From 7f129804e396958ae762da288da5df330d142da0 Mon Sep 17 00:00:00 2001 From: jmestwa-coder Date: Fri, 26 Jun 2026 21:20:33 +0530 Subject: reject negative and overflowing crop in core LuminanceSource classes (#2112) the crop constructors in PlanarYUVLuminanceSource and GrayscaleLuminanceSource did not reject negative offsets or sizes and overflowed when checking left+width and top+height, letting an out-of-bounds crop reach getRow and getMatrix; validate the rectangle the same way as BufferedImageLuminanceSource. --- core/src/main/java/com/google/zxing/GrayscaleLuminanceSource.java | 3 ++- core/src/main/java/com/google/zxing/PlanarYUVLuminanceSource.java | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) (limited to 'core/src/main/java/com') diff --git a/core/src/main/java/com/google/zxing/GrayscaleLuminanceSource.java b/core/src/main/java/com/google/zxing/GrayscaleLuminanceSource.java index 7941bad81..3afa20bcf 100644 --- a/core/src/main/java/com/google/zxing/GrayscaleLuminanceSource.java +++ b/core/src/main/java/com/google/zxing/GrayscaleLuminanceSource.java @@ -48,7 +48,8 @@ public class GrayscaleLuminanceSource extends LuminanceSource { int width, int height) { super(width, height); - if (left + width > dataWidth || top + height > dataHeight) { + if (left < 0 || top < 0 || width < 0 || height < 0 || + width > dataWidth - left || height > dataHeight - top) { throw new IllegalArgumentException("Crop rectangle does not fit within image data."); } this.luminances = pixels; diff --git a/core/src/main/java/com/google/zxing/PlanarYUVLuminanceSource.java b/core/src/main/java/com/google/zxing/PlanarYUVLuminanceSource.java index cecff3efa..b94ebe6e5 100644 --- a/core/src/main/java/com/google/zxing/PlanarYUVLuminanceSource.java +++ b/core/src/main/java/com/google/zxing/PlanarYUVLuminanceSource.java @@ -46,7 +46,8 @@ public final class PlanarYUVLuminanceSource extends LuminanceSource { boolean reverseHorizontal) { super(width, height); - if (left + width > dataWidth || top + height > dataHeight) { + if (left < 0 || top < 0 || width < 0 || height < 0 || + width > dataWidth - left || height > dataHeight - top) { throw new IllegalArgumentException("Crop rectangle does not fit within image data."); } -- cgit v1.2.3