0002920: ArrayIndexOutOfBoundsException in com.caucho.vfs.ReaderStream.read

Viewing Issue Advanced Details [ Jump to Notes ]

[ View Simple ] [ Issue History ] [ Print ]

Category

Severity

Reproducibility

Date Submitted

Last Update

0002920

[Quercus]

block

sometimes

09-10-08 20:38

09-11-08 11:06

Reporter

rgnitz

View Status

public

Assigned To

ferg

Priority

normal

Resolution

fixed

Platform

Status

closed

Projection

none

OS Version

ETA

none

Fixed in Version

3.2.1

Product Version

3.1.6

Product Build

Summary

0002920: ArrayIndexOutOfBoundsException in com.caucho.vfs.ReaderStream.read

Description

Method: com.caucho.vfs.ReaderStream.read(buf, offset, length) (line 56)

// XXX: encoding issues
public int read(byte []buf, int offset, int length) throws IOException

There is an issue here because of the offset increment. There isn't a guarantee that there is 1,2 or 3 bytes ahead.

Included are the steps to reproduce but this also occurs when running a PHP script.

Exception:

Exception in thread "main" conductor.sensor.SensorException: java.lang.ArrayIndexOutOfBoundsException: 16384
        at conductor.sensor.PhpCliHarness.eval(PhpCliHarness.java:170)
        at conductor.sensor.PhpCliHarness.main(PhpCliHarness.java:65)
Caused by: java.lang.ArrayIndexOutOfBoundsException: 16384
        at com.caucho.vfs.ReaderStream.read(ReaderStream.java:67)
        at com.caucho.vfs.ReadStream.readBuffer(ReadStream.java:1015)
        at com.caucho.vfs.ReadStream.readChar(ReadStream.java:513)
        at com.caucho.quercus.parser.QuercusParser.read(QuercusParser.java:4948)
        at com.caucho.quercus.parser.QuercusParser.parsePhpText(QuercusParser.java:4143)
        at com.caucho.quercus.parser.QuercusParser.parseTop(QuercusParser.java:489)
        at com.caucho.quercus.parser.QuercusParser.parse(QuercusParser.java:421)
        at com.caucho.quercus.parser.QuercusParser.parse(QuercusParser.java:322)
        at conductor.sensor.PhpCliHarness.eval(PhpCliHarness.java:121)

Steps To Reproduce

import java.io.Reader;
import java.io.StringReader;
import java.io.IOException;
import java.util.Random;

public final class ReaderStreamFix {
    private Reader _reader;
    private ReaderStreamFix(final Reader pReader) { _reader = pReader; }

    public static void main(final String [] pArgs) throws Exception {
        final int iterations = 16384;
        final int bufferSize = 1024;
        final int reads = iterations / bufferSize;
        final StringBuilder buf = new StringBuilder();
        final Random random = new Random(System.currentTimeMillis());
        for (int idx=0; idx < iterations; idx++) {
            buf.append((char)random.nextInt(Integer.MAX_VALUE));
        }
        final byte [] orig = buf.toString().getBytes();
        final Reader reader = new StringReader(buf.toString());
        final ReaderStreamFix fix = new ReaderStreamFix(reader);
        final byte [] buffer = new byte[bufferSize];
        for (int idx=0; idx < reads; idx++) fix.read(buffer, 0, buffer.length);
    }
    public int read(byte []buf, int offset, int length) throws IOException {
        int i = 0;
        try {
            for (; i < length; i++) {

                int ch = _reader.read();

                if (ch < 0) break;

                if (ch < 0x80)
                    buf[offset++] = (byte) ch;
                else if (ch < 0x800) {
                    buf[offset++] = (byte) (0xc0 | (ch >> 6));
                    buf[offset++] = (byte) (0x80 | (ch & 0x3f));

                } else if (ch < 0x8000) {
                    buf[offset++] = (byte) (0xe0 | (ch >> 12));
                    buf[offset++] = (byte) (0x80 | ((ch >> 6) & 0x3f));
                    buf[offset++] = (byte) (0x80 | ((ch >> 6) & 0x3f));
                }
            }
            return i;
        }
    }
}

Additional Information

Attached Files

Relationships

Notes
(0003417) rgnitz 09-10-08 20:46	Yikes... I put this in the wrong category. This is a Resin bug.

Issue History
Date Modified	Username	Field	Change
09-10-08 20:38	rgnitz	New Issue
09-10-08 20:46	rgnitz	Note Added: 0003417
09-11-08 11:06	ferg	Assigned To	=> ferg
09-11-08 11:06	ferg	Status	new => closed
09-11-08 11:06	ferg	Resolution	open => fixed
09-11-08 11:06	ferg	Fixed in Version	=> 3.2.1
09-11-08 11:06	ferg	Description Updated

Mantis 1.0.0rc3[^]

30 total queries executed.
26 unique queries executed.