Details
-
Bug
-
Status: Resolved
-
Normal
-
Resolution: Fixed
-
None
-
Degradation - Other Exception
-
Low
-
Normal
-
User Report
-
All
-
None
-
Description
In PagingState.java, index is an integer field, and we add long values to it without a Math.toIntExact check. While we’re checking for negative return values returned by getUnsignedVInt, there's a chance that the value returned by it is so large that addition operation would cause integer overflow, or the value itself is large enough to cause overflow.