[jira] [Updated] (JCR-3558) org.apache.jackrabbit.jcr2spi.xml.TargetImportHandler.BufferedStringValue throws ArrayIndexOutOfBoundsException

["Eike Lang (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/JCR-3558?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Eike Lang updated JCR-3558:
---------------------------

    Status: Patch Available  (was: Open)

--- src/main/java/org/apache/jackrabbit/jcr2spi/xml/TargetImportHandler.java
+++ src/main/java/org/apache/jackrabbit/jcr2spi/xml/TargetImportHandler.java
@@ -323,7 +323,7 @@
                 } else {
                     if (bufferPos + length > buffer.length) {
                         // reallocate new buffer and spool old buffer contents
-                        char[] newBuffer = new char[buffer.length + BUFFER_INCREMENT];
+                    	char[] newBuffer = new char[ bufferPos +length + BUFFER_INCREMENT];
                         System.arraycopy(buffer, 0, newBuffer, 0, bufferPos);
                         buffer = newBuffer;
                     }

                
> org.apache.jackrabbit.jcr2spi.xml.TargetImportHandler.BufferedStringValue throws ArrayIndexOutOfBoundsException
> ---------------------------------------------------------------------------------------------------------------
>
>                 Key: JCR-3558
>                 URL: https://issues.apache.org/jira/browse/JCR-3558
>             Project: Jackrabbit Content Repository
>          Issue Type: Bug
>          Components: jackrabbit-jcr2spi
>    Affects Versions: 2.6
>            Reporter: Eike Lang
>
> When importing XML into jackrabbit, an arrayIndexOutOfBoundException will be thrown if during the import process the append method of the inner BufferedStringValue class of org.apache.jackrabbit.jcr2spi.xml.TargertImportHandler is called so that:
> - the char array to be appended is longer than the current buffer size
> - AND the char array to be appended is smaller than the max buffer size
> - AND the char array to be appended is larger than the current buffer size PLUS the buffer increment
> I.e. starting from a fresh buffer, anything larger than 16384 chars, but smaller than 65536 chars will go boom.
> The following test class exposes the problem: (Making BufferedStringValue and its siblings static inner classes would make them a bit easier to test, with no adverse effect I could see.) Relevant case is of course the first one, the other two illustrate what already works.
> -------------------------- BufferedStringValueTest.java----------
> package org.apache.jackrabbit.jcr2spi.xml;
> import static org.mockito.Mockito.mock;
> import java.io.IOException;
> import org.apache.jackrabbit.jcr2spi.xml.TargetImportHandler.BufferedStringValue;
> import org.apache.jackrabbit.spi.commons.conversion.NamePathResolver;
> import org.junit.Test;
> public class BufferedStringValueTest {
>     @Test
>     public void bufferShouldBeIncreasedByASaneAmount() throws IOException {
>         TargetImportHandler targetImportHandler = new SysViewImportHandler(mock(Importer.class),
>                 mock(NamePathResolver.class));
>         BufferedStringValue value = targetImportHandler.new BufferedStringValue();
>         char[] chars = new char[0x4001];
>         for (int i = 0; i < chars.length; i++) {
>             chars[i] = 0;
>         }
>         value.append(chars, 0, chars.length);
>     }
>     @Test
>     public void bufferShouldDealWithArraysBiggerThanBufferButSmallerThanBufferIncrementPlusBuffer() throws IOException {
>         TargetImportHandler targetImportHandler = new SysViewImportHandler(mock(Importer.class),
>                 mock(NamePathResolver.class));
>         BufferedStringValue value = targetImportHandler.new BufferedStringValue();
>         char[] chars = new char[0x3999];
>         for (int i = 0; i < chars.length; i++) {
>             chars[i] = 0;
>         }
>         value.append(chars, 0, chars.length);
>     }
>     @Test
>     public void bufferShouldDealWithArraysBiggerThanMaxSize() throws IOException {
>         TargetImportHandler targetImportHandler = new SysViewImportHandler(mock(Importer.class),
>                 mock(NamePathResolver.class));
>         BufferedStringValue value = targetImportHandler.new BufferedStringValue();
>         char[] chars = new char[0x10001];
>         for (int i = 0; i < chars.length; i++) {
>             chars[i] = 0;
>         }
>         value.append(chars, 0, chars.length);
>     }
> }
> --------------------------
> The following simple patch resolves this issue:
> 326c326
> <                         char[] newBuffer = new char[buffer.length + BUFFER_INCREMENT];
> ---
> >                     	char[] newBuffer = new char[ bufferPos +length + BUFFER_INCREMENT];

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira