Issue Details (XML | Word | Printable)

Key: XALANJ-2316
Type: Bug Bug
Status: Resolved Resolved
Resolution: Fixed
Priority: Major Major
Assignee: Unassigned
Reporter: Enrico Scoda
Votes: 0
Watchers: 1
Operations

If you were logged in you would be able to see more operations.
XalanJ2

WriterToUTF8Buffered.write(String s) fail with big strings

Created: 01/Sep/06 07:50 AM   Updated: 11/Dec/07 04:57 PM
Return to search
Component/s: Serialization
Affects Version/s: 2.7
Fix Version/s: 2.7.1

Time Tracking:
Not Specified

File Attachments:
  Size
Text File Licensed for inclusion in ASF works j2316.patch 2006-10-18 03:58 PM Kevin Cormier 1 kB
Java Source File Licensed for inclusion in ASF works WriterToUTF8Buffered.java 2006-09-01 07:59 AM Enrico Scoda 16 kB

Xalan info: PatchAvailable
Reviewer: Kevin Cormier
Resolution Date: 31/Oct/06 03:24 AM


 Description  « Hide
Try to write an attribute with a value of 50000 characters.
You will get this exception:

java.lang.ArrayIndexOutOfBoundsException
at java.lang.System.arraycopy(Native Method)
at java.lang.String.getChars(String.java:726)
at org.apache.xml.serializer.WriterToUTF8Buffered.write(WriterToUTF8Buffered.java:347)
at org.apache.xml.serializer.ToHTMLStream.writeAttrString(ToHTMLStream.java:1431)

 All   Comments   Work Log   Change History   Subversion Commits      Sort Order: Ascending order - Click to sort in descending order
Enrico Scoda added a comment - 01/Sep/06 07:59 AM
Sorry, unable to generate a patch (can't access Source Repository now).
This is the modified source file for org.apache.xml.serializer.WriterToUTF8Buffered (xalan 2.7.0 source file).

modified code in lines 338-341:
new version:
         if (length % CHARS_MAX > 0)
             chunks = split + 1;
         else
             chunks = split;
was:
        if (split > 1)
             chunks = split;
         else
             chunks = 2;

Brian Minchau added a comment - 17/Oct/06 04:10 PM
Per the JIRA triage meeting on Oct 16, 2005, Kevin C. (a contributor) agreed to reproduce this problem and check the patch. He is not a committer so ultimately he will get Brian M. to give the official review/approval/application.

Brian Minchau added a comment - 17/Oct/06 05:08 PM
Setting Kevin C. as the reviewer.

Kevin Cormier added a comment - 18/Oct/06 03:58 PM
I have reproduced this problem using a stylesheet with an LRE that has an attribute with a value that consists of many characters. The problem applies to the HTML output method.

The problem first exhibits itself when the attribute value has 10927 characters or more, though an exception does not occur for lengths that are within a window of multiples of CHARS_MAX. This is because the actual buffer is 2 characters larger than CHARS_MAX, and the current code ignores the remainder when calculating the chunks, but then calculates the chunk size rather than using CHARS_MAX. It also uses two chunks any time the length of the attribute value divided by CHARS_MAX is 1 or less. CHARS_MAX = 5461, so the problem first occurs once the length exceeds 2 * CHARS_MAX + 2 * 2 = 10926.

I have reviewed the suggested changes, and they fix the problem. This problem also exists in another method of the class that is used for other items, such as comments. The fix applies to it as well, so I have attached a patch with the fix applied to both methods.

Brian Minchau added a comment - 31/Oct/06 03:24 AM
Hi Kevin, I applied your revised patch j2316, it is very small, only 4 lines of code change.

However, please sign an ICLA (individual contributor license agreement) which you will find
at http://www.apache.org/licenses/

Just sign a good old paper copy and mail it in. (Check with your manager or company before
you do that). With a signed ICLA Apache can more easily accept donations of bug fixes or larger code changes.

Enrico, the same applies for you too.

( I don't like this legal paperwork, but Apache needs to protect itself )

Brian Minchau added a comment - 11/Dec/07 04:57 PM
Would the originator of this issue please verify that this issue is fixed in the 2.7.1 release, by adding a comment to this issue, so that we can close this issue.

A lack of response by February 1, 2008 will be taken as consent that we can close this resolved issue.

Regards,
Brian Minchau