Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-6443043

malformed JPEG causes JVM to crash in sun.awt.color.CMM.cmmGetTransform()

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Cannot Reproduce
    • Icon: P3 P3
    • 5.0u30
    • 6
    • client-libs
    • 2d
    • generic
    • generic

      FULL PRODUCT VERSION :
      java version "1.5.0_06"
      Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_06-b05)
      Java HotSpot(TM) Client VM (build 1.5.0_06-b05, mixed mode)

      FULL OS VERSION :
      WindowsXP
      Linux

      A DESCRIPTION OF THE PROBLEM :
      I have a JPEG file which is opened fine in IE/Opera.

      This line crashes JVM:
      image = ImageIO.read(file.toURL());


      THE PROBLEM WAS REPRODUCIBLE WITH -Xint FLAG: Did not try

      THE PROBLEM WAS REPRODUCIBLE WITH -server FLAG: Yes

      STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
      just load the file using ImageIO.read(file.toURL());


      EXPECTED VERSUS ACTUAL BEHAVIOR :
      image = null is expected if JVM can not read file
      ERROR MESSAGES/STACK TRACES THAT OCCUR :
      #
      # An unexpected error has been detected by HotSpot Virtual Machine:
      #
      # EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x7c910f29, pid=57320, tid=56008
      #
      # Java VM: Java HotSpot(TM) Client VM (1.5.0_01-b08 mixed mode)
      # Problematic frame:
      # C [ntdll.dll+0x10f29]
      #

      --------------- T H R E A D ---------------

      Current thread (0x0accd848): JavaThread "AWT-EventQueue-0" [_thread_in_native, id=56008]

      siginfo: ExceptionCode=0xc0000005, reading address 0x00000000

      Registers:
      EAX=0x0b1ae4d0, EBX=0x0b1a0000, ECX=0x00000000, EDX=0x00000000
      ESP=0x0b15ea78, EBP=0x0b15ea84, ESI=0x0b1ae4c8, EDI=0x0b1adcb0
      EIP=0x7c910f29, EFLAGS=0x00010246

        Top of Stack: (sp=0x0b15ea78)
      0x0b15ea78: 0b1a0000 0b1adcb0 00000000 0b15eb58
      0x0b15ea88: 7c910d5c 0b1a0000 00000000 0b15eb3c
      0x0b15ea98: 00000000 0b15ed54 6d22cb08 0b289f88
      0x0b15eaa8: 00000000 0b1a6b30 00000001 0b15eaf8
      0x0b15eab8: 0b15eaec 0b1a66a0 0b1a66a0 0b1a6ec0
      0x0b15eac8: 0b15ee38 2e312e35 0b150031 0b15eafc
      0x0b15ead8: 6d22515c 0b1a66a0 0b1a6ec0 6d225171
      0x0b15eae8: 0b15eaec 6d220032 0b15eaf4 6d003031

      Instructions: (pc=0x7c910f29)
      0x7c910f19: 85 92 00 00 00 8b 4e 0c 8d 46 08 8b 10 89 4d 0c
      0x7c910f29: 8b 09 3b 4a 04 89 55 14 0f 85 ea 0f 00 00 3b c8


