Mercurial > hg > release > icedtea7-forest-2.1 > jdk

changeset 3986:d1ec8c106dda

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
7030147: java.awt.image.SampleModel.setDataElements() does't throw ArrayIndexOutOfBoundsEx for Integer.MAX_VA Reviewed-by: jgodinez, prr
author bae
date Tue, 29 Mar 2011 13:10:09 +0400
parents 0f7256505703
children 5a0c0ae1c85b
files src/share/classes/java/awt/image/SampleModel.java
diffstat 1 files changed, 21 insertions(+), 12 deletions(-) [+]
line wrap: on
line diff
--- a/src/share/classes/java/awt/image/SampleModel.java	Sun Mar 27 15:51:44 2011 +0400
+++ b/src/share/classes/java/awt/image/SampleModel.java	Tue Mar 29 13:10:09 2011 +0400
@@ -361,8 +361,8 @@
         int x1 = x + w;
         int y1 = y + h;
 
-        if (x < 0 || x1 < x || x1 > width ||
-            y < 0 || y1 < y || y1 > height)
+        if (x < 0 || x >= width || w > width || x1 < 0 || x1 > width ||
+            y < 0 || y >= height || h > height || y1 < 0 || y1 > height)
         {
             throw new ArrayIndexOutOfBoundsException("Invalid coordinates.");
         }
@@ -588,6 +588,15 @@
         int type = getTransferType();
         int numDataElems = getNumDataElements();
 
+        int x1 = x + w;
+        int y1 = y + h;
+
+        if (x < 0 || x >= width || w > width || x1 < 0 || x1 > width ||
+            y < 0 || y >= height || h > height || y1 < 0 || y1 > height)
+        {
+            throw new ArrayIndexOutOfBoundsException("Invalid coordinates.");
+        }
+
         switch(type) {
 
         case DataBuffer.TYPE_BYTE:
@@ -595,8 +604,8 @@
             byte[] barray = (byte[])obj;
             byte[] btemp = new byte[numDataElems];
 
-            for (int i=y; i<y+h; i++) {
-                for (int j=x; j<x+w; j++) {
+            for (int i=y; i<y1; i++) {
+                for (int j=x; j<x1; j++) {
                     for (int k=0; k<numDataElems; k++) {
                         btemp[k] = barray[cnt++];
                     }
@@ -612,8 +621,8 @@
             short[] sarray = (short[])obj;
             short[] stemp = new short[numDataElems];
 
-            for (int i=y; i<y+h; i++) {
-                for (int j=x; j<x+w; j++) {
+            for (int i=y; i<y1; i++) {
+                for (int j=x; j<x1; j++) {
                     for (int k=0; k<numDataElems; k++) {
                         stemp[k] = sarray[cnt++];
                     }
@@ -628,8 +637,8 @@
             int[] iArray = (int[])obj;
             int[] itemp = new int[numDataElems];
 
-            for (int i=y; i<y+h; i++) {
-                for (int j=x; j<x+w; j++) {
+            for (int i=y; i<y1; i++) {
+                for (int j=x; j<x1; j++) {
                     for (int k=0; k<numDataElems; k++) {
                         itemp[k] = iArray[cnt++];
                     }
@@ -644,8 +653,8 @@
             float[] fArray = (float[])obj;
             float[] ftemp = new float[numDataElems];
 
-            for (int i=y; i<y+h; i++) {
-                for (int j=x; j<x+w; j++) {
+            for (int i=y; i<y1; i++) {
+                for (int j=x; j<x1; j++) {
                     for (int k=0; k<numDataElems; k++) {
                         ftemp[k] = fArray[cnt++];
                     }
@@ -660,8 +669,8 @@
             double[] dArray = (double[])obj;
             double[] dtemp = new double[numDataElems];
 
-            for (int i=y; i<y+h; i++) {
-                for (int j=x; j<x+w; j++) {
+            for (int i=y; i<y1; i++) {
+                for (int j=x; j<x1; j++) {
                     for (int k=0; k<numDataElems; k++) {
                         dtemp[k] = dArray[cnt++];
                     }