ArrayIndexOutOfBoundsException in CCITTFaxDecoderStream.java

Describe the bug The second occurence of changesCurrentRow[changesCurrentRowCount++] = index; can produce an AIOOBE

Version information

1. The version of the TwelveMonkeys ImageIO library in use. We’re using a modified version of that file, but I expect this to happen on your side too. I looked at your code and the last modifications.

2. The exact output of java --version (or java -version for older Java releases). 18-ea

3. Extra information about OS version, server version, standalone program or web application packaging, executable wrapper, etc. W10

To Reproduce

Use CCITTFaxDecoderStream with the exploit mentioned in https://issues.apache.org/jira/browse/PDFBOX-5339

parameters: columns 7 type 4 fillOrder 1 options 0 byteAligned false

        InputStream is = new FileInputStream("crash-e835587b760ebc7e5a2edc3855d82c38637223c5.txt");
        is.skip(3404);
        CCITTFaxDecoderStream ccittFaxDecoderStream = new CCITTFaxDecoderStream(is, 7, 4, 1, 0, false);
        while (ccittFaxDecoderStream.read() != -1)
            ;

(needs minor change, fill order (the “1”) is no longer as parameter in your code)

Expected behavior An IOException

Sample file(s) crash-e835587b760ebc7e5a2edc3855d82c38637223c5.txt

“hot” part starts at offset 3404

Stak trace

(numbers not the same as in your code)

Exception in thread “main” java.lang.ArrayIndexOutOfBoundsException: 9 at org.apache.pdfbox.filter.CCITTFaxDecoderStream.decode2D(CCITTFaxDecoderStream.java:229) at org.apache.pdfbox.filter.CCITTFaxDecoderStream.decodeRowType6(CCITTFaxDecoderStream.java:336) at org.apache.pdfbox.filter.CCITTFaxDecoderStream.decodeRow(CCITTFaxDecoderStream.java:348) at org.apache.pdfbox.filter.CCITTFaxDecoderStream.fetch(CCITTFaxDecoderStream.java:155) at org.apache.pdfbox.filter.CCITTFaxDecoderStream.read(CCITTFaxDecoderStream.java:477)

The easiest thing to do would be to add something like this 3 times:

if (changesCurrentRowCount >= changesCurrentRow.length)
{
    throw new IOException("changesCurrentRowCount outside of bound");
}

[THausherr]

645.txt is probably a real CCITT stream modified by a fuzzer.

[THausherr]

645.txt

Smaller stream, with smaller code:

public static void main(String[] args) throws IOException
{
    InputStream is = new FileInputStream("645.txt");
    CCITTFaxDecoderStream ccittFaxDecoderStream = new CCITTFaxDecoderStream(is, 7, 4, 0, false);
    while (ccittFaxDecoderStream.read() != -1)
        ;
}