8295687: Better BMP bounds

Reviewed-by: rhalade, mschoene, psadhukhan, prr

src/java.desktop/share/classes/com/sun/imageio/plugins/bmp/BMPImageReader.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -634,22 +634,17 @@ public class BMPImageReader extends ImageReader implements BMPConstants {
                     staggeredReadByteStream(iis, profileSize);
             iis.reset();
 
-            try {
             if (metadata.colorSpace == PROFILE_LINKED &&
-                    isLinkedProfileAllowed() &&
+                isLinkedProfileAllowed())
-                    !isUncOrDevicePath(profile))
             {
                 String path = new String(profile, "windows-1252");
 
                 colorSpace =
                     new ICC_ColorSpace(ICC_Profile.getInstance(path));
-                } else {
+            } else if (metadata.colorSpace == PROFILE_EMBEDDED) {
                 colorSpace =
                     new ICC_ColorSpace(ICC_Profile.getInstance(profile));
             }
-            } catch (Exception e) {
-                colorSpace = ColorSpace.getInstance(ColorSpace.CS_sRGB);
-            }
         }
 
         if (bitsPerPixel == 0 ||
@@ -2063,73 +2058,20 @@ public class BMPImageReader extends ImageReader implements BMPConstants {
         public void readAborted(ImageReader src) {}
     }
 
-    private static Boolean isLinkedProfileDisabled = null;
+    private static Boolean isLinkedProfileAllowed = null;
 
     @SuppressWarnings("removal")
     private static boolean isLinkedProfileAllowed() {
-        if (isLinkedProfileDisabled == null) {
+        if (isLinkedProfileAllowed == null) {
             PrivilegedAction<Boolean> a = new PrivilegedAction<Boolean>() {
                 @Override
                 public Boolean run() {
-                    return Boolean.getBoolean("sun.imageio.plugins.bmp.disableLinkedProfiles");
+                    return Boolean.
+                        getBoolean("sun.imageio.bmp.enableLinkedProfiles");
                 }
             };
-            isLinkedProfileDisabled = AccessController.doPrivileged(a);
+            isLinkedProfileAllowed = AccessController.doPrivileged(a);
-        }
-        return !isLinkedProfileDisabled;
-    }
-
-    private static Boolean isWindowsPlatform = null;
-
-    /**
-     * Verifies whether the byte array contains a unc path.
-     * Non-UNC path examples:
-     *  c:\path\to\file  - simple notation
-     *  \\?\c:\path\to\file - long notation
-     *
-     * UNC path examples:
-     *  \\server\share - a UNC path in simple notation
-     *  \\?\UNC\server\share - a UNC path in long notation
-     *  \\.\some\device - a path to device.
-     */
-    @SuppressWarnings("removal")
-    private static boolean isUncOrDevicePath(byte[] p) {
-        if (isWindowsPlatform == null) {
-            PrivilegedAction<Boolean> a = new PrivilegedAction<Boolean>() {
-                @Override
-                public Boolean run() {
-                    String osname = System.getProperty("os.name");
-                    return (osname != null &&
-                            osname.toLowerCase().startsWith("win"));
-                }
-            };
-            isWindowsPlatform = AccessController.doPrivileged(a);
-        }
-
-        if (!isWindowsPlatform) {
-            /* no need for the check on platforms except windows */
-            return false;
-        }
-
-        /* normalize prefix of the path */
-        if (p[0] == '/') p[0] = '\\';
-        if (p[1] == '/') p[1] = '\\';
-        if (p[3] == '/') p[3] = '\\';
-
-
-        if ((p[0] == '\\') && (p[1] == '\\')) {
-            if ((p[2] == '?') && (p[3] == '\\')) {
-                // long path: whether unc or local
-                return ((p[4] == 'U' || p[4] == 'u') &&
-                        (p[5] == 'N' || p[5] == 'n') &&
-                        (p[6] == 'C' || p[6] == 'c'));
-            } else {
-                // device path or short unc notation
-                return true;
-            }
-        } else {
-            return false;
         }
+        return isLinkedProfileAllowed;
     }
 }
-