You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@xalan.apache.org by bu...@apache.org on 2004/06/03 20:14:58 UTC

DO NOT REPLY [Bug 29372] New: - ArrayIndexOutOfBoundsException from integer overflow in WriterToUTF8Buffered#write()

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=29372>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=29372

ArrayIndexOutOfBoundsException from integer overflow in WriterToUTF8Buffered#write()

           Summary: ArrayIndexOutOfBoundsException from integer overflow in
                    WriterToUTF8Buffered#write()
           Product: XalanJ2
           Version: 2.6
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: Other
         Component: org.apache.xml.serializer
        AssignedTo: xalan-dev@xml.apache.org
        ReportedBy: john@ASCnet.COM


The rework to chunk buffers of data in the write(char [], int, int)
method can lead to an integer overflow in the computation of the end_chunk
then start_chunk variables. When the latter value becomes negative it
leads to an illegal array reference into the chars array. With the numbers
in play a data block of 4MB can lead to this situation.

---------------------------------------------------------------------
To unsubscribe, e-mail: xalan-dev-unsubscribe@xml.apache.org
For additional commands, e-mail: xalan-dev-help@xml.apache.org