Negative dataLength when reading certain JP2 files

[Ruufuus]

Hello,
We are experiencing some issues with processing certain JP2 files using cantaloupe server (version 5.0.5) with grok processor (Tested on both 10.0.8 and 11). We tried opening same image with IIP server with same grok processor and that image worked so we are afraid that there is some issue with cantaloupe server itself.
From our investigation every image that is breaking contain phrase "kakadu-v7.7" in metadata JPEG2000 section.

After investigation of images itself We decided to look into cantaloupe code. We found that integer box length read inside JPEG2000MetadataReader (291 line) class is negative what makes cantaloupe fail request duo to java exception.

You can find example images on linked gdrive (3 are breaking cantaloupe and 1 is working properly - names are self-explanatory).

Bellow I will attach some logs and stack trace regarding those issues.
Thank you in advance for your help!

Cantaloupe application log:
2023-12-07 14:48:11,511 INFO [qtp696933920-28] e.i.l.c.r.i.v.InformationResource [AbstractResource.java:156] Handling GET /iiif/2/test_file!!sllash!!test.jp2/info.json
2023-12-07 14:48:11,551 INFO [qtp696933920-28] e.i.l.c.r.ErrorResource [AbstractResource.java:156] Handling GET /iiif/2/test_file!!sllash!!test.jp2/info.json
2023-12-07 14:48:11,753 INFO [qtp696933920-26] e.i.l.c.r.ErrorResource [AbstractResource.java:156] Handling GET /favicon.ico

Stack trace of issue:
pos < flushedPos!

java.lang.IndexOutOfBoundsException: pos < flushedPos!
at java.desktop/javax.imageio.stream.FileImageInputStream.seek(FileImageInputStream.java:143)
at edu.illinois.library.cantaloupe.source.stream.BufferedImageInputStream.seek(BufferedImageInputStream.java:120)
at java.desktop/javax.imageio.stream.ImageInputStreamImpl.skipBytes(ImageInputStreamImpl.java:759)
at edu.illinois.library.cantaloupe.processor.codec.jpeg2000.JPEG2000MetadataReader.skipBox(JPEG2000MetadataReader.java:316)
at edu.illinois.library.cantaloupe.processor.codec.jpeg2000.JPEG2000MetadataReader.readBox(JPEG2000MetadataReader.java:310)
at edu.illinois.library.cantaloupe.processor.codec.jpeg2000.JPEG2000MetadataReader.readData(JPEG2000MetadataReader.java:282)
at edu.illinois.library.cantaloupe.processor.codec.jpeg2000.JPEG2000MetadataReader.getEXIF(JPEG2000MetadataReader.java:174)
at edu.illinois.library.cantaloupe.processor.GrokProcessor.readInfo(GrokProcessor.java:346)
at edu.illinois.library.cantaloupe.cache.InfoService.readInfo(InfoService.java:220)
at edu.illinois.library.cantaloupe.cache.InfoService.getOrReadInfo(InfoService.java:153)
at edu.illinois.library.cantaloupe.cache.CacheFacade.getOrReadInfo(CacheFacade.java:67)
at edu.illinois.library.cantaloupe.resource.AbstractRequestHandler.getOrReadInfo(AbstractRequestHandler.java:39)
at edu.illinois.library.cantaloupe.resource.InformationRequestHandler.handle(InformationRequestHandler.java:287)
at edu.illinois.library.cantaloupe.resource.iiif.v2.InformationResource.doGET(InformationResource.java:85)
at edu.illinois.library.cantaloupe.resource.HandlerServlet.handle(HandlerServlet.java:97)
at edu.illinois.library.cantaloupe.resource.HandlerServlet.doGet(HandlerServlet.java:35)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:687)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:791)
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:550)
at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233)
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1434)
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188)
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:501)
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186)
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1349)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
at org.eclipse.jetty.server.Server.handle(Server.java:516)
at org.eclipse.jetty.server.HttpChannel.lambda(HttpChannel.java:383)
at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:556)
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:375)
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:273)
at org.eclipse.jetty.io.AbstractConnection.succeeded(AbstractConnection.java:311)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)
at org.eclipse.jetty.io.ChannelEndPoint.run(ChannelEndPoint.java:104)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:336)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:313)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:171)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:129)
at org.eclipse.jetty.util.thread.ReservedThreadExecutor.run(ReservedThreadExecutor.java:375)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:773)
at org.eclipse.jetty.util.thread.QueuedThreadPool.run(QueuedThreadPool.java:905)
at java.base/java.lang.Thread.run(Thread.java:829)