CVE-2026-102834

### Summary `IPCameraFrameGrabber` parses the `Content-Length` value from the multipart MJPEG HTTP stream returned by the configured IP camera without any bounds checking. A malicious or compromised camera endpoint - or any network attacker able to tamper with the plaintext HTTP response (these streams are conventionally accessed over `http://`, as documented in the class itself) - can supply a `Content-Length` value in the range `1073741825`-`2147483647`. This drives the internal buffer-growth routine `ensureBufferCapacity(int)` into 32-bit signed integer overflow, which turns the "grow the buffer" loop into a true infinite loop: the loop variable oscillates to `0` and never again satisfies the loop's exit condition. The thread that called `grab()`/`grabBufferedImage()` spins at 100% CPU forever and never returns, permanently hanging the calling application's frame-grabbing thread with no exception, timeout, or interrupt path available to the caller. ### Details File: `src/main/java/org/bytedeco/javacv/IPCameraFrameGrabber.java` ```java private byte[] readImage() throws IOException { ... int c0 = subheader.indexOf("content-length: "); final int c1 = subheader.indexOf('\r', c0); if (c0 < 0) { throw new EOFException("The camera stream ended unexpectedly"); } c0 += 16; final int contentLength = Integer.parseInt(subheader.substring(c0, c1).trim()); // <-- fully attacker-controlled // adaptive size - careful - don't want a 2G jpeg ensureBufferCapacity(contentLength); // <-- no upper bound enforced input.readFully(pixelBuffer, 0, contentLength); ... } private void ensureBufferCapacity(int desiredCapacity) { int capacity = pixelBuffer.length; // starts at 1024 while (capacity < desiredCapacity) { capacity *= 2; // <-- unchecked int multiplication } if (capacity > pixelBuffer.length) { pixelBuffer = new byte