diff --git a/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c b/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c index 70b146401e3..85476f0f2e6 100644 --- a/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c +++ b/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c @@ -1132,6 +1132,10 @@ imageio_skip_input_data(j_decompress_ptr cinfo, long num_bytes) return; } num_bytes += sb->remaining_skip; + // Check for overflow if remaining_skip value is too large + if (num_bytes < 0) { + return; + } sb->remaining_skip = 0; /* First the easy case where we are skipping <= the current contents. */ diff --git a/src/java.desktop/share/native/libjavajpeg/jpegdecoder.c b/src/java.desktop/share/native/libjavajpeg/jpegdecoder.c index 918149327f4..a01a6bbd58e 100644 --- a/src/java.desktop/share/native/libjavajpeg/jpegdecoder.c +++ b/src/java.desktop/share/native/libjavajpeg/jpegdecoder.c @@ -406,6 +406,10 @@ sun_jpeg_skip_input_data(j_decompress_ptr cinfo, long num_bytes) return; } num_bytes += src->remaining_skip; + // Check for overflow if remaining_skip value is too large + if (num_bytes < 0) { + return; + } src->remaining_skip = 0; ret = (int)src->pub.bytes_in_buffer; /* this conversion is safe, because capacity of the buffer is limited by jnit */ if (ret >= num_bytes) {