[
https://issues.apache.org/jira/browse/LUCENE-6948?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15092115#comment-15092115
]
ASF subversion and git services commented on LUCENE-6948:
---------------------------------------------------------
Commit 1724063 from [~jpountz] in branch 'dev/branches/branch_5x'
[ https://svn.apache.org/r1724063 ]
LUCENE-6948: Move CHANGES entry to 5.4.1.
> ArrayIndexOutOfBoundsException in PagedBytes$Reader.fill
> --------------------------------------------------------
>
> Key: LUCENE-6948
> URL: https://issues.apache.org/jira/browse/LUCENE-6948
> Project: Lucene - Core
> Issue Type: Bug
> Components: core/search
> Affects Versions: 4.10.4
> Reporter: Michael Lawley
> Assignee: Christine Poerschke
> Fix For: 5.5, Trunk
>
> Attachments: LUCENE-6948.patch
>
>
> With a very large index (in our case > 10G), we are seeing exceptions like:
> java.lang.ArrayIndexOutOfBoundsException: -62400
> at org.apache.lucene.util.PagedBytes$Reader.fill(PagedBytes.java:116)
> at
> org.apache.lucene.search.FieldCacheImpl$BinaryDocValuesImpl$1.get(FieldCacheImpl.java:1342)
> at
> org.apache.lucene.search.join.TermsCollector$SV.collect(TermsCollector.java:106)
> at
> org.apache.lucene.search.Weight$DefaultBulkScorer.scoreAll(Weight.java:193)
> at
> org.apache.lucene.search.Weight$DefaultBulkScorer.score(Weight.java:163)
> at org.apache.lucene.search.BulkScorer.score(BulkScorer.java:35)
> at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:621)
> at org.apache.lucene.search.IndexSearcher.search(IndexSearcher.java:309)
> The code in question is trying to allocate an array with a negative size. We
> believe the source of the error is in
> org.apache.lucene.search.FieldCacheImpl$BinaryDocValuesImpl$1.get where the
> following code occurs:
> final int pointer = (int) docToOffset.get(docID);
> if (pointer == 0) {
> term.length = 0;
> } else {
> bytes.fill(term, pointer);
> }
> The cast to int will break if the (long) result of docToOffset.get is too
> large, and is unnecessary in the first place since bytes.fill takes a long as
> its second parameter.
> Proposed fix:
> final long pointer = docToOffset.get(docID);
> if (pointer == 0) {
> term.length = 0;
> } else {
> bytes.fill(term, pointer);
> }
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@lucene.apache.org
For additional commands, e-mail: dev-h...@lucene.apache.org
