Index: modules/luni/src/main/java/java/io/RandomAccessFile.java =================================================================== --- modules/luni/src/main/java/java/io/RandomAccessFile.java (revision 395120) +++ modules/luni/src/main/java/java/io/RandomAccessFile.java (working copy) @@ -294,10 +294,14 @@ * @see #write(int) */ public int read(byte[] buffer, int offset, int count) throws IOException { - openCheck(); - synchronized (repositionLock) { - return (int) fileSystem.read(fd.descriptor, buffer, offset, count); - } + if (offset <= buffer.length && 0 <= count && 0 <= count + && count <= buffer.length - count) { + openCheck(); + synchronized (repositionLock) { + return (int) fileSystem.read(fd.descriptor, buffer, offset, count); + } + } + throw new ArrayIndexOutOfBoundsException(); } /** @@ -711,15 +715,18 @@ * */ public void write(byte[] buffer, int offset, int count) throws IOException { - openCheck(); - synchronized (repositionLock) { - fileSystem.write(fd.descriptor, buffer, offset, count); - } - - // if we are in "rws" mode, attempt to sync file+metadata - if (syncMetadata) { - fd.sync(); - } + if (offset <= buffer.length && 0 <= count && 0 <= count + && count <= buffer.length - count) { + openCheck(); + synchronized (repositionLock) { + fileSystem.write(fd.descriptor, buffer, offset, count); + } + // if we are in "rws" mode, attempt to sync file+metadata + if (syncMetadata) { + fd.sync(); + } + } + throw new ArrayIndexOutOfBoundsException(); } /**