commit f14ccdf17f9bed1085323951eac365af3f22c23c
author Petr Pchelko <pchelko@openjdk.org> Fri May 23 12:15:26 2014 +0400
committer Petr Pchelko <pchelko@openjdk.org> Fri May 23 12:15:26 2014 +0400
tree ea8e6198c75dd33702496470b3ff35fbd020ef73
parent 6ab07a19f8b0465b31e70c4efa8c8086e5a33dbb

8041545: Better validation of generated rasters

Reviewed-by: prr, serb, bae, skoivu

jdk/src/share/classes/sun/awt/image/BytePackedRaster.java

diff --git a/jdk/src/share/classes/sun/awt/image/BytePackedRaster.java b/jdk/src/share/classes/sun/awt/image/BytePackedRaster.java
index da370a3..68e7211 100644
--- a/jdk/src/share/classes/sun/awt/image/BytePackedRaster.java
+++ b/jdk/src/share/classes/sun/awt/image/BytePackedRaster.java
@@ -1393,10 +1393,10 @@
             throw new RasterFormatException("Invalid scanline stride");
         }
 
-        int lastbit = (dataBitOffset
-                       + (height-1) * scanlineStride * 8
-                       + (width-1) * pixelBitStride
-                       + pixelBitStride - 1);
+        long lastbit = (long) dataBitOffset
+                       + (long) (height - 1) * (long) scanlineStride * 8
+                       + (long) (width - 1) * (long) pixelBitStride
+                       + (long) pixelBitStride - 1;
         if (lastbit < 0 || lastbit / 8 >= data.length) {
             throw new RasterFormatException("raster dimensions overflow " +
                                             "array bounds");