elharo opened a new pull request, #140: URL: https://github.com/apache/xerces-j/pull/140
## Summary Fixes [XERCESJ-1655](https://issues.apache.org/jira/browse/XERCESJ-1655). `UTF8Reader.read(char[], int, int)` could throw `ArrayIndexOutOfBoundsException` when a low surrogate was cached from a previous read and the next read used a non-zero offset with a buffer sized to the requested length. The cached surrogate is written to the output buffer before reading the next block of bytes, and `count` is then incremented by the number of characters already written. That `count` was used as the number of bytes to decode, so the reader processed one byte too many from the input buffer and wrote one character too many to the output buffer, overflowing it. For example, reading a stream of 2047 spaces, a surrogate pair, and 2046 spaces in 2048-character blocks with an offset of 1 on the second read fails with: ``` ArrayIndexOutOfBoundsException: Index 2048 out of bounds for length 2048 ``` ## Fix Track the number of characters written from the cached surrogate (`surrogateOffset`) and subtract it from `count` when computing how many bytes in the input buffer are valid: ```java final int total = count - surrogateOffset; ``` ## Tests Added `testSurrogatesInFrames` to `tests/io/UTF8.java`, which reproduces the reported layout and reads into a 2048-character buffer with an offset of 1 on the second read. The test fails with `ArrayIndexOutOfBoundsException: Index 2048` before the fix and passes after it. The full `ant test` suite passes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
