Yalantis/uCrop · error · CImgIOException

load_bmp(): Invalid header size %d specified in filename '%s

Error message

load_bmp(): Invalid header size %d specified in filename '%s'.

What it means

The BMP's header_size field (bytes 0x0E-0x11) is negative or not smaller than the file size, which is impossible for a valid BMP, so load_bmp() throws CImgIOException. It is a sanity check on the DIB header size before reading dimensions and pixel offset.

Source

Thrown at ucrop/src/main/jni/CImg.h:56808

      // Read header and pixel buffer.
      int
        file_size = header[0x02] + (header[0x03]<<8) + (header[0x04]<<16) + (header[0x05]<<24),
        offset = header[0x0A] + (header[0x0B]<<8) + (header[0x0C]<<16) + (header[0x0D]<<24),
        header_size = header[0x0E] + (header[0x0F]<<8) + (header[0x10]<<16) + (header[0x11]<<24),
        dx = header[0x12] + (header[0x13]<<8) + (header[0x14]<<16) + (header[0x15]<<24),
        dy = header[0x16] + (header[0x17]<<8) + (header[0x18]<<16) + (header[0x19]<<24),
        compression = header[0x1E] + (header[0x1F]<<8) + (header[0x20]<<16) + (header[0x21]<<24),
        nb_colors = header[0x2E] + (header[0x2F]<<8) + (header[0x30]<<16) + (header[0x31]<<24),
        bpp = header[0x1C] + (header[0x1D]<<8);

      if ((ulongT)file_size!=fsiz)
        throw CImgIOException(_cimg_instance
                              "load_bmp(): Invalid file_size %d specified in filename '%s' (expected %lu).",
                              cimg_instance,
                              file_size,filename?filename:"(FILE*)",fsiz);

      if (header_size<0 || header_size>=file_size)
        throw CImgIOException(_cimg_instance
                              "load_bmp(): Invalid header size %d specified in filename '%s'.",
                              cimg_instance,
                              header_size,filename?filename:"(FILE*)");

      if (offset<0 || offset>=file_size)
        throw CImgIOException(_cimg_instance
                              "load_bmp(): Invalid offset %d specified in filename '%s'.",
                              cimg_instance,
                              offset,filename?filename:"(FILE*)");

      if (header_size>40) cimg::fseek(nfile,header_size - 40,SEEK_CUR);
      const int
        dx_bytes = (bpp==1)?(dx/8 + (dx%8?1:0)):((bpp==4)?(dx/2 + (dx%2)):(int)((longT)dx*bpp/8)),
        align_bytes = (4 - dx_bytes%4)%4;
      const ulongT
        cimg_iobuffer = (ulongT)24*1024*1024,
        buf_size = (ulongT)cimg::abs(dy)*(dx_bytes + align_bytes);

View on GitHub (pinned to f788b534b4)

Solutions

  1. Re-save the BMP with a standard tool so the DIB header size is 40 (BITMAPINFOHEADER) or 124 (BITMAPV5).
  2. Validate bytes 0x0E-0x11 encode a sane header size (>=12 and < file_size) before loading.
  3. Use a tolerant platform decoder and re-encode to a clean BMP.
  4. Treat the file as corrupt: re-export from the original source.

Example fix

// before
img.load_bmp(path); // header_size garbage
// after
if (!bmpHeaderSizeSane(path)) reencodeToBmp(path, cleanPath);
img.load_bmp(cleanPath);
Defensive patterns

Strategy: try-catch

Validate before calling

bool bmpHeaderSizeSane(const char* p){ std::ifstream f(p,std::ios::binary); unsigned char h[0x12]={0}; f.read((char*)h,0x12); int32_t hs=h[0xE]|(h[0xF]<<8)|(h[0x10]<<16)|((int32_t)h[0x11]<<24); std::ifstream e(p,std::ios::binary|std::ios::ate); int64_t sz=e.tellg(); return hs>=12 && hs<sz; }

Try / catch

try { img.load_bmp(path); } catch (cimg_library::CImgIOException& e) { /* corrupt DIB header: transcode via tolerant decoder */ }

Prevention

When it happens

Trigger: Loading a BMP with a corrupted or maliciously/erroneously written header_size — e.g. wrong endianness when written, header bytes overwritten, or a non-BMP file that passed the 'BM' magic check by chance.

Common situations: Files produced by buggy custom BMP encoders; files that were partially overwritten; hand-crafted or fuzzed inputs in image-processing pipelines.

Related errors

AI-assisted analysis of Yalantis/uCrop@f788b534b4 (2026-09-08). Data as JSON: /api/errors/f2ed50c880ba5394. Report an issue: GitHub.