Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-6355567

AdobeMarkerSegment causes failure to read valid JPEG

    XMLWordPrintable

Details

    • b07
    • x86
    • windows_xp

    Description

      FULL PRODUCT VERSION :
      java version "1.4.2_10"
      Java(TM) 2 Runtime Environment, Standard Edition (build 1.4.2_10-b03)
      Java HotSpot(TM) Client VM (build 1.4.2_10-b03, mixed mode)

      JRE build 1.5.0_04-b05

      A DESCRIPTION OF THE PROBLEM :
      When attempting to read a valid JPEG file with Adobe-specific JPEG application markers, an Image Format Error can result.

      This is caused by com.sun.imageio.plugins.jpeg.AdobeMarkerSegment assuming a 14-byte marker. We have encoutered 33-byte markers generated by some adobe applications. When a JPEG with such a marker is read by com.sun.imageio.plugins.jpeg.JPEGImageReader.getImageMetadata, AdobeMarkerSegment advances the JPEGBuffer's pointer by only 14 bytes while reducing its "available bytes" count by the correct 35 bytes. This leaves the buffer in an inconsistent state, effectively removing 21 bytes

      This error is easily missed as the code is somewhat tolerant of premature end-of-buffer. However, if the 21st-to-last byte in the file (now the perceived end of the buffer) is 0xFF, com.sun.imageio.plugins.jpeg.JPEGMetadata attempts to fetch another byte and throws the exception mentioned.

      An example of the 35-byte marker:

      FF EE 00 21 41 64 6F 62
      65 00 64 c0 00 00 00 01
      03 00 10 03 02 03 06 00
      00 02 BB 00 00 03 FC 00
      00 08 5C

      The code in question can seen by inspection to be in error - see constructor com.sun.imageio.plugins.jpeg.AdobeMarkerSegment(JPEGBuffer buffer) - buffer.bufPtr is incremented by a total of 14 bytes and buffer.bufAvail is decremented by whatever length is specified in the marker, so unless this length is 14, it will cause problems.

      STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
      Create JPEG file with the marker data mentioned and with FF 00 in the data stream, with the "FF" being 21 bytes from the end of the file. Attempt to read this file using ImageIO.

      EXPECTED VERSUS ACTUAL BEHAVIOR :
      EXPECTED -
      Expected: no output.
      JPEG is read successfully

