0002920: ArrayIndexOutOfBoundsException in com.caucho.vfs.ReaderStream.read

2920

block

sometimes

09-10-08 20:38

09-11-08 11:06

Reporter:

rgnitz

Platform:

Assigned To:

ferg

OS:

Priority:

normal

OS Version:

Status:

closed

Product Version:

3.1.6

Product Build:

Resolution:

fixed

Projection:

none

ETA:

none

Fixed in Version:

3.2.1

Summary:

0002920: ArrayIndexOutOfBoundsException in com.caucho.vfs.ReaderStream.read

Description:

Method: com.caucho.vfs.ReaderStream.read(buf, offset, length) (line 56)

// XXX: encoding issues
public int read(byte []buf, int offset, int length) throws IOException

There is an issue here because of the offset increment. There isn't a guarantee that there is 1,2 or 3 bytes ahead.

Included are the steps to reproduce but this also occurs when running a PHP script.

Exception:

Exception in thread "main" conductor.sensor.SensorException: java.lang.ArrayIndexOutOfBoundsException: 16384
        at conductor.sensor.PhpCliHarness.eval(PhpCliHarness.java:170)
        at conductor.sensor.PhpCliHarness.main(PhpCliHarness.java:65)
Caused by: java.lang.ArrayIndexOutOfBoundsException: 16384
        at com.caucho.vfs.ReaderStream.read(ReaderStream.java:67)
        at com.caucho.vfs.ReadStream.readBuffer(ReadStream.java:1015)
        at com.caucho.vfs.ReadStream.readChar(ReadStream.java:513)
        at com.caucho.quercus.parser.QuercusParser.read(QuercusParser.java:4948)
        at com.caucho.quercus.parser.QuercusParser.parsePhpText(QuercusParser.java:4143)
        at com.caucho.quercus.parser.QuercusParser.parseTop(QuercusParser.java:489)
        at com.caucho.quercus.parser.QuercusParser.parse(QuercusParser.java:421)
        at com.caucho.quercus.parser.QuercusParser.parse(QuercusParser.java:322)
        at conductor.sensor.PhpCliHarness.eval(PhpCliHarness.java:121)

Steps To Reproduce:

import java.io.Reader;
import java.io.StringReader;
import java.io.IOException;
import java.util.Random;

public final class ReaderStreamFix {
    private Reader _reader;
    private ReaderStreamFix(final Reader pReader) { _reader = pReader; }

    public static void main(final String [] pArgs) throws Exception {
        final int iterations = 16384;
        final int bufferSize = 1024;
        final int reads = iterations / bufferSize;
        final StringBuilder buf = new StringBuilder();
        final Random random = new Random(System.currentTimeMillis());
        for (int idx=0; idx < iterations; idx++) {
            buf.append((char)random.nextInt(Integer.MAX_VALUE));
        }
        final byte [] orig = buf.toString().getBytes();
        final Reader reader = new StringReader(buf.toString());
        final ReaderStreamFix fix = new ReaderStreamFix(reader);
        final byte [] buffer = new byte[bufferSize];
        for (int idx=0; idx < reads; idx++) fix.read(buffer, 0, buffer.length);
    }
    public int read(byte []buf, int offset, int length) throws IOException {
        int i = 0;
        try {
            for (; i < length; i++) {

                int ch = _reader.read();

                if (ch < 0) break;

                if (ch < 0x80)
                    buf[offset++] = (byte) ch;
                else if (ch < 0x800) {
                    buf[offset++] = (byte) (0xc0 | (ch >> 6));
                    buf[offset++] = (byte) (0x80 | (ch & 0x3f));

                } else if (ch < 0x8000) {
                    buf[offset++] = (byte) (0xe0 | (ch >> 12));
                    buf[offset++] = (byte) (0x80 | ((ch >> 6) & 0x3f));
                    buf[offset++] = (byte) (0x80 | ((ch >> 6) & 0x3f));
                }
            }
            return i;
        }
    }
}

