Details
-
Bug
-
Status: Closed
-
Major
-
Resolution: Fixed
-
10.4.2.0
-
None
-
CentOS 5, java 1.6.0_11
-
High Value Fix
Description
DDMReader.readBytes(int length) checks the length vs DssConstants.MAX_DSS_LENGTH, but ignores the fact that the buffer position "pos" might not be 0. If pos is non-zero then the pos + length can be larger than the size of "buffer" causing an ArrayIndexOutOfBoundsException.
For me this happened when sending a BLOB that was 32766 bytes long. The value of pos was 2 in that method.