.lang.ArrayIndexOutOfBoundsException: 1
	at java.desktop/com.sun.imageio.plugins.png.PNGImageReader.decodePass(PNGImageReader.java:1308)
	at java.desktop/com.sun.imageio.plugins.png.PNGImageReader.decodeImage(PNGImageReader.java:1360)
	at java.desktop/com.sun.imageio.plugins.png.PNGImageReader.readImage(PNGImageReader.java:1493)
	at java.desktop/com.sun.imageio.plugins.png.PNGImageReader.read(PNGImageReader.java:1810)
	... 3 more

Comments
Fix Request (11u): On behalf of KostyaSha. Applies cleanly. Included test has passed. "The initial issue was found in jdk 11 and 12, but was fixed only in 12. I backported patch locally, built jdk and verified that our tool works fine. Btw zulu11 has no such issue, probably they backported this patch already."
28-04-2022

A pull request was submitted for review. URL: https://git.openjdk.java.net/jdk11u-dev/pull/1032 Date: 2022-04-12 12:16:14 +0000
27-04-2022

URL: http://hg.openjdk.java.net/jdk/jdk/rev/6bdbd601d31c User: psadhukhan Date: 2018-11-29 09:03:46 +0000
29-11-2018

URL: http://hg.openjdk.java.net/jdk/client/rev/6bdbd601d31c User: jdv Date: 2018-11-20 09:07:45 +0000
20-11-2018

More analysis after review: We are getting AIOOB because we are trying to access more band data from input image (ps[]) and not because of scale array. Because scale array is actually of bigger size and it will not throw AIOOB. Basically numBands calculation should be updated to contain one less band whenever we have tRNS chunk for RGB & Gray data. Then it will match the input data bands and bitDepth adjusting also will happen properly.
14-11-2018

Bitdepth of input gray image with tRNS chunk is 1 and output bit depth is 8. So in PNGImageReader.decodePass() we create per sample scale array to scale the samples. Since we have tRNS chunk we increase number of samples by 1 for output image. So that we can represent gray image with tRNS chunk as gray alpha image, which was done in JDK-6788458. But we should not create 2/4 sample scale array for gray/rgb input image. Because we have only 1/3 sample input data.
11-10-2018