pcloudcom / pclouddoc

pCloud documentation
19 stars 14 forks source link

Possible invalid array access #5

Open paulholder opened 2 years ago

paulholder commented 2 years ago

In the code

    public int getByte() throws IOException {
    if (bufferOffset >= bytesInBuffer) {
        fillBuffer();
    }
    return buffer[bufferOffset++] & 0xff;
    }

the call to fillBuffer()

    private void fillBuffer() throws IOException {
    if (length == 0) {
        throw (new IOException());
    }
    int cnt = 4096;
    if (cnt > length) {
        cnt = length;
    }
    bytesInBuffer = istream.read(buffer, 0, cnt);
    if (bytesInBuffer == -1) {
        throw (new IOException());
    }
    length -= bytesInBuffer;
    bufferOffset = 0;
    }

could potentially return having read less than a full buffer (in the case of network congestion or othewise). In particular the line bytesInBuffer = istream.read(buffer, 0, cnt); is not guaranteed to get all cnt bytes it wants.

It would then be possible that the reference to buffer[bufferOffset++] would not contain valid data.