Project

Profile

Help

Bug #4971

Deleting an entry from NamespaceMap can cause IndexOutOfBoundsException

Added by Michael Kay about 1 month ago. Updated 5 days ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
Internals
Sprint/Milestone:
-
Start date:
2021-04-17
Due date:
% Done:

0%

Estimated time:
Legacy ID:
Applies to branch:
10, trunk
Fix Committed on Branch:
10, trunk
Fixed in Maintenance Release:

Description

The code at NamespaceMap.put() reads

                n2.prefixes = new String[prefixes.length - 1];
                System.arraycopy(prefixes, 0, n2.prefixes, 0,position);
                System.arraycopy(prefixes, position+1, n2.prefixes, position+1, prefixes.length - position);

The last line crashes because the destination array is too short. I think the 4th argument should be position rather than position+1.

It looks to me as if this path is untested. The failure arose in Saxon-CS development, where the maintenance of namespace maps is handled differently, because the input comes from a pull parser. But the failure certainly could occur in Saxon-10, especially but not exclusively when run with a pull parser.

History

#1 Updated by Michael Kay about 1 month ago

The correct statement appears to be

System.arraycopy(prefixes, position+1, n2.prefixes, position, prefixes.length - position - 1);

and similarly, mutatis mutandis, for the uri array a couple of lines further on.

#2 Updated by Michael Kay 5 days ago

  • Category set to Internals
  • Status changed from New to Resolved
  • Applies to branch 10, trunk added
  • Fix Committed on Branch 10, trunk added

Added a JUnit test NamespaceMapTest.testIncrementalRemove() which demonstrates the bug and shows that the suggested fix works.

Please register to edit this issue

Also available in: Atom PDF