Bug #5447: Failure in bin:pack-integer with little-endian negative integer - Saxon - Saxonica Developer Community

Actions

Send by e-mail Copy link

Bug #5447

closed

Failure in bin:pack-integer with little-endian negative integer

Added by Michael Kay about 2 years ago. Updated about 1 year ago.

Status:

Closed

Priority:

Normal

Assignee:

Michael Kay

Category:

EXSLT extensions

Sprint/Milestone:

Start date:

2022-04-04

Due date:

% Done:

100%

Estimated time:

Legacy ID:

Applies to branch:

10, 11, trunk

Fix Committed on Branch:

10, 11, trunk

Fixed in Maintenance Release:

11.4, 12.0, 10.9

Platforms:

Description

At line 1100, in method packBytes (called by pack-integer), is the loop

               while (length > 0)
                    result[i++] = (byte) (255);

which is clearly wrong because the condition doesn't change within the loop.

It's possible that this code is unreachable; more likely, it's not reached by any of our test cases. We have relatively few tests for bin:pack-integer on negative numbers, but it's a complicated path.

Actions

Copy link

Updated by Michael Kay about 2 years ago

The bug can be very easily demonstrated with the test

Q{http://expath.org/ns/binary}pack-integer(-23, 4, 'LE')

(Essentially, any attempt to call pack-integer with a negative value in littleEndian format.

It doesn't cause an infinite loop, it loops until it hits an array-bounds failure:

java.lang.ArrayIndexOutOfBoundsException: Index 4 out of bounds for length 4
	at com.saxonica.functions.extfn.EXPathBinaryFunctionSet.packBytes(EXPathBinaryFunctionSet.java:1096)
	at com.saxonica.functions.extfn.EXPathBinaryFunctionSet.access$800(EXPathBinaryFunctionSet.java:24)
	at com.saxonica.functions.extfn.EXPathBinaryFunctionSet$BinaryPackInteger.call(EXPathBinaryFunctionSet.java:589)

It's rather surprising that there are no test cases that catch this. The "binary" test set from John Lumley appears to have no tests that exercise negative numbers in pack-integer. The "binary2" test set from Christian Grün does have tests for negative numbers, but none of them are little-endian.

Actions

Copy link

Updated by Michael Kay about 2 years ago

Subject changed from Code smell in EXPathBinaryFunctionSet to Failure in bin:pack-integer with little-endian negative integer
Status changed from New to In Progress

Fix tested on main development branch.

Leaving open until tests are updated and the fix is ported to other branches.

Actions

Copy link