Name: saf@russia Date: 08/21/96


This bug was found by St.Petersburg Java SQE team (by Mikhail Gorshenev).

The java.lang.String(byte[] ascii,int hibyte,int offset,int count) constructor
does not work with large values of offset+count according to the
Java language specification.

The Java Language specification (Version 1.0, August 1, 1996)
says the following (please see item 20.12.7):

20.12.7 public String(byte[] ascii, int hibyte, int offset, int count)
throws NullPointerException, IndexOutOfBoundsException

This constructor initializes a newly created String object so that it
represents the sequence of characters constructed from a subarray of an
array of 8-bit integer values. The offset argument is the index of the first
byte of the subarray and the count argument specifies the length of the
subarray. Each character c in the result string is constructed from the corresponding element b of the byte subarray in such a way that:

c == ((hibyte & 0xff) << 8) | (b & 0xff)

If ascii is null, then a NullPointerException is thrown.

If offset is negative, or count is negative, or offset+count is larger than
ascii.length, then an IndexOutOfBoundsException is thrown.



Here is the minimized test demonstrating the bug:

----- java_lang_String_Ctor1.java ---------------------------------------
class java_lang_String_Ctor1 {
  public static void main(String argv[]) {
      byte ascii[]={'a','b','c','d','e','f'};
      try {
        String s = new String(ascii,0,5,Integer.MAX_VALUE);
        System.out.println("Test failed: String s = \\"" + s + "\\" created");
      }
      catch (IndexOutOfBoundsException e) {
        System.out.println("Test passed: " + e);
      }
  }
}

----- The output of the test: -------------------------
java.lang.OutOfMemoryError
at java.lang.String.<init>(String.java)
at java_lang_String_Ctor1.main(java_lang_String_Ctor1.java:5)
-------------------------------------------------------


Workaround:
None
======================================================================