DO NOT REPLY [Bug 12182] - long xpath expression crashes with ArrayIndexOutOfBoundsException in org.apache.xpath.compiler.Lexer.addToTokenQueue()

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=12182>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=12182

long xpath expression crashes with ArrayIndexOutOfBoundsException in org.apache.xpath.compiler.Lexer.addToTokenQueue()

jeff.keegan@av.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
      everconfirmed|0                           |1
           Keywords|                            |APIBug, XSLTBug
            Summary|calling xalan:evaluate on   |long xpath expression
                   |long xpath expression       |crashes with
                   |crashes with                |ArrayIndexOutOfBoundsExcepti
                   |ArrayIndexOutOfBoundsExcepti|on in
                   |on                          |org.apache.xpath.compiler.Le
                   |                            |xer.addToTokenQueue()



------- Additional Comments From jeff.keegan@av.com  2002-09-05 06:07 -------
[Changed summary from "calling xalan:evaluate on long xpath expression crashes 
with ArrayIndexOutOfBoundsException" to "long xpath expression crashes with 
ArrayIndexOutOfBoundsException in 
org.apache.xpath.compiler.Lexer.addToTokenQueue()"]

Ok, I've taken a look at the code and found the problem, but am hesitating as 
to the best way to fix it.  (By the way, it has nothing to do with 
xalan:evaluate, it's just a problem with long xpaths in general).

In org/apache/xpath/compiler/OpMap.java there's a variable MAXTOKENQUEUESIZE 
that's set to 500.  An array m_tokenQueue in org.apache.xpath.compiler.OpMap is 
allocated with this size.

org.apache.xpath.compiler.Lexer.addToTokenQueue() adds to this array, 
overrunning it (throwing the exception) when it hits the end, without checking 
it first.

My question is now this:  how public is org.apache.xpath.compiler.OpMap?  Would 
changing its public m_tokenQueue attribute from an Object[] to a Vector (and 
all places that use it in the xalan package) be acceptable, or is that public 
enough to be used by someone who'd have code break on them as a result?

If not, are people ok with allocating a new larger m_tokenQueue array and 
copying over the old when we reach the max size?

I don't believe having a set limit is acceptable, so just bumping the limit 
from 500 up doesn't cut it, nor does throwing a different exception (though 
addToTokenQueue should obviously never throw an AIOOBE).

Comments?