OpenJDK / bsd-port / jdk9 / jdk
changeset 3815:d1ec8c106dda
7030147: java.awt.image.SampleModel.setDataElements() does't throw ArrayIndexOutOfBoundsEx for Integer.MAX_VA
Reviewed-by: jgodinez, prr
| author | bae |
|---|---|
| date | Tue, 29 Mar 2011 13:10:09 +0400 |
| parents | 0f7256505703 |
| children | 5a0c0ae1c85b |
| files | src/share/classes/java/awt/image/SampleModel.java |
| diffstat | 1 files changed, 21 insertions(+), 12 deletions(-) [+] |
line wrap: on
line diff
--- a/src/share/classes/java/awt/image/SampleModel.java Sun Mar 27 15:51:44 2011 +0400 +++ b/src/share/classes/java/awt/image/SampleModel.java Tue Mar 29 13:10:09 2011 +0400 @@ -361,8 +361,8 @@ int x1 = x + w; int y1 = y + h; - if (x < 0 || x1 < x || x1 > width || - y < 0 || y1 < y || y1 > height) + if (x < 0 || x >= width || w > width || x1 < 0 || x1 > width || + y < 0 || y >= height || h > height || y1 < 0 || y1 > height) { throw new ArrayIndexOutOfBoundsException("Invalid coordinates."); } @@ -588,6 +588,15 @@ int type = getTransferType(); int numDataElems = getNumDataElements(); + int x1 = x + w; + int y1 = y + h; + + if (x < 0 || x >= width || w > width || x1 < 0 || x1 > width || + y < 0 || y >= height || h > height || y1 < 0 || y1 > height) + { + throw new ArrayIndexOutOfBoundsException("Invalid coordinates."); + } + switch(type) { case DataBuffer.TYPE_BYTE: @@ -595,8 +604,8 @@ byte[] barray = (byte[])obj; byte[] btemp = new byte[numDataElems]; - for (int i=y; i<y+h; i++) { - for (int j=x; j<x+w; j++) { + for (int i=y; i<y1; i++) { + for (int j=x; j<x1; j++) { for (int k=0; k<numDataElems; k++) { btemp[k] = barray[cnt++]; } @@ -612,8 +621,8 @@ short[] sarray = (short[])obj; short[] stemp = new short[numDataElems]; - for (int i=y; i<y+h; i++) { - for (int j=x; j<x+w; j++) { + for (int i=y; i<y1; i++) { + for (int j=x; j<x1; j++) { for (int k=0; k<numDataElems; k++) { stemp[k] = sarray[cnt++]; } @@ -628,8 +637,8 @@ int[] iArray = (int[])obj; int[] itemp = new int[numDataElems]; - for (int i=y; i<y+h; i++) { - for (int j=x; j<x+w; j++) { + for (int i=y; i<y1; i++) { + for (int j=x; j<x1; j++) { for (int k=0; k<numDataElems; k++) { itemp[k] = iArray[cnt++]; } @@ -644,8 +653,8 @@ float[] fArray = (float[])obj; float[] ftemp = new float[numDataElems]; - for (int i=y; i<y+h; i++) { - for (int j=x; j<x+w; j++) { + for (int i=y; i<y1; i++) { + for (int j=x; j<x1; j++) { for (int k=0; k<numDataElems; k++) { ftemp[k] = fArray[cnt++]; } @@ -660,8 +669,8 @@ double[] dArray = (double[])obj; double[] dtemp = new double[numDataElems]; - for (int i=y; i<y+h; i++) { - for (int j=x; j<x+w; j++) { + for (int i=y; i<y1; i++) { + for (int j=x; j<x1; j++) { for (int k=0; k<numDataElems; k++) { dtemp[k] = dArray[cnt++]; }