openjdk/jdk11u
1
0
Fork 0
mirror of https://github.com/openjdk/jdk11u.git synced 2025-12-11 17:44:17 -06:00
Code Issues Packages Projects Releases Wiki Activity

8347911: Limit the length of inflated text chunks

Browse Source 
Backport-of: 398a580518b4e7961bdddf733e0a89ff25bc437a
This commit is contained in:
Timofei Pushkin 2025-10-22 17:23:57 +00:00 committed by Alexey Bakhtin
parent c5f39c9547
commit 085a7f1851
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/java.desktop/share/classes/com/sun/imageio/plugins/png/PNGImageReader.java
View File

@ -1,5 +1,5 @@
/*
* Copyright (c) 2000, 2021, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2000, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -139,6 +139,7 @@ public class PNGImageReader extends ImageReader {
static final int tRNS_TYPE = 0x74524e53;
static final int zTXt_TYPE = 0x7a545874;
static final int MAX_INFLATED_TEXT_LENGTH = 262144;
static final int PNG_COLOR_GRAY = 0;
static final int PNG_COLOR_RGB = 2;
static final int PNG_COLOR_PALETTE = 3;
@ -661,7 +662,7 @@ public class PNGImageReader extends ImageReader {
private static byte[] inflate(byte[] b) throws IOException {
InputStream bais = new ByteArrayInputStream(b);
try (InputStream iis = new InflaterInputStream(bais)) {
return iis.readAllBytes();
return iis.readNBytes(MAX_INFLATED_TEXT_LENGTH);
}
}