dhruvaggarwal2000 opened a new pull request, #1736: URL: https://github.com/apache/commons-lang/pull/1736
This issue is tracked as LANG-1828 (https://issues.apache.org/jira/browse/LANG-1828). **Repro:** ```java StringUtils.rightPad("x", Integer.MIN_VALUE, '*'); // → OutOfMemoryError StringUtils.leftPad ("x", Integer.MIN_VALUE, '*'); // → OutOfMemoryError ``` Both pad overloads crash the JVM when called with `size = Integer.MIN_VALUE` and a non-empty input string. The documented contract — **"if the size is less than the str length, the str is returned"** — should make this a no-op returning "x" unchanged. The empty-string case `StringUtils.rightPad("", Integer.MIN_VALUE, '*')` is correctly handled and returns `""`; only non-empty inputs trip the bug. **Cause:** The early-return guard runs after the unsafe arithmetic: ```java public static String rightPad(final String str, final int size, final char padChar) { if (str == null) { return null; } final int pads = size - str.length(); // MIN_VALUE - 1 = MAX_VALUE (int underflow) if (pads <= 0) { // skipped — pads is now ~2.1 billion return str; } if (pads > PAD_LIMIT) { // taken — recurses to the String overload return rightPad(str, size, String.valueOf(padChar)); } return str.concat(repeat(padChar, pads)); } ``` When `size = Integer.MIN_VALUE` and `str.length() = 1`, the subtraction wraps around in int arithmetic: `Integer.MIN_VALUE - 1 ` becomes `Integer.MAX_VALUE` instead of staying negative. So pads ends up around 2.1 billion, the `pads <= 0` check is skipped, and the method tries to allocate a 2 GB char[] — OOM. All four pad methods have the same logic `pads = size - str.length()` followed by a check on the result, so the bug exists in all of them. **Fix:** Short-circuit before the subtraction. The original guard `if (pads <= 0) return str` is mathematically equivalent to `if (size <= str.length()) return str` for valid (non-overflow) inputs. ```java if (size <= str.length()) { // ← new: short-circuit before subtraction return str; } final int pads = size - str.length(); // now safe: size > str.length() ≥ 0 → pads > 0 ``` **Methods affected:** - leftPad(String, int, char) - leftPad(String, int, String) - rightPad(String, int, char) - rightPad(String, int, String) <details> <summary><b>Compatibility report</b> (<code>mvn package japicmp:cmp</code> against 3.20.0)</summary> ### `org.apache.commons.lang3.StringUtils` - [X] Binary-compatible - [X] Source-compatible - [X] Serialization-compatible | Status | Modifiers | Type | Name | Extends | JDK | Serialization | Compatibility Changes | |----------|-----------|-------|---------------|------------|-------|---------------------|-----------------------| | Modified | `public` | Class | `StringUtils` | [`Object`] | JDK 8 | ![Not serializable] | ![No changes] | </details> Before you push a pull request, review this list: - [x] Read the [contribution guidelines](CONTRIBUTING.md) for this project. - [x] Read the [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html) if you use Artificial Intelligence (AI). - [x] AI used: Claude (Anthropic, claude-opus-4-7) via the Claude Code CLI, to draft this PR description. Per ASF guidance: Anthropic's terms place no restrictions inconsistent with the OSD; no third-party material is reproduced in the output. - [x] Run a successful build using the default [Maven](https://maven.apache.org/). - [x] Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied. This may not always be possible, but it is a best practice. - [x] Write a pull request description that is detailed enough to understand what the pull request does, how, and why. - [x] Each commit in the pull request should have a meaningful subject line and body. Note that a maintainer may squash commits during the merge process. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
