FULL PRODUCT VERSION :
java version "1.4.2_10"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.4.2_10-b03)
Java HotSpot(TM) Client VM (build 1.4.2_10-b03, mixed mode)

JRE build 1.5.0_04-b05

A DESCRIPTION OF THE PROBLEM :
When attempting to read a valid JPEG file with Adobe-specific JPEG application markers, an Image Format Error can result.

This is caused by com.sun.imageio.plugins.jpeg.AdobeMarkerSegment assuming a 14-byte marker. We have encoutered 33-byte markers generated by some adobe applications. When a JPEG with such a marker is read by com.sun.imageio.plugins.jpeg.JPEGImageReader.getImageMetadata, AdobeMarkerSegment advances the JPEGBuffer's pointer by only 14 bytes while reducing its "available bytes" count by the correct 35 bytes. This leaves the buffer in an inconsistent state, effectively removing 21 bytes

This error is easily missed as the code is somewhat tolerant of premature end-of-buffer. However, if the 21st-to-last byte in the file (now the perceived end of the buffer) is 0xFF, com.sun.imageio.plugins.jpeg.JPEGMetadata attempts to fetch another byte and throws the exception mentioned.

An example of the 35-byte marker:

FF EE 00 21 41 64 6F 62
65 00 64 c0 00 00 00 01
03 00 10 03 02 03 06 00
00 02 BB 00 00 03 FC 00
00 08 5C

The code in question can seen by inspection to be in error - see constructor com.sun.imageio.plugins.jpeg.AdobeMarkerSegment(JPEGBuffer buffer) - buffer.bufPtr is incremented by a total of 14 bytes and buffer.bufAvail is decremented by whatever length is specified in the marker, so unless this length is 14, it will cause problems.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Create JPEG file with the marker data mentioned and with FF 00 in the data stream, with the "FF" being 21 bytes from the end of the file. Attempt to read this file using ImageIO.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Expected: no output.
JPEG is read successfully

