Author: fanningpj
Date: Tue Jun 9 09:56:56 2026
New Revision: 1935162
Log:
Guard against integer overflow in GDuration field parsing. Thanks to aizu-m.
This closes #40
Modified:
xmlbeans/trunk/src/main/java/org/apache/xmlbeans/GDuration.java
xmlbeans/trunk/src/test/java/xmlobject/schematypes/checkin/GDateTests.java
Modified: xmlbeans/trunk/src/main/java/org/apache/xmlbeans/GDuration.java
==============================================================================
--- xmlbeans/trunk/src/main/java/org/apache/xmlbeans/GDuration.java Tue Jun
9 06:44:42 2026 (r1935161)
+++ xmlbeans/trunk/src/main/java/org/apache/xmlbeans/GDuration.java Tue Jun
9 09:56:56 2026 (r1935162)
@@ -120,7 +120,10 @@ public final class GDuration implements
ch = (start < len) ? str.charAt(start) : '\0';
if (!GDate.isDigit(ch))
break;
- value = value * 10 + GDate.digitVal(ch);
+ int digit = GDate.digitVal(ch);
+ if (value > (Integer.MAX_VALUE - digit) / 10)
+ throw new IllegalArgumentException("duration field value
out of range: " + str);
+ value = value * 10 + digit;
}
if (ch == '.')
{
Modified:
xmlbeans/trunk/src/test/java/xmlobject/schematypes/checkin/GDateTests.java
==============================================================================
--- xmlbeans/trunk/src/test/java/xmlobject/schematypes/checkin/GDateTests.java
Tue Jun 9 06:44:42 2026 (r1935161)
+++ xmlbeans/trunk/src/test/java/xmlobject/schematypes/checkin/GDateTests.java
Tue Jun 9 09:56:56 2026 (r1935162)
@@ -108,6 +108,11 @@ public class GDateTests {
"-P1Y1M1DT1H-1M1.1S",
"-PT-0.1S",
"-PT-0.1415926S",
+
+ "PT2147483648S", // overflow: Integer.MAX_VALUE + 1
+ "PT4294967296S", // overflow
+ "P4294967296Y", // overflow
+ "PT10000000000S", // overflow
};
private static final String[] invalidDates = {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