      Stack: [0x0b120000,0x0b160000), sp=0x0b15ea78, free space=250k
      Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
      C [ntdll.dll+0x10f29]
      C [ntdll.dll+0x10d5c]
      C [cmm.dll+0x27859]
      C [cmm.dll+0x25738]
      C [cmm.dll+0x26030]
      C [cmm.dll+0x288a6]
      j sun.awt.color.CMM.cmmGetTransform(Ljava/awt/color/ICC_Profile;IILsun/awt/color/ICC_Transform;)I+0
      j sun.awt.color.ICC_Transform.<init>(Ljava/awt/color/ICC_Profile;II)V+18
      j java.awt.image.ColorConvertOp.filter(Ljava/awt/image/Raster;Ljava/awt/image/WritableRaster;)Ljava/awt/image/WritableRaster;+240
      j com.sun.imageio.plugins.jpeg.JPEGImageReader.acceptPixels(IZ)V+19
      v ~StubRoutines::call_stub
      V [jvm.dll+0x8176e]
      V [jvm.dll+0xd481d]
      V [jvm.dll+0x8163f]
      V [jvm.dll+0x86984]
      C [jpeg.dll+0x22ae]
      j com.sun.imageio.plugins.jpeg.JPEGImageReader.readImage(J[BI[I[IIIIIII[Ljavax/imageio/plugins/jpeg/JPEGQTable;[Ljavax/imageio/plugins/jpeg/JPEGHuffmanTable;[Ljavax/imageio/plugins/jpeg/JPEGHuffmanTable;IIZ)Z+0
      j com.sun.imageio.plugins.jpeg.JPEGImageReader.readInternal(ILjavax/imageio/ImageReadParam;Z)Ljava/awt/image/Raster;+1062
      j com.sun.imageio.plugins.jpeg.JPEGImageReader.read(ILjavax/imageio/ImageReadParam;)Ljava/awt/image/BufferedImage;+4
      j javax.imageio.ImageIO.read(Ljavax/imageio/stream/ImageInputStream;)Ljava/awt/image/BufferedImage;+55
      j javax.imageio.ImageIO.read(Ljava/net/URL;)Ljava/awt/image/BufferedImage;+42
      j Converting$2.actionPerformed(Ljava/awt/event/ActionEvent;)V+31
      j javax.swing.AbstractButton.fireActionPerformed(Ljava/awt/event/ActionEvent;)V+84
      j javax.swing.AbstractButton$Handler.actionPerformed(Ljava/awt/event/ActionEvent;)V+5
      j javax.swing.DefaultButtonModel.fireActionPerformed(Ljava/awt/event/ActionEvent;)V+35
      j javax.swing.DefaultButtonModel.setPressed(Z)V+117
      j javax.swing.plaf.basic.BasicButtonListener.mouseReleased(Ljava/awt/event/MouseEvent;)V+35
      j java.awt.Component.processMouseEvent(Ljava/awt/event/MouseEvent;)V+64
      j javax.swing.JComponent.processMouseEvent(Ljava/awt/event/MouseEvent;)V+23
      j java.awt.Component.processEvent(Ljava/awt/AWTEvent;)V+81
      j java.awt.Container.processEvent(Ljava/awt/AWTEvent;)V+18
      j java.awt.Component.dispatchEventImpl(Ljava/awt/AWTEvent;)V+477
      J java.awt.Container.dispatchEventImpl(Ljava/awt/AWTEvent;)V
      J java.awt.LightweightDispatcher.retargetMouseEvent(Ljava/awt/Component;ILjava/awt/event/MouseEvent;)V
      j java.awt.LightweightDispatcher.processMouseEvent(Ljava/awt/event/MouseEvent;)Z+139
      j java.awt.LightweightDispatcher.dispatchEvent(Ljava/awt/AWTEvent;)Z+50
      J java.awt.Container.dispatchEventImpl(Ljava/awt/AWTEvent;)V
      v ~RuntimeStub::alignment_frame_return Runtime1 stub
      j java.awt.Window.dispatchEventImpl(Ljava/awt/AWTEvent;)V+19
      j java.awt.Component.dispatchEvent(Ljava/awt/AWTEvent;)V+2
      j java.awt.EventQueue.dispatchEvent(Ljava/awt/AWTEvent;)V+46
      j java.awt.EventDispatchThread.pumpOneEventForHierarchy(ILjava/awt/Component;)Z+200
      j java.awt.EventDispatchThread.pumpEventsForHierarchy(ILjava/awt/Conditional;Ljava/awt/Component;)V+26
      j java.awt.EventDispatchThread.pumpEvents(ILjava/awt/Conditional;)V+4
      j java.awt.EventDispatchThread.pumpEvents(Ljava/awt/Conditional;)V+3
      j java.awt.EventDispatchThread.run()V+9
      v ~StubRoutines::call_stub
      V [jvm.dll+0x8176e]
      V [jvm.dll+0xd481d]
      V [jvm.dll+0x8163f]
      V [jvm.dll+0x8139c]
      V [jvm.dll+0x9c05c]
      V [jvm.dll+0xfeece]
      V [jvm.dll+0xfee9c]
      C [MSVCRT.dll+0x2a3b0]
      C [kernel32.dll+0xb50b]

      Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
      j sun.awt.color.CMM.cmmGetTransform(Ljava/awt/color/ICC_Profile;IILsun/awt/color/ICC_Transform;)I+0
      j sun.awt.color.ICC_Transform.<init>(Ljava/awt/color/ICC_Profile;II)V+18
      j java.awt.image.ColorConvertOp.filter(Ljava/awt/image/Raster;Ljava/awt/image/WritableRaster;)Ljava/awt/image/WritableRaster;+240
      j com.sun.imageio.plugins.jpeg.JPEGImageReader.acceptPixels(IZ)V+19
      v ~StubRoutines::call_stub
      j com.sun.imageio.plugins.jpeg.JPEGImageReader.readImage(J[BI[I[IIIIIII[Ljavax/imageio/plugins/jpeg/JPEGQTable;[Ljavax/imageio/plugins/jpeg/JPEGHuffmanTable;[Ljavax/imageio/plugins/jpeg/JPEGHuffmanTable;IIZ)Z+0
      j com.sun.imageio.plugins.jpeg.JPEGImageReader.readInternal(ILjavax/imageio/ImageReadParam;Z)Ljava/awt/image/Raster;+1062
      j com.sun.imageio.plugins.jpeg.JPEGImageReader.read(ILjavax/imageio/ImageReadParam;)Ljava/awt/image/BufferedImage;+4
      j javax.imageio.ImageIO.read(Ljavax/imageio/stream/ImageInputStream;)Ljava/awt/image/BufferedImage;+55
      j javax.imageio.ImageIO.read(Ljava/net/URL;)Ljava/awt/image/BufferedImage;+42
      j Converting$2.actionPerformed(Ljava/awt/event/ActionEvent;)V+31
      j javax.swing.AbstractButton.fireActionPerformed(Ljava/awt/event/ActionEvent;)V+84
      j javax.swing.AbstractButton$Handler.actionPerformed(Ljava/awt/event/ActionEvent;)V+5
      j javax.swing.DefaultButtonModel.fireActionPerformed(Ljava/awt/event/ActionEvent;)V+35
      j javax.swing.DefaultButtonModel.setPressed(Z)V+117
      j javax.swing.plaf.basic.BasicButtonListener.mouseReleased(Ljava/awt/event/MouseEvent;)V+35
      j java.awt.Component.processMouseEvent(Ljava/awt/event/MouseEvent;)V+64
      j javax.swing.JComponent.processMouseEvent(Ljava/awt/event/MouseEvent;)V+23
      j java.awt.Component.processEvent(Ljava/awt/AWTEvent;)V+81
      j java.awt.Container.processEvent(Ljava/awt/AWTEvent;)V+18
      j java.awt.Component.dispatchEventImpl(Ljava/awt/AWTEvent;)V+477
      J java.awt.Container.dispatchEventImpl(Ljava/awt/AWTEvent;)V
      J java.awt.LightweightDispatcher.retargetMouseEvent(Ljava/awt/Component;ILjava/awt/event/MouseEvent;)V
      j java.awt.LightweightDispatcher.processMouseEvent(Ljava/awt/event/MouseEvent;)Z+139
      j java.awt.LightweightDispatcher.dispatchEvent(Ljava/awt/AWTEvent;)Z+50
      J java.awt.Container.dispatchEventImpl(Ljava/awt/AWTEvent;)V
      v ~RuntimeStub::alignment_frame_return Runtime1 stub
      j java.awt.Window.dispatchEventImpl(Ljava/awt/AWTEvent;)V+19
      j java.awt.Component.dispatchEvent(Ljava/awt/AWTEvent;)V+2
      j java.awt.EventQueue.dispatchEvent(Ljava/awt/AWTEvent;)V+46
      j java.awt.EventDispatchThread.pumpOneEventForHierarchy(ILjava/awt/Component;)Z+200
      j java.awt.EventDispatchThread.pumpEventsForHierarchy(ILjava/awt/Conditional;Ljava/awt/Component;)V+26
      j java.awt.EventDispatchThread.pumpEvents(ILjava/awt/Conditional;)V+4
      j java.awt.EventDispatchThread.pumpEvents(Ljava/awt/Conditional;)V+3
      j java.awt.EventDispatchThread.run()V+9
      v ~StubRoutines::call_stub

      --------------- P R O C E S S ---------------

      Java Threads: ( => current thread )
        0x00356990 JavaThread "DestroyJavaVM" [_thread_blocked, id=56132]
        0x0ad23490 JavaThread "TimerQueue" daemon [_thread_blocked, id=52176]
      =>0x0accd848 JavaThread "AWT-EventQueue-0" [_thread_in_native, id=56008]
        0x0ac66a60 JavaThread "AWT-Windows" daemon [_thread_in_native, id=53548]
        0x0ac66678 JavaThread "AWT-Shutdown" [_thread_blocked, id=53912]
        0x0ac60e28 JavaThread "Java2D Disposer" daemon [_thread_blocked, id=36088]
        0x00a31f50 JavaThread "Low Memory Detector" daemon [_thread_blocked, id=27524]
        0x00a30b28 JavaThread "CompilerThread0" daemon [_thread_blocked, id=50796]
        0x00a2fe58 JavaThread "Signal Dispatcher" daemon [_thread_blocked, id=13656]
        0x00a27330 JavaThread "Finalizer" daemon [_thread_blocked, id=55312]
        0x00a25ea0 JavaThread "Reference Handler" daemon [_thread_blocked, id=49324]

