FULL PRODUCT VERSION :
java version "1.6.0_03"
Java(TM) SE Runtime Environment (build 1.6.0_03-b05)
Java HotSpot(TM) Client VM (build 1.6.0_03-b05, mixed mode, sharing)

ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows XP [Version 5.1.2600]

A DESCRIPTION OF THE PROBLEM :
The IIOMetadata for GIF format assumes characterCellWidth and characterCellHeight
attribute on PlainTextExtension as 2-bytes unsigned integer, but both are
defined as 1-byte unsigned integer in GIF 89a format.

The following document specifies that both attribute values are 1-65535 range.

http://java.sun.com/javase/ja/6/docs/ja/api/javax/imageio/metadata/doc-files/gif_metadata.html

Actually, IIOInvalidTreeException is raised when the value is greater than not
255 but 65535.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
IIOMetadata#setFromTree() should raise IIOInvalidTreeException if
characterCellWidth or characterCellHeight is greater than 255.
ACTUAL -
In value 256-65535, IIOMetadata#setFromTree() is quiet but actual field will
store only lower 1 byte (same as value & 0xFF). If the value is greater than
65535, it will raise IIOInvalidTreeException.

Other 1-byte unsigned integer field such as textForegroundColor will raise
same exception if greater than 255.

ERROR MESSAGES/STACK TRACES THAT OCCUR :
If value > 65535

javax.imageio.metadata.IIOInvalidTreeException: Bad value for PlainTextExtension attribute characterCellWidth!
  at com.sun.imageio.plugins.gif.GIFMetadata.fatal(GIFMetadata.java:34)
  at com.sun.imageio.plugins.gif.GIFMetadata.getIntAttribute(GIFMetadata.java:97)
  at com.sun.imageio.plugins.gif.GIFWritableImageMetadata.mergeNativeTree(GIFWritableImageMetadata.java:188)
  at com.sun.imageio.plugins.gif.GIFMetadata.mergeTree(GIFMetadata.java:236)
  at com.sun.imageio.plugins.gif.GIFImageMetadata.mergeTree(GIFImageMetadata.java:25)
  at com.sun.imageio.plugins.gif.GIFWritableImageMetadata.setFromTree(GIFWritableImageMetadata.java:382)
  ...


REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
The following source will create "hello, world" GIF image with plain text
extension block in file foo.gif. Please modifiy *1 or *2 to 256-65535 or over
to reproduce this behaviour.

import java.awt.*;
import java.awt.image.*;
import java.io.*;
import java.util.*;
import javax.imageio.*;
import javax.imageio.metadata.*;
import javax.imageio.stream.*;
public class GIFPlainText {
  public static void main(String[] args) throws IOException{
    BufferedImage image = new BufferedImage(100, 16, BufferedImage.TYPE_4BYTE_ABGR);
    Graphics g = image.getGraphics();
    g.setColor(Color.WHITE); g.fillRect(0, 0, 100, 16);
    g.setColor(Color.BLACK); g.drawString("hello, world", 3, 14);
    ImageOutputStream out = ImageIO.createImageOutputStream(new File("foo.gif"));
    Iterator<ImageWriter> it = ImageIO.getImageWritersByFormatName("GIF");
    ImageWriter writer = it.next();
    writer.setOutput(out);
    IIOMetadataNode node = new IIOMetadataNode("PlainTextExtension");
    node.setAttribute("textGridLeft", "0");
    node.setAttribute("textGridTop", "0");
    node.setAttribute("textGridWidth", "100");
    node.setAttribute("textGridHeight", "16");
    node.setAttribute("characterCellWidth", "100"); // *1
    node.setAttribute("characterCellHeight", "16"); // *2
    node.setAttribute("textForegroundColor", "0");
    node.setAttribute("textBackgroundColor", "1");
    ImageWriteParam param = writer.getDefaultWriteParam();
    IIOMetadata meta = writer.getDefaultImageMetadata(
        ImageTypeSpecifier.createFromRenderedImage(image), param);
    String format = meta.getNativeMetadataFormatName();
    IIOMetadataNode root = (IIOMetadataNode)meta.getAsTree(format);
    root.appendChild(node);
    meta.setFromTree(format, root);
    writer.prepareWriteSequence(null);
    writer.writeToSequence(new IIOImage(image, null, meta), param);
    writer.endWriteSequence();
    out.close();
  }
}
---------- END SOURCE ----------