Actions
Bug #4971
closedDeleting an entry from NamespaceMap can cause IndexOutOfBoundsException
Start date:
2021-04-17
Due date:
% Done:
100%
Estimated time:
Legacy ID:
Applies to branch:
10, trunk
Fix Committed on Branch:
10, trunk
Fixed in Maintenance Release:
Platforms:
Description
The code at NamespaceMap.put() reads
n2.prefixes = new String[prefixes.length - 1];
System.arraycopy(prefixes, 0, n2.prefixes, 0,position);
System.arraycopy(prefixes, position+1, n2.prefixes, position+1, prefixes.length - position);
The last line crashes because the destination array is too short. I think the 4th argument should be position rather than position+1.
It looks to me as if this path is untested. The failure arose in Saxon-CS development, where the maintenance of namespace maps is handled differently, because the input comes from a pull parser. But the failure certainly could occur in Saxon-10, especially but not exclusively when run with a pull parser.
Please register to edit this issue
Actions