src/java.desktop/share/native/libawt/awt/medialib/awt_ImagingLib.c

*** 2417,2436 ****
  #endif
      switch (rasterP->type) {
      case sun_awt_image_IntegerComponentRaster_TYPE_INT_8BIT_SAMPLES:
          if (!((rasterP->chanOffsets[0] == 0 || SAFE_TO_ALLOC_2(rasterP->chanOffsets[0], 4)) &&
                SAFE_TO_ALLOC_2(width, 4) &&
!               SAFE_TO_ALLOC_3(height, rasterP->scanlineStride, 4)))
          {
              return -1;
          }
          offset = 4 * rasterP->chanOffsets[0];
          dataSize = 4 * (*env)->GetArrayLength(env, rasterP->jdata);
  
          if (offset < 0 || offset >= dataSize ||
              width > rasterP->scanlineStride ||
!             height * rasterP->scanlineStride * 4 > dataSize - offset)
          {
              // raster data buffer is too short
              return -1;
          }
          dataP = (void *) (*env)->GetPrimitiveArrayCritical(env, rasterP->jdata,
--- 2417,2436 ----
  #endif
      switch (rasterP->type) {
      case sun_awt_image_IntegerComponentRaster_TYPE_INT_8BIT_SAMPLES:
          if (!((rasterP->chanOffsets[0] == 0 || SAFE_TO_ALLOC_2(rasterP->chanOffsets[0], 4)) &&
                SAFE_TO_ALLOC_2(width, 4) &&
!               SAFE_TO_ALLOC_3(rasterP->scanlineStride, height, 4)))
          {
              return -1;
          }
          offset = 4 * rasterP->chanOffsets[0];
          dataSize = 4 * (*env)->GetArrayLength(env, rasterP->jdata);
  
          if (offset < 0 || offset >= dataSize ||
              width > rasterP->scanlineStride ||
!             ((width + (height - 1) * rasterP->scanlineStride) * 4) > dataSize - offset)
          {
              // raster data buffer is too short
              return -1;
          }
          dataP = (void *) (*env)->GetPrimitiveArrayCritical(env, rasterP->jdata,
*** 2444,2463 ****
                                                (unsigned char *)dataP + offset);
          *dataPP = dataP;
          return 0;
      case sun_awt_image_IntegerComponentRaster_TYPE_BYTE_SAMPLES:
          if (!(SAFE_TO_ALLOC_2(width, rasterP->numBands) &&
!               SAFE_TO_ALLOC_2(height, rasterP->scanlineStride)))
          {
              return -1;
          }
          offset = rasterP->chanOffsets[0];
          dataSize = (*env)->GetArrayLength(env, rasterP->jdata);
  
          if (offset < 0 || offset >= dataSize ||
              width * rasterP->numBands > rasterP->scanlineStride ||
!             height * rasterP->scanlineStride > dataSize - offset)
          {
              // raster data buffer is too short
              return -1;
          }
          dataP = (void *) (*env)->GetPrimitiveArrayCritical(env, rasterP->jdata,
--- 2444,2464 ----
                                                (unsigned char *)dataP + offset);
          *dataPP = dataP;
          return 0;
      case sun_awt_image_IntegerComponentRaster_TYPE_BYTE_SAMPLES:
          if (!(SAFE_TO_ALLOC_2(width, rasterP->numBands) &&
!               SAFE_TO_ALLOC_2(rasterP->scanlineStride, height)))
          {
              return -1;
          }
          offset = rasterP->chanOffsets[0];
          dataSize = (*env)->GetArrayLength(env, rasterP->jdata);
  
          if (offset < 0 || offset >= dataSize ||
              width * rasterP->numBands > rasterP->scanlineStride ||
!             ((width * rasterP->numBands) +
!              (height - 1) * rasterP->scanlineStride) > dataSize - offset)
          {
              // raster data buffer is too short
              return -1;
          }
          dataP = (void *) (*env)->GetPrimitiveArrayCritical(env, rasterP->jdata,
*** 2472,2491 ****
          *dataPP = dataP;
          return 0;
      case sun_awt_image_IntegerComponentRaster_TYPE_USHORT_SAMPLES:
          if (!((rasterP->chanOffsets[0] == 0 || SAFE_TO_ALLOC_2(rasterP->chanOffsets[0], 2)) &&
                SAFE_TO_ALLOC_3(width, rasterP->numBands, 2) &&
!               SAFE_TO_ALLOC_3(height, rasterP->scanlineStride, 2)))
          {
                return -1;
          }
          offset = rasterP->chanOffsets[0] * 2;
          dataSize = 2 * (*env)->GetArrayLength(env, rasterP->jdata);
  
          if (offset < 0 || offset >= dataSize ||
              width * rasterP->numBands > rasterP->scanlineStride ||
!             height * rasterP->scanlineStride * 2 > dataSize - offset)
          {
              // raster data buffer is too short
               return -1;
          }
          dataP = (void *) (*env)->GetPrimitiveArrayCritical(env, rasterP->jdata,
--- 2473,2493 ----
          *dataPP = dataP;
          return 0;
      case sun_awt_image_IntegerComponentRaster_TYPE_USHORT_SAMPLES:
          if (!((rasterP->chanOffsets[0] == 0 || SAFE_TO_ALLOC_2(rasterP->chanOffsets[0], 2)) &&
                SAFE_TO_ALLOC_3(width, rasterP->numBands, 2) &&
!               SAFE_TO_ALLOC_3(rasterP->scanlineStride, height, 2)))
          {
                return -1;
          }
          offset = rasterP->chanOffsets[0] * 2;
          dataSize = 2 * (*env)->GetArrayLength(env, rasterP->jdata);
  
          if (offset < 0 || offset >= dataSize ||
              width * rasterP->numBands > rasterP->scanlineStride ||
!             (((width * rasterP->numBands) +
!              (height - 1) * rasterP->scanlineStride)) * 2 > dataSize - offset)
          {
              // raster data buffer is too short
               return -1;
          }
          dataP = (void *) (*env)->GetPrimitiveArrayCritical(env, rasterP->jdata,