jaideeppyne opened a new pull request, #783: URL: https://github.com/apache/datasketches-java/pull/783
## Problem The UTF-8 and UTF-16 string SerDes allocate arrays from serialized counts and length prefixes before checking that the input segment contains those bytes. Invalid input can therefore throw `NegativeArraySizeException` or `OutOfMemoryError` instead of the expected bounds exception. ## Change Check the minimum prefix space before allocating the output array, and validate each string's payload before allocating its byte buffer. Valid serialized bytes and zero-item behavior are unchanged. The new tests exercise both SerDes with impossible item counts, negative and oversized length prefixes, truncated prefixes, invalid offsets, and offset Unicode/empty-string round trips. They also verify that decoded strings remain independent of later input mutations. ## Verification [Tests-first and full verification on JDK 25](https://github.com/jaideeppyne/datasketches-java/actions/runs/40831233659): - Unchanged production: the new tests reproduce the wrong `NegativeArraySizeException` and `OutOfMemoryError` paths. - Fixed source: all 10 focused cases pass. - `mvn -B clean verify`: **2,305 tests passed**, no failures, errors, or skips. Source: `628ac813eb143c287ed9da5594e74f5222fc29be`. No dependencies or serialization formats changed. Prepared with OpenAI Codex assistance, including implementation and tests. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