      Other Threads:
        0x00a234d0 VMThread [id=47708]
        0x00a33128 WatcherThread [id=56804]

      VM state:not at safepoint (normal execution)

      VM Mutex/Monitor currently owned by a thread: None

      Heap
       def new generation total 576K, used 314K [0x02a70000, 0x02b10000, 0x02f50000)
        eden space 512K, 51% used [0x02a70000, 0x02ab1ce8, 0x02af0000)
        from space 64K, 80% used [0x02af0000, 0x02afced8, 0x02b00000)
        to space 64K, 0% used [0x02b00000, 0x02b00000, 0x02b10000)
       tenured generation total 1408K, used 968K [0x02f50000, 0x030b0000, 0x06a70000)
         the space 1408K, 68% used [0x02f50000, 0x030421f0, 0x03042200, 0x030b0000)
       compacting perm gen total 8192K, used 7440K [0x06a70000, 0x07270000, 0x0aa70000)
         the space 8192K, 90% used [0x06a70000, 0x071b4100, 0x071b4200, 0x07270000)
      No shared spaces configured.

      Dynamic libraries:
      0x00400000 - 0x0040c000 D:\Program Files\Java\jdk1.5.0_01\bin\javaw.exe
      0x7c900000 - 0x7c9b0000 C:\WINDOWS\system32\ntdll.dll
      0x7c800000 - 0x7c8f4000 C:\WINDOWS\system32\kernel32.dll
      0x77dd0000 - 0x77e6b000 C:\WINDOWS\system32\ADVAPI32.dll
      0x77e70000 - 0x77f01000 C:\WINDOWS\system32\RPCRT4.dll
      0x77d40000 - 0x77dd0000 C:\WINDOWS\system32\USER32.dll
      0x77f10000 - 0x77f57000 C:\WINDOWS\system32\GDI32.dll
      0x77c10000 - 0x77c68000 C:\WINDOWS\system32\MSVCRT.dll
      0x6d6b0000 - 0x6d835000 D:\Program Files\Java\jdk1.5.0_01\jre\bin\client\jvm.dll
      0x76b40000 - 0x76b6d000 C:\WINDOWS\system32\WINMM.dll
      0x5cd70000 - 0x5cd77000 C:\WINDOWS\system32\serwvdrv.dll
      0x5b0a0000 - 0x5b0a7000 C:\WINDOWS\system32\umdmxfrm.dll
      0x6d2f0000 - 0x6d2f8000 D:\Program Files\Java\jdk1.5.0_01\jre\bin\hpi.dll
      0x76bf0000 - 0x76bfb000 C:\WINDOWS\system32\PSAPI.DLL
      0x6d680000 - 0x6d68c000 D:\Program Files\Java\jdk1.5.0_01\jre\bin\verify.dll
      0x6d370000 - 0x6d38d000 D:\Program Files\Java\jdk1.5.0_01\jre\bin\java.dll
      0x6d6a0000 - 0x6d6af000 D:\Program Files\Java\jdk1.5.0_01\jre\bin\zip.dll
      0x6d070000 - 0x6d1d6000 D:\Program Files\Java\jdk1.5.0_01\jre\bin\awt.dll
      0x73000000 - 0x73026000 C:\WINDOWS\system32\WINSPOOL.DRV
      0x76390000 - 0x763ad000 C:\WINDOWS\system32\IMM32.dll
      0x774e0000 - 0x7761d000 C:\WINDOWS\system32\ole32.dll
      0x5ad70000 - 0x5ada8000 C:\WINDOWS\system32\uxtheme.dll
      0x73760000 - 0x737a9000 C:\WINDOWS\system32\ddraw.dll
      0x73bc0000 - 0x73bc6000 C:\WINDOWS\system32\DCIMAN32.dll
      0x73940000 - 0x73a10000 C:\WINDOWS\system32\D3DIM700.DLL
      0x6d2b0000 - 0x6d2ed000 D:\Program Files\Java\jdk1.5.0_01\jre\bin\fontmanager.dll
      0x61210000 - 0x6121f000 C:\Program Files\Microsoft Hardware\Mouse\POINT32.dll
      0x7c9c0000 - 0x7d1d5000 C:\WINDOWS\system32\shell32.dll
      0x77f60000 - 0x77fd6000 C:\WINDOWS\system32\SHLWAPI.dll
      0x773d0000 - 0x774d2000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
      0x5d090000 - 0x5d127000 C:\WINDOWS\system32\comctl32.dll
      0x5b860000 - 0x5b8b4000 C:\WINDOWS\system32\netapi32.dll
      0x71b20000 - 0x71b32000 C:\WINDOWS\system32\MPR.dll
      0x75f70000 - 0x75f79000 C:\WINDOWS\System32\davclnt.dll
      0x75f60000 - 0x75f67000 C:\WINDOWS\System32\drprov.dll
      0x71c10000 - 0x71c1e000 C:\WINDOWS\System32\ntlanman.dll
      0x71cd0000 - 0x71ce7000 C:\WINDOWS\System32\NETUI0.dll
      0x71c90000 - 0x71cd0000 C:\WINDOWS\System32\NETUI1.dll
      0x71c80000 - 0x71c87000 C:\WINDOWS\System32\NETRAP.dll
      0x71bf0000 - 0x71c03000 C:\WINDOWS\System32\SAMLIB.dll
      0x77920000 - 0x77a13000 C:\WINDOWS\system32\SETUPAPI.dll
      0x77b40000 - 0x77b62000 C:\WINDOWS\system32\appHelp.dll
      0x76fd0000 - 0x7704f000 C:\WINDOWS\system32\CLBCATQ.DLL
      0x77050000 - 0x77115000 C:\WINDOWS\system32\COMRes.dll
      0x77120000 - 0x771ac000 C:\WINDOWS\system32\OLEAUT32.dll
      0x77c00000 - 0x77c08000 C:\WINDOWS\system32\VERSION.dll
      0x76980000 - 0x76988000 C:\WINDOWS\system32\LINKINFO.dll
      0x76990000 - 0x769b5000 C:\WINDOWS\system32\ntshrui.dll
      0x76b20000 - 0x76b31000 C:\WINDOWS\system32\ATL.DLL
      0x769c0000 - 0x76a73000 C:\WINDOWS\system32\USERENV.dll
      0x6d530000 - 0x6d543000 D:\Program Files\Java\jdk1.5.0_01\jre\bin\net.dll
      0x71ab0000 - 0x71ac7000 C:\WINDOWS\system32\WS2_32.dll
      0x71aa0000 - 0x71aa8000 C:\WINDOWS\system32\WS2HELP.dll
      0x6d550000 - 0x6d559000 D:\Program Files\Java\jdk1.5.0_01\jre\bin\nio.dll
      0x6d200000 - 0x6d22f000 D:\Program Files\Java\jdk1.5.0_01\jre\bin\cmm.dll
      0x6d430000 - 0x6d44f000 D:\Program Files\Java\jdk1.5.0_01\jre\bin\jpeg.dll
      0x61220000 - 0x61232000 C:\Program Files\Microsoft Hardware\Mouse\MSH_ZWF.dll

      VM Arguments:
      java_command: Converting

      Environment Variables:
      PATH=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\WBEM;C:\Program Files\Common Files\Symbian\Tools;d:\Perl\bin;C:\Program Files\ATI Technologies\ATI Control Panel;d:\Program Files\Metrowerks\CodeWarrior For Symbian Personal v2.0\Bin;d:\Program Files\Metrowerks\CodeWarrior For Symbian Personal v2.0\Other_Metrowerks_Tools\Command Line Tools;d:\mophun\bin;C:\Program Files\Microsoft SQL Server\80\Tools\BINN;d:\Program Files\SourceOffSite Collab Client; D:\raserver\bin;C:\Program Files\VoiceAge\Common;D:\Program Files\Microsoft Visual Studio\Common\Tools\WinNT;D:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin;D:\Program Files\Microsoft Visual Studio\Common\Tools;D:\Program Files\Microsoft Visual Studio\VC98\bin; D:\jdk1.1.8\bin
      USERNAME=a
      OS=Windows_NT
      PROCESSOR_IDENTIFIER=x86 Family 6 Model 10 Stepping 0, AuthenticAMD


      --------------- S Y S T E M ---------------

      OS: Windows XP Build 2600 Service Pack 2

      CPU:total 1 family 6, cmov, cx8, fxsr, mmx, sse

      Memory: 4k page, physical 1572336k(505940k free), swap 1933608k(619872k free)

      vm_info: Java HotSpot(TM) Client VM (1.5.0_01-b08) for windows-x86, built on Dec 6 2004 19:51:00 by "java_re" with MS VC++ 6.0



      REPRODUCIBILITY :
      This bug can be reproduced always.
      Code (taken from http://java.sun.com/developer/technicalArticles/Media/AdvancedImage/index.html) and image attached.

            anashaty Anton Nashatyrev (Inactive)
            igor Igor Nekrestyanov (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved:
              Imported:
              Indexed: