[jira] [Work logged] (IO-429) ByteArrayOutputStream can overflow

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/IO-429?focusedWorklogId=596089&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-596089 ]

ASF GitHub Bot logged work on IO-429:
-------------------------------------

                Author: ASF GitHub Bot
            Created on: 13/May/21 12:52
            Start Date: 13/May/21 12:52
    Worklog Time Spent: 10m 
      Work Description: garydgregory commented on pull request #175:
URL: https://github.com/apache/commons-io/pull/175#issuecomment-840534277


   @leskin-in 
   May you please rebase on master and see if you can get green builds?
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Issue Time Tracking
-------------------

    Worklog Id:     (was: 596089)
    Time Spent: 1h 10m  (was: 1h)

> ByteArrayOutputStream can overflow
> ----------------------------------
>
>                 Key: IO-429
>                 URL: https://issues.apache.org/jira/browse/IO-429
>             Project: Commons IO
>          Issue Type: Bug
>          Components: Utilities
>            Reporter: Fabian Lange
>            Priority: Major
>          Time Spent: 1h 10m
>  Remaining Estimate: 0h
>
> There are many places involved in the problem, and a good fix might be problematic performance wise.
> For example:
> IOUtils.toByteArray(InputStream input) invoked with a Stream which feeds more than Integer.MAX_VALUE bytes will either crash with NegativeArraySizeException or maybe worse overflow in such a way that it returns fine (but only with partial data)
> The ByteArrayOutputStream will happily consume the full stream but "int count" will overflow. At some point then toByteArray is invoked which will do like new byte[count].
> maybe "needNewBuffer" can throw the IllegalArgumentException, as it gets  the count and could check for the overflow.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)