[lgritz]

The OpenJPH HTJ2K path assumed every component is full resolution, pulling one full-width line per component for each image row. Subsampled components put it out of step with the decoder, and OpenJPH spins indefinitely in codestream::pull(). Found by the fuzzer.

Each component is now pulled at its own reconstructed size, and each sample is replicated over the full-resolution pixels it covers (the same nearest-sample mapping as the OpenJPEG path, but honoring the image offset). The image size comes from the image extent rather than from component 0, which is smaller when subsampled. OpenJPH's pull order is kept: color-transformed files are decoded interleaved, which requires every component to have the same subsampling, so unequal ones are rejected; other files are pulled component by component. Every pulled line is checked for the expected component and width.

A component that is empty despite a nonempty image (offset and extent rounding to the same sample) made pull() spin and is rejected from the header. A tile-component with no columns, from tiles narrower than the component's horizontal subsampling, crashes OpenJPH before 0.27.0, which added a zero-width guard to tile::pull; such files are rejected only when built against an older OpenJPH. Tile rows with no samples are skipped by every version. Keep in mind that our security policy basically doesn't recognize vulnerabilities that are only problems with old versions of dependencies.

The valid subsampled test fixtures come from a committed generator (make_subsampled_htj2k.cpp) that codes a known pattern losslessly, so the expected pixels can be checked independently of the reader; the empty-component fixture is patched by make_malformed_htj2k.py. They cover 4:2:0 at odd sizes, 10-bit, tiles with image and tile offsets, non-power-of-2 factors, a subsampled first component, color transforms with three and five components, four components with their own alpha subsampling, and tiles holding no rows or no columns of a component. The version-dependent outcomes have their own output file and refs.

Assisted-by: Claude Code / Claude Opus 5.5

[Copilot]

🟡 Changes recommended

The decoder can corrupt color-transformed images and hang on zero-height components, while offset and extent calculations lack targeted regression coverage.

3 open issues

• Reject zero-sized components before pulling scanlines · New
• Preserve interleaved reads for subsampled color-transformed codestreams · New
• Add coverage for subsampled components and nonaligned image offsets · New

What changed in this PR

This PR updates OpenImageIO’s OpenJPH decoder to handle subsampled HTJ2K components without hanging and reconstruct them at full image resolution.

Changes:

• Decode subsampled components in planar order and expand samples using offset-aware mapping.
• Derive image dimensions from the image extent rather than component 0.
• Add subsampling regression cases and document the decoder behavior.

File	Description
testsuite/​htj2k/​run.py	Adds valid subsampling cases and a corrupt-file hang regression.
testsuite/​htj2k/​ref/​out.txt	Records expected dimensions, pixel hashes, and completion output.
src/​jpeg2000.imageio/​jpeg2000input.cpp	Implements per-component decoding, sample expansion, and canvas sizing.
.agents/​skills/​oiio-input-security-audit/​references/​format-notes.md	Documents the subsampling fix and OpenJPEG fallback limitations.
.agents/​skills/​oiio-input-security-audit/​references/​bug-catalog.md	Records the component-size mismatch and its decoding consequences.

_{Review effort: Balanced}

[lgritz]

Addressed the copilot comments and pushed an amentment.

[Copilot]

🟡 Changes recommended

The column-map allocation can fail outside the scanline error handler, and the regression test can pass even when the decoder crashes.

2 open issues

• Handle column-map allocation failures as read errors · New
• Fail the test on abnormal decoder termination · New

3 resolved since last review

• Preserve interleaved reads for subsampled color-transformed codestreams
• Reject zero-sized components before pulling scanlines
• Add coverage for subsampled components and nonaligned image offsets

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The tile-layout check incorrectly rejects valid nonempty layouts with more than two tiles when the tile size is smaller than the subsampling factor.

1 open issue

• Rejects valid layouts when tile size is smaller than subsampling · New

2 resolved since last review

• Fail the test on abnormal decoder termination
• Handle column-map allocation failures as read errors

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The regressions lack coverage for MCT files with five or more components, and the corrupt-fixture test can mask decoder crashes by hiding the exit status and forcing success.

2 open issues

• Add regression coverage for five or more interleaved components · New
• Check decoder exit status separately from filtering its output · New

1 resolved since last review

• Rejects valid layouts when tile size is smaller than subsampling

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are reported for the subsampled HTJ2K decoding fix.

No open issues 🎉

2 resolved since last review

• Check decoder exit status separately from filtering its output
• Add regression coverage for five or more interleaved components

_{Review effort: Balanced}

[lgritz]

Any final objections on this?

[lgritz]

No objections, cleared multiple rounds of tedious robot reviews. Merging.