ACTUAL -
javax.imageio.IIOException thrown


ERROR MESSAGES/STACK TRACES THAT OCCUR :
Error: One factory fails for the operation "ImageRead"
Occurs in: javax.media.jai.ThreadSafeOperationRegistry
java.lang.reflect.InvocationTargetException
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.lang.reflect.Method.invoke(Unknown Source)
        at javax.media.jai.FactoryCache.invoke(FactoryCache.java:130)
        at javax.media.jai.OperationRegistry.invokeFactory(OperationRegistry.java:1682)
        at javax.media.jai.ThreadSafeOperationRegistry.invokeFactory(ThreadSafeOperationRegistry.java:481)
        at javax.media.jai.registry.RIFRegistry.create(RIFRegistry.java:340)
        at javax.media.jai.RenderedOp.createInstance(RenderedOp.java:830)
        at javax.media.jai.RenderedOp.createRendering(RenderedOp.java:878)
        at javax.media.jai.RenderedOp.getRendering(RenderedOp.java:899)
        at com.mobileaware.[- deleted -]
Caused by: java.lang.RuntimeException: javax.imageio.IIOException: Image Format Error
        at com.sun.media.jai.imageioimpl.ImageReadCRIF.create(ImageReadCRIF.java:267)
        ... 21 more
Caused by: javax.imageio.IIOException: Image Format Error
        at com.sun.imageio.plugins.jpeg.JPEGBuffer.loadBuf(Unknown Source)
        at com.sun.imageio.plugins.jpeg.JPEGMetadata.<init>(Unknown Source)
        at com.sun.imageio.plugins.jpeg.JPEGImageReader.getImageMetadata(Unknown Source)
        at com.sun.imageio.plugins.jpeg.JPEGImageReader.getNumThumbnails(Unknown Source)
        at javax.imageio.ImageReader.hasThumbnails(Unknown Source)
        at com.sun.media.jai.imageioimpl.ImageReadOpImage.<init>(ImageReadOpImage.java:505)
        at com.sun.media.jai.imageioimpl.ImageReadCRIF.create(ImageReadCRIF.java:259)
        ... 21 more
Exception in thread "main" javax.media.jai.util.ImagingException: All factories fail for the operation "ImageRead"
        at javax.media.jai.OperationRegistry.invokeFactory(OperationRegistry.java:1695)
        at javax.media.jai.ThreadSafeOperationRegistry.invokeFactory(ThreadSafeOperationRegistry.java:481)
        at javax.media.jai.registry.RIFRegistry.create(RIFRegistry.java:340)
        at javax.media.jai.RenderedOp.createInstance(RenderedOp.java:830)
        at javax.media.jai.RenderedOp.createRendering(RenderedOp.java:878)
        at javax.media.jai.RenderedOp.getRendering(RenderedOp.java:899)
        at com.mobileaware.[- deleted -]
Caused by: java.lang.reflect.InvocationTargetException
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.lang.reflect.Method.invoke(Unknown Source)
        at javax.media.jai.FactoryCache.invoke(FactoryCache.java:130)
        at javax.media.jai.OperationRegistry.invokeFactory(OperationRegistry.java:1682)
        ... 15 more
Caused by: java.lang.RuntimeException: javax.imageio.IIOException: Image Format Error
        at com.sun.media.jai.imageioimpl.ImageReadCRIF.create(ImageReadCRIF.java:267)
        ... 21 more
Caused by: javax.imageio.IIOException: Image Format Error
        at com.sun.imageio.plugins.jpeg.JPEGBuffer.loadBuf(Unknown Source)
        at com.sun.imageio.plugins.jpeg.JPEGMetadata.<init>(Unknown Source)
        at com.sun.imageio.plugins.jpeg.JPEGImageReader.getImageMetadata(Unknown Source)
        at com.sun.imageio.plugins.jpeg.JPEGImageReader.getNumThumbnails(Unknown Source)
        at javax.imageio.ImageReader.hasThumbnails(Unknown Source)
        at com.sun.media.jai.imageioimpl.ImageReadOpImage.<init>(ImageReadOpImage.java:505)
        at com.sun.media.jai.imageioimpl.ImageReadCRIF.create(ImageReadCRIF.java:259)
        ... 21 more
Caused by:
java.lang.reflect.InvocationTargetException
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.lang.reflect.Method.invoke(Unknown Source)
        at javax.media.jai.FactoryCache.invoke(FactoryCache.java:130)
        at javax.media.jai.OperationRegistry.invokeFactory(OperationRegistry.java:1682)
        at javax.media.jai.ThreadSafeOperationRegistry.invokeFactory(ThreadSafeOperationRegistry.java:481)
        at javax.media.jai.registry.RIFRegistry.create(RIFRegistry.java:340)
        at javax.media.jai.RenderedOp.createInstance(RenderedOp.java:830)
        at javax.media.jai.RenderedOp.createRendering(RenderedOp.java:878)
        at javax.media.jai.RenderedOp.getRendering(RenderedOp.java:899)
        at com.mobileaware.[- deleted -]
Caused by: java.lang.RuntimeException: javax.imageio.IIOException: Image Format Error
        at com.sun.media.jai.imageioimpl.ImageReadCRIF.create(ImageReadCRIF.java:267)
        ... 21 more
Caused by: javax.imageio.IIOException: Image Format Error
        at com.sun.imageio.plugins.jpeg.JPEGBuffer.loadBuf(Unknown Source)
        at com.sun.imageio.plugins.jpeg.JPEGMetadata.<init>(Unknown Source)
        at com.sun.imageio.plugins.jpeg.JPEGImageReader.getImageMetadata(Unknown Source)
        at com.sun.imageio.plugins.jpeg.JPEGImageReader.getNumThumbnails(Unknown Source)
        at javax.imageio.ImageReader.hasThumbnails(Unknown Source)
        at com.sun.media.jai.imageioimpl.ImageReadOpImage.<init>(ImageReadOpImage.java:505)
        at com.sun.media.jai.imageioimpl.ImageReadCRIF.create(ImageReadCRIF.java:259)
        ... 21 more

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
import javax.imageio.*;
import javax.imageio.stream.FileImageInputStream;

public class ImageIOJpegBug {
public static void main(String[] args) throws Exception {
FileImageInputStream input = new FileImageInputStream(new java.io.File("example.jpeg"));
ImageReader reader = (ImageReader) ImageIO.getImageReaders(input).next();
reader.setInput(input);
reader.getImageMetadata(reader.getMinIndex());
}
}

---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
Modify the JPEG file so that the marker is not recognised as an Adobe application marker.

Alternatively, add a byte to the end of the file.