reject out-of-range palette register in iff multipalette color map

[arib06]

What is fixed No open issue; hardening the IFF multipalette reader against a crafted PCHG chunk.

Why is this change proposed MutableIndexColorModel.adjustColorMap validates palette change registers only against the upper bound (index >= rgbs.length) before writing rgbs[index], so a negative register slips through and writes out of bounds. ILBM PCHG BigLineChanges read a 32-bit register straight from the stream with a signed toShort, so a register like 0xfffe becomes -2 and reaches adjustColorMap through getColorModel/colorMapForRow while rendering, throwing ArrayIndexOutOfBoundsException out of ImageIO.read on a crafted IFF.

What is changed

• Reject registers below zero as well as above rgbs.length at the existing validation point, matching the current warn-and-ignore behaviour for out-of-range registers.
• Keep the MP_REG_IGNORE sentinel silently skipped so valid multipalette decoding is unchanged.
• Added PCHGChunkTest covering a negative register (ignored) and an in-range register (applied).

[haraldk]

Thanks! Appreciate your fixes!

In this case it does fix the very specific issue of negative indexes. 👍🏻

However, I think it would provide a lot more value if we could also fix the issue as in the comment:

// TODO: Move validation to chunk (when reading)

Would you like to look into that as well?

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud