jdk-sandbox: comparison jdk/src/share/classes/sun/java2d/cmm/lcms/LCMSImageLayout.java

equal deleted inserted replaced

-:b321dfd1163f
+:5e0400ee2917
 * image is processed scan by scan.
 */
 private boolean imageAtOnce = false;
 Object dataArray;
-private LCMSImageLayout(int np, int pixelType, int pixelSize) {
+private int dataArrayLength; /* in bytes */
+private LCMSImageLayout(int np, int pixelType, int pixelSize)
+throws ImageLayoutException
+{
 this.pixelType = pixelType;
 width = np;
 height = 1;
-nextRowOffset = np * pixelSize;
+nextRowOffset = safeMult(pixelSize, np);
 offset = 0;
 }
 private LCMSImageLayout(int width, int height, int pixelType,
-int pixelSize) {
+int pixelSize)
+throws ImageLayoutException
+{
 this.pixelType = pixelType;
 this.width = width;
 this.height = height;
-nextRowOffset = width * pixelSize;
+nextRowOffset = safeMult(pixelSize, width);
 offset = 0;
 }
-public LCMSImageLayout(byte[] data, int np, int pixelType, int pixelSize) {
+public LCMSImageLayout(byte[] data, int np, int pixelType, int pixelSize)
+throws ImageLayoutException
+{
 this(np, pixelType, pixelSize);
 dataType = DT_BYTE;
 dataArray = data;
-}
+dataArrayLength = data.length;
-public LCMSImageLayout(short[] data, int np, int pixelType, int pixelSize) {
+verify();
+}
+public LCMSImageLayout(short[] data, int np, int pixelType, int pixelSize)
+throws ImageLayoutException
+{
 this(np, pixelType, pixelSize);
 dataType = DT_SHORT;
 dataArray = data;
-}
+dataArrayLength = 2 * data.length;
-public LCMSImageLayout(int[] data, int np, int pixelType, int pixelSize) {
+verify();
+}
+public LCMSImageLayout(int[] data, int np, int pixelType, int pixelSize)
+throws ImageLayoutException
+{
 this(np, pixelType, pixelSize);
 dataType = DT_INT;
 dataArray = data;
-}
+dataArrayLength = 4 * data.length;
-public LCMSImageLayout(double[] data, int np, int pixelType, int pixelSize) {
+verify();
+}
+public LCMSImageLayout(double[] data, int np, int pixelType, int pixelSize)
+throws ImageLayoutException
+{
 this(np, pixelType, pixelSize);
 dataType = DT_DOUBLE;
 dataArray = data;
+dataArrayLength = 8 * data.length;
+verify();
 }
 private LCMSImageLayout() {
 }
 /* This method creates a layout object for given image.
 * Returns null if the image is not supported by current implementation.
 */
-public static LCMSImageLayout createImageLayout(BufferedImage image) {
+public static LCMSImageLayout createImageLayout(BufferedImage image) throws ImageLayoutException {
 LCMSImageLayout l = new LCMSImageLayout();
 switch (image.getType()) {
 case BufferedImage.TYPE_INT_RGB:
 l.pixelType = PT_ARGB_8;
 case BufferedImage.TYPE_INT_ARGB:
 case BufferedImage.TYPE_INT_BGR:
 do {
 IntegerComponentRaster intRaster = (IntegerComponentRaster)
 image.getRaster();
-l.nextRowOffset = intRaster.getScanlineStride() * 4;
+l.nextRowOffset = safeMult(4, intRaster.getScanlineStride());
-l.offset = intRaster.getDataOffset(0) * 4;
+l.offset = safeMult(4, intRaster.getDataOffset(0));
 l.dataArray = intRaster.getDataStorage();
+l.dataArrayLength = 4 * intRaster.getDataStorage().length;
 l.dataType = DT_INT;
 if (l.nextRowOffset == l.width * 4 * intRaster.getPixelStride()) {
 l.imageAtOnce = true;
 }
 image.getRaster();
 l.nextRowOffset = byteRaster.getScanlineStride();
 int firstBand = image.getSampleModel().getNumBands() - 1;
 l.offset = byteRaster.getDataOffset(firstBand);
 l.dataArray = byteRaster.getDataStorage();
+l.dataArrayLength = byteRaster.getDataStorage().length;
 l.dataType = DT_BYTE;
 if (l.nextRowOffset == l.width * byteRaster.getPixelStride()) {
 l.imageAtOnce = true;
 }
 } while (false);
 case BufferedImage.TYPE_BYTE_GRAY:
 do {
 ByteComponentRaster byteRaster = (ByteComponentRaster)
 image.getRaster();
 l.nextRowOffset = byteRaster.getScanlineStride();
+l.dataArrayLength = byteRaster.getDataStorage().length;
 l.offset = byteRaster.getDataOffset(0);
 l.dataArray = byteRaster.getDataStorage();
 l.dataType = DT_BYTE;
 if (l.nextRowOffset == l.width * byteRaster.getPixelStride()) {
 case BufferedImage.TYPE_USHORT_GRAY:
 do {
 ShortComponentRaster shortRaster = (ShortComponentRaster)
 image.getRaster();
-l.nextRowOffset = shortRaster.getScanlineStride() * 2;
+l.nextRowOffset = safeMult(2, shortRaster.getScanlineStride());
-l.offset = shortRaster.getDataOffset(0) * 2;
+l.offset = safeMult(2, shortRaster.getDataOffset(0));
 l.dataArray = shortRaster.getDataStorage();
+l.dataArrayLength = 2 * shortRaster.getDataStorage().length;
 l.dataType = DT_SHORT;
 if (l.nextRowOffset == l.width * 2 * shortRaster.getPixelStride()) {
 l.imageAtOnce = true;
 }
 } while (false);
 break;
 default:
 return null;
 }
+l.verify();
 return l;
 }
 private static enum BandOrder {
 DIRECT,
 }
 return order;
 }
 }
+private void verify() throws ImageLayoutException {
+if (offset < 0 || offset >= dataArrayLength) {
+throw new ImageLayoutException("Invalid image layout");
+}
+int lastPixelOffset = safeMult(nextRowOffset, (height - 1));
+lastPixelOffset = safeAdd(lastPixelOffset, (width - 1));
+int off = safeAdd(offset, lastPixelOffset);
+if (off < 0 || off >= dataArrayLength) {
+throw new ImageLayoutException("Invalid image layout");
+}
+}
+static int safeAdd(int a, int b) throws ImageLayoutException {
+long res = a;
+res += b;
+if (res < Integer.MIN_VALUE || res > Integer.MAX_VALUE) {
+throw new ImageLayoutException("Invalid image layout");
+}
+return (int)res;
+}
+static int safeMult(int a, int b) throws ImageLayoutException {
+long res = a;
+res *= b;
+if (res < Integer.MIN_VALUE || res > Integer.MAX_VALUE) {
+throw new ImageLayoutException("Invalid image layout");
+}
+return (int)res;
+}
+public static class ImageLayoutException extends Exception {
+public ImageLayoutException(String message) {
+super(message);
+}
+}
 public static LCMSImageLayout createImageLayout(Raster r) {
 LCMSImageLayout l = new LCMSImageLayout();
 if (r instanceof ByteComponentRaster) {
 ByteComponentRaster br = (ByteComponentRaster)r;

changeset 16900	5e0400ee2917
parent 15974	91b0e63e6e83
parent 16899	666a37b19844
child 18255	3bad8692f61c