[JCR-3558] org.apache.jackrabbit.jcr2spi.xml.TargetImportHandler.BufferedStringValue throws ArrayIndexOutOfBoundsException

• Type: Bug
• Status: Patch Available
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.6
• Component/s: jackrabbit-jcr2spi
• Assignee: Unassigned
• Reporter: Eike Lang
• Created: 04/Apr/13 10:24
• Updated: 04/Apr/13 10:31

Description

When importing XML into jackrabbit, an arrayIndexOutOfBoundException will be thrown if during the import process the append method of the inner BufferedStringValue class of org.apache.jackrabbit.jcr2spi.xml.TargertImportHandler is called so that:

• the char array to be appended is longer than the current buffer size
• AND the char array to be appended is smaller than the max buffer size
• AND the char array to be appended is larger than the current buffer size PLUS the buffer increment

I.e. starting from a fresh buffer, anything larger than 16384 chars, but smaller than 65536 chars will go boom.

The following test class exposes the problem: (Making BufferedStringValue and its siblings static inner classes would make them a bit easier to test, with no adverse effect I could see.) Relevant case is of course the first one, the other two illustrate what already works.

-------------------------- BufferedStringValueTest.java----------

package org.apache.jackrabbit.jcr2spi.xml;

import static org.mockito.Mockito.mock;

import java.io.IOException;

import org.apache.jackrabbit.jcr2spi.xml.TargetImportHandler.BufferedStringValue;
import org.apache.jackrabbit.spi.commons.conversion.NamePathResolver;
import org.junit.Test;

public class BufferedStringValueTest {

@Test
public void bufferShouldBeIncreasedByASaneAmount() throws IOException {
TargetImportHandler targetImportHandler = new SysViewImportHandler(mock(Importer.class),
mock(NamePathResolver.class));
BufferedStringValue value = targetImportHandler.new BufferedStringValue();
char[] chars = new char[0x4001];
for (int i = 0; i < chars.length; i++)

{ chars[i] = 0; }
value.append(chars, 0, chars.length);
}

@Test
public void bufferShouldDealWithArraysBiggerThanBufferButSmallerThanBufferIncrementPlusBuffer() throws IOException {
TargetImportHandler targetImportHandler = new SysViewImportHandler(mock(Importer.class),
mock(NamePathResolver.class));
BufferedStringValue value = targetImportHandler.new BufferedStringValue();
char[] chars = new char[0x3999];
for (int i = 0; i < chars.length; i++) { chars[i] = 0; }

value.append(chars, 0, chars.length);
}

@Test
public void bufferShouldDealWithArraysBiggerThanMaxSize() throws IOException {
TargetImportHandler targetImportHandler = new SysViewImportHandler(mock(Importer.class),
mock(NamePathResolver.class));
BufferedStringValue value = targetImportHandler.new BufferedStringValue();
char[] chars = new char[0x10001];
for (int i = 0; i < chars.length; i++)

{ chars[i] = 0; }

value.append(chars, 0, chars.length);
}
}
--------------------------

The following simple patch resolves this issue:

326c326
< char[] newBuffer = new char[buffer.length + BUFFER_INCREMENT];
—
> char[] newBuffer = new char[ bufferPos +length + BUFFER_INCREMENT];