8295687: Better BMP bounds

Reviewed-by: yan
Backport-of: 4df2fd2d1ca8ed73de6ac8b2f6a51ff93e3dac6d

src/java.desktop/share/classes/com/sun/imageio/plugins/bmp/BMPImageReader.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -637,21 +637,16 @@ else if (size == 124)
                     staggeredReadByteStream(iis, profileSize);
             iis.reset();
 
-            try {
-                if (metadata.colorSpace == PROFILE_LINKED &&
-                    isLinkedProfileAllowed() &&
-                    !isUncOrDevicePath(profile))
-                {
-                    String path = new String(profile, "windows-1252");
+            if (metadata.colorSpace == PROFILE_LINKED &&
+                isLinkedProfileAllowed())
+            {
+                String path = new String(profile, "windows-1252");
 
-                    colorSpace =
-                        new ICC_ColorSpace(ICC_Profile.getInstance(path));
-                } else {
-                    colorSpace =
-                        new ICC_ColorSpace(ICC_Profile.getInstance(profile));
-                }
-            } catch (Exception e) {
-                colorSpace = ColorSpace.getInstance(ColorSpace.CS_sRGB);
+                colorSpace =
+                    new ICC_ColorSpace(ICC_Profile.getInstance(path));
+            } else if (metadata.colorSpace == PROFILE_EMBEDDED) {
+                colorSpace =
+                    new ICC_ColorSpace(ICC_Profile.getInstance(profile));
             }
         }
 
@@ -2040,69 +2035,18 @@ public void sequenceStarted(ImageReader src, int minIndex) {}
         public void readAborted(ImageReader src) {}
     }
 
-    private static Boolean isLinkedProfileDisabled = null;
+    private static Boolean isLinkedProfileAllowed = null;
 
     private static boolean isLinkedProfileAllowed() {
-        if (isLinkedProfileDisabled == null) {
-            PrivilegedAction<Boolean> a = new PrivilegedAction<Boolean>() {
-                public Boolean run() {
-                    return Boolean.getBoolean("sun.imageio.plugins.bmp.disableLinkedProfiles");
-                }
-            };
-            isLinkedProfileDisabled = AccessController.doPrivileged(a);
-        }
-        return !isLinkedProfileDisabled;
-    }
-
-    private static Boolean isWindowsPlatform = null;
-
-    /**
-     * Verifies whether the byte array contans a unc path.
-     * Non-UNC path examples:
-     *  c:\path\to\file  - simple notation
-     *  \\?\c:\path\to\file - long notation
-     *
-     * UNC path examples:
-     *  \\server\share - a UNC path in simple notation
-     *  \\?\UNC\server\share - a UNC path in long notation
-     *  \\.\some\device - a path to device.
-     */
-    private static boolean isUncOrDevicePath(byte[] p) {
-        if (isWindowsPlatform == null) {
+        if (isLinkedProfileAllowed == null) {
             PrivilegedAction<Boolean> a = new PrivilegedAction<Boolean>() {
                 public Boolean run() {
-                    String osname = System.getProperty("os.name");
-                    return (osname != null &&
-                            osname.toLowerCase().startsWith("win"));
+                    return Boolean.
+                        getBoolean("sun.imageio.bmp.enableLinkedProfiles");
                 }
             };
-            isWindowsPlatform = AccessController.doPrivileged(a);
-        }
-
-        if (!isWindowsPlatform) {
-            /* no need for the check on platforms except windows */
-            return false;
-        }
-
-        /* normalize prefix of the path */
-        if (p[0] == '/') p[0] = '\\';
-        if (p[1] == '/') p[1] = '\\';
-        if (p[3] == '/') p[3] = '\\';
-
-
-        if ((p[0] == '\\') && (p[1] == '\\')) {
-            if ((p[2] == '?') && (p[3] == '\\')) {
-                // long path: whether unc or local
-                return ((p[4] == 'U' || p[4] == 'u') &&
-                        (p[5] == 'N' || p[5] == 'n') &&
-                        (p[6] == 'C' || p[6] == 'c'));
-            } else {
-                // device path or short unc notation
-                return true;
-            }
-        } else {
-            return false;
+            isLinkedProfileAllowed = AccessController.doPrivileged(a);
         }
+        return isLinkedProfileAllowed;
     }
 }
-