Skip to content

Commit 341a72f

Browse files
committed
Add fix for overflow error in MXParser buffer sizing
1 parent 905a516 commit 341a72f

File tree

2 files changed

+19
-1
lines changed

2 files changed

+19
-1
lines changed

src/main/java/org/codehaus/plexus/util/xml/pull/MXParser.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3656,7 +3656,8 @@ else if ( expand )
36563656
buf = newBuf;
36573657
if ( bufLoadFactor > 0 )
36583658
{
3659-
bufSoftLimit = ( bufLoadFactor * buf.length ) / 100;
3659+
// Include fix for https://web.archive.org/web/20070831191548/http://www.extreme.indiana.edu/bugzilla/show_bug.cgi?id=228
3660+
bufSoftLimit = (int) ((((long) bufLoadFactor) * buf.length) / 100);
36603661
}
36613662

36623663
}

src/test/java/org/codehaus/plexus/util/xml/pull/MXParserTest.java

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -391,6 +391,23 @@ public void testSubsequentProcessingInstructionMoreThan8k()
391391
assertEquals( XmlPullParser.END_TAG, parser.nextToken() );
392392
}
393393

394+
@Test
395+
public void testFillBuf_NoOverflow()
396+
throws Exception
397+
{
398+
MXParser parser = new MXParser();
399+
parser.reader = new StringReader("testFillBuf_NoOverflow");
400+
parser.bufEnd = 15941364;
401+
parser.buf = new char[16777216];
402+
403+
parser.fillBuf();
404+
405+
// Without this fix
406+
// https://web.archive.org/web/20070831191548/http://www.extreme.indiana.edu/bugzilla/show_bug.cgi?id=228
407+
// the integer value overflows to -11072962
408+
assertTrue(parser.bufSoftLimit >= 0);
409+
}
410+
394411
public void testMalformedProcessingInstructionAfterTag()
395412
throws Exception
396413
{

0 commit comments

Comments
 (0)