[OAK-2388] Possibility of overflow in file length calculation

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.0.10, 1.1.5
• Component/s: lucene
• Assignee: Chetan Mehrotra
• Reporter: Chetan Mehrotra
• Created: 10/Jan/15 19:00
• Updated: 22/Jan/16 12:31
• Resolved: 12/Jan/15 10:06

Description

In OakDirectory the length of a file is calculated in following way

OakDirectory

        public OakIndexFile(String name, NodeBuilder file) {
            ...
            this.blobSize = determineBlobSize(file);
            this.blob = new byte[blobSize];

            PropertyState property = file.getProperty(JCR_DATA);
            if (property != null && property.getType() == BINARIES) {
                this.data = newArrayList(property.getValue(BINARIES));
            } else {
                this.data = newArrayList();
            }

            this.length = data.size() * blobSize;
            if (!data.isEmpty()) {
                Blob last = data.get(data.size() - 1);
                this.length -= blobSize - last.length();
            }

In above calculation its possible to have an overflow in

this.length = data.size() * blobSize;

As multiplication of two integers result in an integer [1]

[1] http://stackoverflow.com/questions/12861893/casting-result-of-multiplication-two-positive-integers-to-long-is-negative-value

Issue Links

• is related to: OAK-3911 Integer overflow causing incorrect file handling in OakDirectory for file size more than 2 GB