      ACTUAL -
      javax.imageio.IIOException thrown


      ERROR MESSAGES/STACK TRACES THAT OCCUR :
      Error: One factory fails for the operation "ImageRead"
      Occurs in: javax.media.jai.ThreadSafeOperationRegistry
      java.lang.reflect.InvocationTargetException
              at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
              at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
              at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
              at java.lang.reflect.Method.invoke(Unknown Source)
              at javax.media.jai.FactoryCache.invoke(FactoryCache.java:130)
              at javax.media.jai.OperationRegistry.invokeFactory(OperationRegistry.java:1682)
              at javax.media.jai.ThreadSafeOperationRegistry.invokeFactory(ThreadSafeOperationRegistry.java:481)
              at javax.media.jai.registry.RIFRegistry.create(RIFRegistry.java:340)
              at javax.media.jai.RenderedOp.createInstance(RenderedOp.java:830)
              at javax.media.jai.RenderedOp.createRendering(RenderedOp.java:878)
              at javax.media.jai.RenderedOp.getRendering(RenderedOp.java:899)
              at com.mobileaware.[- deleted -]
      Caused by: java.lang.RuntimeException: javax.imageio.IIOException: Image Format Error
              at com.sun.media.jai.imageioimpl.ImageReadCRIF.create(ImageReadCRIF.java:267)
              ... 21 more
      Caused by: javax.imageio.IIOException: Image Format Error
              at com.sun.imageio.plugins.jpeg.JPEGBuffer.loadBuf(Unknown Source)
              at com.sun.imageio.plugins.jpeg.JPEGMetadata.<init>(Unknown Source)
              at com.sun.imageio.plugins.jpeg.JPEGImageReader.getImageMetadata(Unknown Source)
              at com.sun.imageio.plugins.jpeg.JPEGImageReader.getNumThumbnails(Unknown Source)
              at javax.imageio.ImageReader.hasThumbnails(Unknown Source)
              at com.sun.media.jai.imageioimpl.ImageReadOpImage.<init>(ImageReadOpImage.java:505)
              at com.sun.media.jai.imageioimpl.ImageReadCRIF.create(ImageReadCRIF.java:259)
              ... 21 more
      Exception in thread "main" javax.media.jai.util.ImagingException: All factories fail for the operation "ImageRead"
              at javax.media.jai.OperationRegistry.invokeFactory(OperationRegistry.java:1695)
              at javax.media.jai.ThreadSafeOperationRegistry.invokeFactory(ThreadSafeOperationRegistry.java:481)
              at javax.media.jai.registry.RIFRegistry.create(RIFRegistry.java:340)
              at javax.media.jai.RenderedOp.createInstance(RenderedOp.java:830)
              at javax.media.jai.RenderedOp.createRendering(RenderedOp.java:878)
              at javax.media.jai.RenderedOp.getRendering(RenderedOp.java:899)
              at com.mobileaware.[- deleted -]
      Caused by: java.lang.reflect.InvocationTargetException
              at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
              at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
              at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
              at java.lang.reflect.Method.invoke(Unknown Source)
              at javax.media.jai.FactoryCache.invoke(FactoryCache.java:130)
              at javax.media.jai.OperationRegistry.invokeFactory(OperationRegistry.java:1682)
              ... 15 more
      Caused by: java.lang.RuntimeException: javax.imageio.IIOException: Image Format Error
              at com.sun.media.jai.imageioimpl.ImageReadCRIF.create(ImageReadCRIF.java:267)
              ... 21 more
      Caused by: javax.imageio.IIOException: Image Format Error
              at com.sun.imageio.plugins.jpeg.JPEGBuffer.loadBuf(Unknown Source)
              at com.sun.imageio.plugins.jpeg.JPEGMetadata.<init>(Unknown Source)
              at com.sun.imageio.plugins.jpeg.JPEGImageReader.getImageMetadata(Unknown Source)
              at com.sun.imageio.plugins.jpeg.JPEGImageReader.getNumThumbnails(Unknown Source)
              at javax.imageio.ImageReader.hasThumbnails(Unknown Source)
              at com.sun.media.jai.imageioimpl.ImageReadOpImage.<init>(ImageReadOpImage.java:505)
              at com.sun.media.jai.imageioimpl.ImageReadCRIF.create(ImageReadCRIF.java:259)
              ... 21 more
      Caused by:
      java.lang.reflect.InvocationTargetException
              at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
              at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
              at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
              at java.lang.reflect.Method.invoke(Unknown Source)
              at javax.media.jai.FactoryCache.invoke(FactoryCache.java:130)
              at javax.media.jai.OperationRegistry.invokeFactory(OperationRegistry.java:1682)
              at javax.media.jai.ThreadSafeOperationRegistry.invokeFactory(ThreadSafeOperationRegistry.java:481)
              at javax.media.jai.registry.RIFRegistry.create(RIFRegistry.java:340)
              at javax.media.jai.RenderedOp.createInstance(RenderedOp.java:830)
              at javax.media.jai.RenderedOp.createRendering(RenderedOp.java:878)
              at javax.media.jai.RenderedOp.getRendering(RenderedOp.java:899)
              at com.mobileaware.[- deleted -]
      Caused by: java.lang.RuntimeException: javax.imageio.IIOException: Image Format Error
              at com.sun.media.jai.imageioimpl.ImageReadCRIF.create(ImageReadCRIF.java:267)
              ... 21 more
      Caused by: javax.imageio.IIOException: Image Format Error
              at com.sun.imageio.plugins.jpeg.JPEGBuffer.loadBuf(Unknown Source)
              at com.sun.imageio.plugins.jpeg.JPEGMetadata.<init>(Unknown Source)
              at com.sun.imageio.plugins.jpeg.JPEGImageReader.getImageMetadata(Unknown Source)
              at com.sun.imageio.plugins.jpeg.JPEGImageReader.getNumThumbnails(Unknown Source)
              at javax.imageio.ImageReader.hasThumbnails(Unknown Source)
              at com.sun.media.jai.imageioimpl.ImageReadOpImage.<init>(ImageReadOpImage.java:505)
              at com.sun.media.jai.imageioimpl.ImageReadCRIF.create(ImageReadCRIF.java:259)
              ... 21 more

      REPRODUCIBILITY :
      This bug can be reproduced always.

      ---------- BEGIN SOURCE ----------
      import javax.imageio.*;
      import javax.imageio.stream.FileImageInputStream;

      public class ImageIOJpegBug {
      public static void main(String[] args) throws Exception {
      FileImageInputStream input = new FileImageInputStream(new java.io.File("example.jpeg"));
      ImageReader reader = (ImageReader) ImageIO.getImageReaders(input).next();
      reader.setInput(input);
      reader.getImageMetadata(reader.getMinIndex());
      }
      }

      ---------- END SOURCE ----------

      CUSTOMER SUBMITTED WORKAROUND :
      Modify the JPEG file so that the marker is not recognised as an Adobe application marker.

      Alternatively, add a byte to the end of the file.

      Attachments

        Issue Links

          Activity

            People

              cushon Liam Miller-Cushon
              ndcosta Nelson Dcosta (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:
                Imported:
                Indexed: