From 78600b8e5e352ff1ea22c10891da12f9414c5b15 Mon Sep 17 00:00:00 2001 From: Goetz Lindenmaier Date: Mon, 10 Mar 2025 14:38:23 +0000 Subject: [PATCH] 8347911: Limit the length of inflated text chunks Backport-of: 398a580518b4e7961bdddf733e0a89ff25bc437a --- .../classes/com/sun/imageio/plugins/png/PNGImageReader.java | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/java.desktop/share/classes/com/sun/imageio/plugins/png/PNGImageReader.java b/src/java.desktop/share/classes/com/sun/imageio/plugins/png/PNGImageReader.java index fc58a566148..7a51d218fb3 100644 --- a/src/java.desktop/share/classes/com/sun/imageio/plugins/png/PNGImageReader.java +++ b/src/java.desktop/share/classes/com/sun/imageio/plugins/png/PNGImageReader.java @@ -1,5 +1,5 @@ /* - * Copyright (c) 2000, 2021, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2000, 2025, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -139,6 +139,7 @@ public class PNGImageReader extends ImageReader { static final int tRNS_TYPE = 0x74524e53; static final int zTXt_TYPE = 0x7a545874; + static final int MAX_INFLATED_TEXT_LENGTH = 262144; static final int PNG_COLOR_GRAY = 0; static final int PNG_COLOR_RGB = 2; static final int PNG_COLOR_PALETTE = 3; @@ -661,7 +662,7 @@ private void parse_tRNS_chunk(int chunkLength) throws IOException { private static byte[] inflate(byte[] b) throws IOException { InputStream bais = new ByteArrayInputStream(b); try (InputStream iis = new InflaterInputStream(bais)) { - return iis.readAllBytes(); + return iis.readNBytes(MAX_INFLATED_TEXT_LENGTH); } }