From 4abfb8cadbfdd64cd2582ce9f68dac9ce567fa1f Mon Sep 17 00:00:00 2001
From: Oliver Schmidtmer <O.Schmidtmer@elo.com>
Date: Mon, 11 May 2020 15:48:08 +0200
Subject: [PATCH] Skip to the image offset instead of firing an exception

---
 src/net/sf/image4j/codec/ico/ICODecoder.java  |   3 +++
 .../image4j/io/LittleEndianInputStream.java   |   9 ++++++--
 test/net/sf/image4j/254.ico                   | Bin 0 -> 1485 bytes
 test/net/sf/image4j/ICODecoderTest.java       |  20 ++++++++++++++++++
 4 files changed, 30 insertions(+), 2 deletions(-)
 create mode 100644 test/net/sf/image4j/254.ico
 create mode 100644 test/net/sf/image4j/ICODecoderTest.java

diff --git a/src/net/sf/image4j/codec/ico/ICODecoder.java b/src/net/sf/image4j/codec/ico/ICODecoder.java
index fe1a29d..700bb6d 100644
--- a/src/net/sf/image4j/codec/ico/ICODecoder.java
+++ b/src/net/sf/image4j/codec/ico/ICODecoder.java
@@ -167,6 +167,9 @@ public static java.util.List<ICOImage> readExt(java.io.InputStream is)
 		try {
 			for (i = 0; i < sCount; i++) {
 				// Make sure we're at the right file offset!
+				while (in.getCount() < entries[i].iFileOffset) {
+					in.skip(entries[i].iFileOffset - in.getCount(), false);
+				}
 				int fileOffset = in.getCount();
 				if (fileOffset != entries[i].iFileOffset) {
 					throw new IOException("Cannot read image #" + i
diff --git a/src/net/sf/image4j/io/LittleEndianInputStream.java b/src/net/sf/image4j/io/LittleEndianInputStream.java
index 70f5839..d1630c2 100644
--- a/src/net/sf/image4j/io/LittleEndianInputStream.java
+++ b/src/net/sf/image4j/io/LittleEndianInputStream.java
@@ -31,8 +31,13 @@ public int getCount() {
 	  return ((CountingInputStream) in).getCount();
   }
   
-  public int skip(int count, boolean strict) throws IOException {
-	  return IOUtils.skip(this, count, strict);
+  @Override
+  public long skip( long n ) throws IOException {
+    return skip( ( int )n, false );
+  }
+  
+  public int skip( int count, boolean strict ) throws IOException {
+	  return IOUtils.skip( this, count, strict );
   }
   
   /**
diff --git a/test/net/sf/image4j/254.ico b/test/net/sf/image4j/254.ico
new file mode 100644
index 0000000000000000000000000000000000000000..18fa3107152ab2d6402d0beb9fb0308a952cce9d
GIT binary patch
literal 1485
zcmZQzU}Rup5D;Jh(h3Z93=9lyKrA5v;qL;nSr{1@6cix*H9-D8Am6|M!ha0pXE8A_
zI5<G~|A2g7W(J0Y1PH$gsMebWC`bTw2Kc%2a!GLkmGOFdxC8-dpo<s;IM{%s{OA9P
zK+4tA#WAEJE;*s0>095r|12M>70en|9%oQ+{c&K|SLqMZPA3``AMbx`-Xg*LLCR?j
z<B7HjDGXK&E9FfSt}xt^aL{6V$;@y-=-l+>9Y()_1~PcM`njxgN@&7jJJA0O5@6dO
zl-vFQavEW_J21VKjs1V}0OyIc2doOb-qUse*Z(*Xxah+Z&0x>XEK4MoOpGY_@FDS%
zj^foOpnE2#aaxK^Na5TmCXmaiDweQOh2d_^B;ATHKMdLSmH)Rp)5KQt*>f9%xWv{5
z1r!{??XmJpVd5UK0KsNm28L<r;R`+a7jhGDxdKpL0qpYPs;VzQPBFygZ_gd%Y;X`@
zKJYqjBd2x1><QZ5@#XyrFLF2WD>nX__GSvx%x6!9N{-$=Un$XT)|SD1G3WO|#fSru
z+U)@h8ZBG`ZW@e=Em8(OCm47XH!*Y^*l(-zK$lG-p@9)X{9&IE`{#CZdt~nay!Fpj
z>q^BR#1L>RFcmQvfZZC-^s^nvSp{|LHAB882NBo6X{Y!MavUCsP1(9)uA-ri_gt3Q
zD?RSjf7X2G8)s>-eD*r!Po{H@z1-ekSo`<<g*M)TdYi-L^YrSD$Uk_oRi~~+_(NQ{
z{UP2B%25n!I>H#F7pWd-%HZX2PhoHpjBGG)QCr}4rTq3(;SJkAy<wOj$-t1rz|aBA
z2y6@uz!ZSQX(-xJqmq67_8R8C4ZreS9BUb?_nXw-St?{lz>5w*c?Yl;S7jF719FZ+
zy?DWqi^-6u?c&ajk6L3^s!z0>wvL5UZ;8R#_zL-y+iLl@RbKY{JwLs=a9!#AmwzL&
zzI{=u5u17U?Y|QaFPJLcRkJy%JFqyJJ6Jn0IcPg^IY>JRIdD5k9VlsWX;{gzlHszz
zB*tY5OPFQ)HZUDn$g!Fsq^0V3K`g^!V3ve{E7onmtO^EK>XTqhh85*J>`>tq|Brw&
zAOk}mLqzT?*~3@c!)I2ttJHpHE1J6Q(rc5~H$jqkvQYw1IsxqaM>EPTfMtRw)b|%R
z@;Vs`umpN72o|tqoVq|hNa%xWla4yewTkn`myTWgDa)4z1mDt^e|{>u>v{U|Z}WCo
zwX5pNFDwqZwMnq9-}7bF?(2>oEEPG?vMnJEMjR&@R0S?EJ`&Voa8V9n>~LMdBG4JY
ztH8HV$w9;^v_Ycf6oVkgRmNrR5sV30Eujp{Tq8IWyjrd@EOU+!Ot^2tv6|`4Y^KE2
zhFaT}Z~blCtPboGTljbJLRF?74+aay2P_T341NQ_$m3%89{bzfIa|J*=|T4Y6K8;+
UYA@rwi5@)Rf*(qNAq<ZJ09$0!SO5S3

literal 0
HcmV?d00001

diff --git a/test/net/sf/image4j/ICODecoderTest.java b/test/net/sf/image4j/ICODecoderTest.java
new file mode 100644
index 0000000..98be10e
--- /dev/null
+++ b/test/net/sf/image4j/ICODecoderTest.java
@@ -0,0 +1,20 @@
+package net.sf.image4j;
+
+import java.io.IOException;
+import java.io.InputStream;
+
+import org.junit.Test;
+
+import net.sf.image4j.codec.ico.ICODecoder;
+
+public class ICODecoderTest {
+
+	@Test
+	public void checkSkipOnTooLongLayerDefinition() throws IOException {
+		// The image header is some bytes after the last layer definition, so the offset is higher than the current position
+		try(InputStream icon = ICODecoderTest.class.getResourceAsStream("254.ico")){
+			ICODecoder.read(icon);
+		}
+	}
+
+}