Author: fanningpj
Date: Fri Jun 5 13:29:48 2026
New Revision: 1935030
Log:
[XMLBeans-666] XsTypeConverter: Fix out-of-bounds read in lexFloat for
single-character input. This closes #35
Modified:
xmlbeans/trunk/src/main/java/org/apache/xmlbeans/impl/util/XsTypeConverter.java
xmlbeans/trunk/src/test/java/misc/checkin/XsTypeConverterTest.java
Modified:
xmlbeans/trunk/src/main/java/org/apache/xmlbeans/impl/util/XsTypeConverter.java
==============================================================================
---
xmlbeans/trunk/src/main/java/org/apache/xmlbeans/impl/util/XsTypeConverter.java
Fri Jun 5 13:18:49 2026 (r1935029)
+++
xmlbeans/trunk/src/main/java/org/apache/xmlbeans/impl/util/XsTypeConverter.java
Fri Jun 5 13:29:48 2026 (r1935030)
@@ -48,12 +48,10 @@ public final class XsTypeConverter {
//current jdk impl of parseFloat calls trim() on the string.
//Any other space is illegal anyway, whether there are one or more
spaces.
//so no need to do a collapse pass through the string.
- if (cs.length() > 0) {
+ if (cs.length() > 1) {
char ch = cs.charAt(cs.length() - 1);
- if (ch == 'f' || ch == 'F') {
- if (cs.charAt(cs.length() - 2) != 'N') {
- throw new NumberFormatException("Invalid char '" + ch
+ "' in float.");
- }
+ if ((ch == 'f' || ch == 'F') && cs.charAt(cs.length() - 2) !=
'N') {
+ throw new NumberFormatException("Invalid char '" + ch + "'
in float.");
}
}
return Float.parseFloat(v);
@@ -678,4 +676,4 @@ public final class XsTypeConverter {
return lexical_value;
}
-}
\ No newline at end of file
+}
Modified: xmlbeans/trunk/src/test/java/misc/checkin/XsTypeConverterTest.java
==============================================================================
--- xmlbeans/trunk/src/test/java/misc/checkin/XsTypeConverterTest.java Fri Jun
5 13:18:49 2026 (r1935029)
+++ xmlbeans/trunk/src/test/java/misc/checkin/XsTypeConverterTest.java Fri Jun
5 13:29:48 2026 (r1935030)
@@ -55,4 +55,25 @@ public class XsTypeConverterTest {
assertThrows(NumberFormatException.class, () ->
XsTypeConverter.lexByte(FULLWIDTH_123));
assertThrows(NumberFormatException.class, () ->
XsTypeConverter.lexByte(ARABIC_123));
}
+
+ @Test
+ void lexFloatRejectsSingleCharSuffix() {
+ // a lone "f"/"F" used to read charAt(-1) and throw
+ // StringIndexOutOfBoundsException instead of NumberFormatException.
+ assertThrows(NumberFormatException.class, () ->
XsTypeConverter.lexFloat("f"));
+ assertThrows(NumberFormatException.class, () ->
XsTypeConverter.lexFloat("F"));
+ }
+
+ @Test
+ void lexFloatRejectsJavaFloatSuffix() {
+ assertThrows(NumberFormatException.class, () ->
XsTypeConverter.lexFloat("1.0f"));
+ assertThrows(NumberFormatException.class, () ->
XsTypeConverter.lexFloat("1.0F"));
+ }
+
+ @Test
+ void lexFloatAcceptsValidValues() {
+ assertEquals(1.0f, XsTypeConverter.lexFloat("1.0"));
+ assertEquals(Float.POSITIVE_INFINITY, XsTypeConverter.lexFloat("INF"));
+ assertEquals(Float.NEGATIVE_INFINITY,
XsTypeConverter.lexFloat("-INF"));
+ }
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
