XBM (X Bitmap) images are small one-bit deep images that were developed as a simple uncompressed format that could easily be included in C source files as include files.

They are basically two #defines of width and height and a byte array with the bits.
They were commonly used in X11 applications at a time when color graphics cards were not the norm.
JDK's Toolkit Image API has always supported these, even thought it is not specified or even documented.
The current implementation allows an arbitrarily large XBM which is not a valid use case for any XBM.
Also it doesn't validate that the provided byte array is sufficient to populate the specified WxH.

It is tempting to just delete the XBM support, but there's a small risk that some app actually depends on it.
So instead we can just limit the size to something reasonable.
XBMs would usually be something like 16x16 or 32x32, so maybe 128x128 pixels ? That's 16384 bytes.
We could go larger if someone thinks it necessary.
At the same time we can improve the overall implementation of this decoder.