--- old/src/java.desktop/share/classes/com/sun/imageio/plugins/png/PNGImageReader.java 2017-12-14 13:20:55.584997340 +0530 +++ new/src/java.desktop/share/classes/com/sun/imageio/plugins/png/PNGImageReader.java 2017-12-14 13:20:55.180997340 +0530 @@ -1037,7 +1037,15 @@ int bytesPerPixel = (bitDepth == 16) ? 2 : 1; bytesPerPixel *= inputBands; - int bytesPerRow = (inputBands*passWidth*bitDepth + 7)/8; + /* + * When we multiply passWidth with inputBands/bitDepth if the + * resultant value exceeds maximum value for int, bufferoverflow happens + * and the value will be invalid. So until we calculate bytesPerRow + * value by dividing it by 8 we can maintain bitsPerRow value in long + * so that final bytesPerRow value is valid. + */ + long bitsPerRow = ((long)inputBands) * passWidth * bitDepth; + int bytesPerRow = (int)((bitsPerRow + 7)/8); int eltsPerRow = (bitDepth == 16) ? bytesPerRow/2 : bytesPerRow; // If no pixels need updating, just skip the input data