8041545: Better validation of generated rasters
Reviewed-by: prr, serb, bae, skoivu
--- a/jdk/src/java.desktop/share/classes/sun/awt/image/BytePackedRaster.java Thu May 22 12:28:27 2014 -0700
+++ b/jdk/src/java.desktop/share/classes/sun/awt/image/BytePackedRaster.java Fri May 23 10:56:42 2014 +0400
@@ -1408,10 +1408,10 @@
}
}
- int lastbit = (dataBitOffset
- + (height-1) * scanlineStride * 8
- + (width-1) * pixelBitStride
- + pixelBitStride - 1);
+ long lastbit = (long) dataBitOffset
+ + (long) (height - 1) * (long) scanlineStride * 8
+ + (long) (width - 1) * (long) pixelBitStride
+ + (long) pixelBitStride - 1;
if (lastbit < 0 || lastbit / 8 >= data.length) {
throw new RasterFormatException("raster dimensions overflow " +
"array bounds");