8066904: NullPointerException when calling ImageIO.read(InputStream) with corrupt BMP

Reviewed-by: serb, prr

jdk/src/java.desktop/share/classes/com/sun/imageio/plugins/bmp/BMPImageReader.java

@@ -290,6 +290,8 @@ public class BMPImageReader extends ImageReader implements BMPConstants {
                 imageType = VERSION_2_8_BIT;
             } else if (bitsPerPixel == 24) {
                 imageType = VERSION_2_24_BIT;
+            } else {
+                throw new IIOException(I18N.getString("BMPImageReader8"));
             }
 
             // Read in the palette
@@ -364,6 +366,9 @@ public class BMPImageReader extends ImageReader implements BMPConstants {
                         metadata.redMask = redMask;
                         metadata.greenMask = greenMask;
                         metadata.blueMask = blueMask;
+                    } else {
+                        throw new
+                            IIOException(I18N.getString("BMPImageReader8"));
                     }
 
                     metadata.bmpVersion = VERSION_3;
@@ -375,6 +380,9 @@ public class BMPImageReader extends ImageReader implements BMPConstants {
                         imageType = VERSION_3_NT_16_BIT;
                     } else if (bitsPerPixel == 32) {
                         imageType = VERSION_3_NT_32_BIT;
+                    } else {
+                        throw new
+                            IIOException(I18N.getString("BMPImageReader8"));
                     }
 
                     // BitsField encoding
@@ -493,6 +501,9 @@ public class BMPImageReader extends ImageReader implements BMPConstants {
                             greenMask = 0x0000FF00;
                             blueMask  = 0x000000FF;
                         }
+                    } else {
+                        throw new
+                            IIOException(I18N.getString("BMPImageReader8"));
                     }
 
                     metadata.redMask = redMask;

jdk/src/java.desktop/share/classes/com/sun/imageio/plugins/common/iio-plugin.properties

@@ -23,6 +23,7 @@ BMPImageReader4=No ImageIO-style reader is found for
 BMPImageReader5=Input has not been set.
 BMPImageReader6=Unable to read the image header.
 BMPImageReader7=Invalid bitmap offset.
+BMPImageReader8=Invalid bits per pixel in image header.
 BMPImageWriter0=Output is not an ImageOutputStream.
 BMPImageWriter1=The image region to be encoded is empty.
 BMPImageWriter2=Only 1 or 3 band image is encoded.

jdk/test/javax/imageio/plugins/bmp/Bug8066904.java

@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * @test
+ * @bug     8066904
+ * @summary Test verifies whether Bits per Pixel in BMP
+ *          Header is corrupted or not
+ * @run     main Bug8066904
+ */
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import javax.imageio.ImageIO;
+
+public class Bug8066904 {
+
+    public static void main(String[] args) throws IOException {
+        // corrupted byte array with improper Bits per pixel in header
+        byte[] corruptedBmp = { (byte) 0x42, (byte) 0x4d, (byte) 0x7e,
+                (byte) 0x06, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+                (byte) 0x00, (byte) 0x00, (byte) 0x3e, (byte) 0x00, (byte) 0x00,
+                (byte) 0x00, (byte) 0x28, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+                (byte) 0x64, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x64,
+                (byte) 0x00, (byte) 0x40, (byte) 0x06, (byte) 0x00, (byte) 0x00,
+                (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+                (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+                (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+                (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
+                (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0x00, (byte) 0xff,
+                (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+                (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff,
+                (byte) 0xff };
+
+        /** if IOException is caught then test will
+         * pass otherwise throws a different exception.
+         */
+        try {
+            ImageIO.read(new ByteArrayInputStream(corruptedBmp));
+        } catch(Exception ex) {
+            if (!(ex instanceof IOException))
+                throw ex;
+        }
+    }
+}