[LUCENE-3779] An incomplete fix for the NPE bugs in MultipleTermPositions.java

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Abandoned
• Affects Version/s: 3.0
• Component/s: core/index
• Lucene Fields: New
• Assignee: Unassigned
• Reporter: Guangtai Liang
• Created: 14/Feb/12 12:38
• Updated: 28/Aug/22 13:08
• Resolved: 09/Jun/16 14:29

Description

The fix revision 219387 (Fix for NPE (bug #35626). Fix by Hans Hjelm, test case by Scotty Allen.) was aimed to remove an NPE bug on the return value of "_termPositionsQueue.peek()" in the method "skipTo" of the file "/lucene/java/trunk/src/java/org/apache/lucene/index/MultipleTermPositions.java" , but it is incomplete.
Since the returned value "_termPositionsQueue.peek()" could be null during the run-time execution, its value should also be null-checked before being dereferenced in other methods.

The buggy code locations the same fix needs to be applied at are as bellows:

Line 118, 124, 135 of the method "next()" :

public final boolean next() throws IOException {
if (_termPositionsQueue.size() == 0)
return false;

_posList.clear();
[Line 118] _doc = _termPositionsQueue.peek().doc();

TermPositions tp;
do {
tp = _termPositionsQueue.peek();

[Line 124] for (int i = 0; i < tp.freq(); i++)

{ // NOTE: this can result in dup positions being added! _posList.add(tp.nextPosition()); }

if (tp.next())
_termPositionsQueue.updateTop();
else

{ _termPositionsQueue.pop(); tp.close(); }

[Line 135] } while (_termPositionsQueue.size() > 0 && _termPositionsQueue.peek().doc() == _doc);

_posList.sort();
_freq = _posList.size();

return true;

}