Additional Information:

Relationships

Attached Files:

Mantis - Quercus
Viewing Issue Advanced Details

ID:	Category:	Severity:	Reproducibility:	Date Submitted:	Last Update:
2920		block	sometimes	09-10-08 20:38	09-11-08 11:06

Reporter:	rgnitz	Platform:
Assigned To:	ferg	OS:
Priority:	normal	OS Version:
Status:	closed	Product Version:	3.1.6
Product Build:		Resolution:	fixed
Projection:	none
ETA:	none	Fixed in Version:	3.2.1

Summary:	0002920: ArrayIndexOutOfBoundsException in com.caucho.vfs.ReaderStream.read
Description:	Method: com.caucho.vfs.ReaderStream.read(buf, offset, length) (line 56) // XXX: encoding issues public int read(byte []buf, int offset, int length) throws IOException There is an issue here because of the offset increment. There isn't a guarantee that there is 1,2 or 3 bytes ahead. Included are the steps to reproduce but this also occurs when running a PHP script. Exception: Exception in thread "main" conductor.sensor.SensorException: java.lang.ArrayIndexOutOfBoundsException: 16384 at conductor.sensor.PhpCliHarness.eval(PhpCliHarness.java:170) at conductor.sensor.PhpCliHarness.main(PhpCliHarness.java:65) Caused by: java.lang.ArrayIndexOutOfBoundsException: 16384 at com.caucho.vfs.ReaderStream.read(ReaderStream.java:67) at com.caucho.vfs.ReadStream.readBuffer(ReadStream.java:1015) at com.caucho.vfs.ReadStream.readChar(ReadStream.java:513) at com.caucho.quercus.parser.QuercusParser.read(QuercusParser.java:4948) at com.caucho.quercus.parser.QuercusParser.parsePhpText(QuercusParser.java:4143) at com.caucho.quercus.parser.QuercusParser.parseTop(QuercusParser.java:489) at com.caucho.quercus.parser.QuercusParser.parse(QuercusParser.java:421) at com.caucho.quercus.parser.QuercusParser.parse(QuercusParser.java:322) at conductor.sensor.PhpCliHarness.eval(PhpCliHarness.java:121)
Steps To Reproduce:	import java.io.Reader; import java.io.StringReader; import java.io.IOException; import java.util.Random; public final class ReaderStreamFix { private Reader _reader; private ReaderStreamFix(final Reader pReader) { _reader = pReader; } public static void main(final String [] pArgs) throws Exception { final int iterations = 16384; final int bufferSize = 1024; final int reads = iterations / bufferSize; final StringBuilder buf = new StringBuilder(); final Random random = new Random(System.currentTimeMillis()); for (int idx=0; idx < iterations; idx++) { buf.append((char)random.nextInt(Integer.MAX_VALUE)); } final byte [] orig = buf.toString().getBytes(); final Reader reader = new StringReader(buf.toString()); final ReaderStreamFix fix = new ReaderStreamFix(reader); final byte [] buffer = new byte[bufferSize]; for (int idx=0; idx < reads; idx++) fix.read(buffer, 0, buffer.length); } public int read(byte []buf, int offset, int length) throws IOException { int i = 0; try { for (; i < length; i++) { int ch = _reader.read(); if (ch < 0) break; if (ch < 0x80) buf[offset++] = (byte) ch; else if (ch < 0x800) { buf[offset++] = (byte) (0xc0 \| (ch >> 6)); buf[offset++] = (byte) (0x80 \| (ch & 0x3f)); } else if (ch < 0x8000) { buf[offset++] = (byte) (0xe0 \| (ch >> 12)); buf[offset++] = (byte) (0x80 \| ((ch >> 6) & 0x3f)); buf[offset++] = (byte) (0x80 \| ((ch >> 6) & 0x3f)); } } return i; } } }
Additional Information:
Relationships
Attached Files: