This is the mail archive of the
gcc-bugs@gcc.gnu.org
mailing list for the GCC project.
[Bug java/24461] New: array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib
- From: "jrandom-gcc at i2p dot net" <gcc-bugzilla at gcc dot gnu dot org>
- To: gcc-bugs at gcc dot gnu dot org
- Date: 20 Oct 2005 19:48:22 -0000
- Subject: [Bug java/24461] New: array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib
- Reply-to: gcc-bugzilla at gcc dot gnu dot org
I hate posting bug reports without test cases, but this one
is a bit beyond me - hopefully someone else will know whats up.
Symptom:
java.lang.ArrayIndexOutOfBoundsException
at java.lang.System.arraycopy(java.lang.Object, int, java.lang.Object, int,
int) (/usr/local/gcc-4.0.2/lib/libgcj.so.6.0.0)
at java.util.zip.GZIPInputStream.read(byte[], int, int)
(/usr/local/gcc-4.0.2/lib/libgcj.so.6.0.0)
at java.io.FilterInputStream.read(byte[])
(/usr/local/gcc-4.0.2/lib/libgcj.so.6.0.0)
at net.i2p.i2ptunnel.HTTPResponseOutputStream$Pusher.run()
(/home/jrandom/dev/i2p/build/libi2p.so)
at java.lang.Thread.run() (/usr/local/gcc-4.0.2/lib/libgcj.so.6.0.0)
This occurs on EOF, the buffer passed in to GZIPInputStream is 8KB,
and the length and offset fields are fine too (set by
FilterInputStream as '0, buf.length'). The problem is, I believe,
in the inf.getRemaining() and/or the fixed size buffer in
GZIPInputStream:
byte[] tmp = new byte[8];
// First copy remaining bytes from inflater input buffer.
int avail = inf.getRemaining();
System.arraycopy(this.buf, this.len - avail, tmp, 0, avail);
I have no idea why tmp is 8 bytes long, probably something I don't
understand about zlib. inf.getRemaining() just returns
'z_streamp->avail_in', and from what I can see, that can either be
set explicitly, via inflater.setInput(buf[], off, len), or
implicitly, within zlib's inflate(z_streamp, Z_SYNC_FLUSH).
My very cursory look into inflate(...) leads me nowhere, but
InflaterInputStream.java seems to be allowing arbitrarily large
setInput(buf, 0, buf.length) calls - e.g. line 157. The default
buf.length is 4KB.
Or, maybe is there something in the zlib format such that it will
never have more than 8 bytes uninflated?
FWIW, I'm on the latest zlib (1.2.3) and gcj 4.0.2 (and I haven't
seen any updates on the related classes in gcj's cvsweb)
=jr
--
Summary: array access in either GZIPInputStream, Inflater,
natInflate.cc, or zlib
Product: gcc
Version: 4.0.2
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: java
AssignedTo: unassigned at gcc dot gnu dot org
ReportedBy: jrandom-gcc at i2p dot net
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=24461