Bug 39414 - fop dies due to integer overflow
Summary: fop dies due to integer overflow
Status: CLOSED FIXED
Alias: None
Product: Fop - Now in Jira
Classification: Unclassified
Component: page-master/layout (show other bugs)
Version: 0.92
Hardware: PC Linux
: P2 normal
Target Milestone: ---
Assignee: fop-dev
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2006-04-26 16:50 UTC by Pavel Zeldin
Modified: 2012-04-01 06:57 UTC (History)
0 users


Attachments
example fo file to reproduce the problem (61.75 KB, text/plain)
2006-04-27 15:14 UTC, Pavel Zeldin 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Pavel Zeldin 2006-04-26 16:50:55 UTC 
TextLayoutManager.java rev=392488
has
private short iTempStart = 0; (Line 145)
which it uses in a loop at line 602:
                for (; iTempStart < textArray.length
                        && !isSpace(textArray[iTempStart])
                        && textArray[iTempStart] != NEWLINE
                        && !(iTempStart > iNextStart
                             && isBreakChar(textArray[iTempStart - 1]));
                        iTempStart++) {
...
Looks like in my case textArray was big enough so that length  > 32767

I am using fop-0.92beta
Here is the command line:
fop -fo PSC_PTL_Compiler_Design_Spec.fo -pdf PSC_PTL_Compiler_Design_Spec.pdf

and the output:
Apr 26, 2006 12:50:17 PM org.apache.fop.cli.Main startFOP
SEVERE: Exception
java.lang.ArrayIndexOutOfBoundsException: -32768
        at org.apache.fop.cli.InputHandler.transformTo(InputHandler.java:167)
        at org.apache.fop.cli.InputHandler.renderTo(InputHandler.java:114)
        at org.apache.fop.cli.Main.startFOP(Main.java:159)
        at org.apache.fop.cli.Main.main(Main.java:190)

---------

java.lang.ArrayIndexOutOfBoundsException: -32768
        at
org.apache.fop.layoutmgr.inline.TextLayoutManager.getNextKnuthElements(TextLayoutManager.java:605)
        at
org.apache.fop.layoutmgr.inline.LineLayoutManager.collectInlineKnuthElements(LineLayoutManager.java:647)
        at
org.apache.fop.layoutmgr.inline.LineLayoutManager.getNextKnuthElements(LineLayoutManager.java:582)
        at
org.apache.fop.layoutmgr.BlockStackingLayoutManager.getNextKnuthElements(BlockStackingLayoutManager.java:275)
        at
org.apache.fop.layoutmgr.BlockLayoutManager.getNextKnuthElements(BlockLayoutManager.java:105)
        at
org.apache.fop.layoutmgr.BlockStackingLayoutManager.getNextKnuthElements(BlockStackingLayoutManager.java:275)
        at
org.apache.fop.layoutmgr.BlockLayoutManager.getNextKnuthElements(BlockLayoutManager.java:105)
        at
org.apache.fop.layoutmgr.BlockStackingLayoutManager.getNextKnuthElements(BlockStackingLayoutManager.java:275)
        at
org.apache.fop.layoutmgr.BlockLayoutManager.getNextKnuthElements(BlockLayoutManager.java:105)
        at
org.apache.fop.layoutmgr.BlockStackingLayoutManager.getNextKnuthElements(BlockStackingLayoutManager.java:275)
        at
org.apache.fop.layoutmgr.BlockLayoutManager.getNextKnuthElements(BlockLayoutManager.java:105)
        at
org.apache.fop.layoutmgr.FlowLayoutManager.getNextKnuthElements(FlowLayoutManager.java:98)
        at
org.apache.fop.layoutmgr.PageSequenceLayoutManager$PageBreaker.getNextKnuthElements(PageSequenceLayoutManager.java:234)
        at
org.apache.fop.layoutmgr.AbstractBreaker.getNextBlockList(AbstractBreaker.java:502)
        at
org.apache.fop.layoutmgr.PageSequenceLayoutManager$PageBreaker.getNextBlockList(PageSequenceLayoutManager.java:226)
        at
org.apache.fop.layoutmgr.AbstractBreaker.doLayout(AbstractBreaker.java:252)
        at
org.apache.fop.layoutmgr.AbstractBreaker.doLayout(AbstractBreaker.java:220)
        at
org.apache.fop.layoutmgr.PageSequenceLayoutManager.activateLayout(PageSequenceLayoutManager.java:152)
        at
org.apache.fop.area.AreaTreeHandler.endPageSequence(AreaTreeHandler.java:320)
        at
org.apache.fop.fo.pagination.PageSequence.endOfNode(PageSequence.java:147)
        at
org.apache.fop.fo.FOTreeBuilder$MainFOHandler.endElement(FOTreeBuilder.java:357)
        at org.apache.fop.fo.FOTreeBuilder.endElement(FOTreeBuilder.java:193)
        at
org.apache.xalan.transformer.TransformerIdentityImpl.endElement(TransformerIdentityImpl.java:1101)
        at org.apache.xerces.parsers.AbstractSAXParser.endElement(Unknown Source)
        at
org.apache.xerces.impl.XMLNSDocumentScannerImpl.scanEndElement(Unknown Source)
        at
org.apache.xerces.impl.XMLDocumentFragmentScannerImpl$FragmentContentDispatcher.dispatch(Unknown
Source)
        at
org.apache.xerces.impl.XMLDocumentFragmentScannerImpl.scanDocument(Unknown Source)
        at org.apache.xerces.parsers.XML11Configuration.parse(Unknown Source)
        at org.apache.xerces.parsers.XML11Configuration.parse(Unknown Source)
        at org.apache.xerces.parsers.XMLParser.parse(Unknown Source)
        at org.apache.xerces.parsers.AbstractSAXParser.parse(Unknown Source)
        at
org.apache.xalan.transformer.TransformerIdentityImpl.transform(TransformerIdentityImpl.java:484)
        at org.apache.fop.cli.InputHandler.transformTo(InputHandler.java:164)
        at org.apache.fop.cli.InputHandler.renderTo(InputHandler.java:114)
        at org.apache.fop.cli.Main.startFOP(Main.java:159)
        at org.apache.fop.cli.Main.main(Main.java:190)
Comment 1 Jeremias Maerki 2006-04-27 07:37:47 UTC 
Please attach an FO file so we can reproduce the bug. Thanks.
Comment 2 Manuel Mall 2006-04-27 10:12:40 UTC 
Easy to reproduce:

<block white-space="pre"><![CDATA[
put any text in here having more then 32768 characters
]]></block>
Comment 3 Pavel Zeldin 2006-04-27 15:14:24 UTC 
Created attachment 18193 [details]
example fo file to reproduce the problem
Comment 4 Andreas L. Delmelle 2006-09-02 00:50:54 UTC 
Fixed in FOP Trunk.
Comment 5 Andreas L. Delmelle 2006-09-02 00:54:35 UTC 
Sorry, forgot to add:

URL: http://svn.apache.org/viewvc?rev=439511&view=rev
Comment 6 Glenn Adams 2012-04-01 06:57:47 UTC 
batch transition pre-FOP1.0 resolved+fixed bugs to closed+fixed