FULL PRODUCT VERSION :
- OpenJDK Runtime Environment (build 9.0.1+11)
- Java(TM) SE Runtime Environment (build 10-ea+30)

ADDITIONAL OS VERSION INFORMATION :
Ubuntu Linux 64-bit

A DESCRIPTION OF THE PROBLEM :
The ImageReader com.sun.imageio.plugins.png.PNGImageReader throws an undocumented IllegalArgumentException with message "Pixel stride times width must be less than or equal to the scanline stride" with the width is very large (e.g. 0x4fff ffff pixels). This is leaking an implementation detail: if the PNGReader cannot handle images with large widths, an IllegalArgumentException with such a message must be thrown and this should be documented in the public API for ImageIO.read() and ImageReader.read(). This may be related to JDK-8190332.

This bug was found using AFL + JQF.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Compile and run the test program attached below. For brevity, a small PNG file is included that does not actually contain all the pixels specified in the header (i.e. the image is malformed), and thus an IOException is expected.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -

For the example provided below, an IOException should be thrown (e.g. javax.imagio.IIOException) since the image does not actually contain as many pixels as specified in the large width. If the PngImageReader cannot handle well-formed images with widths as large as 0x4fffffff pixels, an appropriate exception should be thrown and this should be documented.
ACTUAL -
A java.lang.IllegalArgumentException is thrown with message: "Pixel stride times width must be less than or equal to the scanline stride"

ERROR MESSAGES/STACK TRACES THAT OCCUR :
Exception in thread "main" java.lang.IllegalArgumentException: Pixel stride times width must be less than or equal to the scanline stride
at java.desktop/java.awt.image.PixelInterleavedSampleModel.<init>(PixelInterleavedSampleModel.java:101)
at java.desktop/java.awt.image.Raster.createInterleavedRaster(Raster.java:642)
at java.desktop/com.sun.imageio.plugins.png.PNGImageReader.createRaster(PNGImageReader.java:963)
at java.desktop/com.sun.imageio.plugins.png.PNGImageReader.decodePass(PNGImageReader.java:1079)
at java.desktop/com.sun.imageio.plugins.png.PNGImageReader.decodeImage(PNGImageReader.java:1275)
at java.desktop/com.sun.imageio.plugins.png.PNGImageReader.readImage(PNGImageReader.java:1396)
at java.desktop/com.sun.imageio.plugins.png.PNGImageReader.read(PNGImageReader.java:1674)
at java.desktop/javax.imageio.ImageIO.read(ImageIO.java:1468)
at java.desktop/javax.imageio.ImageIO.read(ImageIO.java:1363)
at PngReaderStrideIssue.main(PngReaderStrideIssue.java:18)


REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
import java.io.ByteArrayInputStream;
import java.io.InputStream;
import java.util.Base64;
import javax.imageio.ImageIO;

public class PngReaderStrideIssue {

// PNG image test case (encoded as base64)
private static String inputImageBase64 = "iVBORw0KGgoAAAANSUhEUk////8AAAA" +
"BCAAAAAA6fptVAAAACklEQVQYV2P4DwABAQEAWk1v8QAAAABJRU5ErkJgggo=";

public static void main(String[] args) throws java.io.IOException {
// Convert test case into input stream
byte[] inputBytes = Base64.getDecoder().decode(inputImageBase64);
InputStream in = new ByteArrayInputStream(inputBytes);

// Attempt to read PNG
ImageIO.read(in); // Throws java.lang.IllegalArgumentException!
}
}
---------- END SOURCE ----------