-
Bug
-
Resolution: Unresolved
-
P4
-
None
-
6
-
None
-
generic
-
generic
Current implementation of sun.awt.FontConfiguration.loadBinary(InputStream is)
has following code:
248 int len = tableSizes[INDEX_stringTable];
249 byte[] bb = new byte[len * 2];
250 table_stringTable = new char[len];
251 in.read(bb);
252 int i = 0, j = 0;
253 while (i < len) {
254 table_stringTable[i++] = (char)(bb[j++] << 8 | (bb[j++] & 0xff));
255 }
However, InputStream.read(byte[] b) doesn't guarantee that exactly b.length
bytes will be read. So, the code has potential problems in case less than bb.length
bytes are returned. While this is probably hardly reproducible in real
apps theoretically it might happen - so it seems better to update code to protect from this.
E.g.
int totalReaded = 0;
while (totalReaded < bb.length)
{
totaleReaded += in.read(bb, totaleReaded, bb.length - totaleReaded);
}
Note that similar problem is present in sun.awt.FontConfiguration.readShortTable:
1567 private static short[] readShortTable(DataInputStream in, int len)
1568 throws IOException {
1569 if (len == 0) {
1570 return EMPTY_SHORT_ARRAY;
1571 }
1572 short[] data = new short[len];
1573 byte[] bb = new byte[len * 2];
1574 in.read(bb);
1575 int i = 0,j = 0;
1576 while (i < len) {
1577 data[i++] = (short)(bb[j++] << 8 | (bb[j++] & 0xff));
1578 }
1579 return data;
1580 }
has following code:
248 int len = tableSizes[INDEX_stringTable];
249 byte[] bb = new byte[len * 2];
250 table_stringTable = new char[len];
251 in.read(bb);
252 int i = 0, j = 0;
253 while (i < len) {
254 table_stringTable[i++] = (char)(bb[j++] << 8 | (bb[j++] & 0xff));
255 }
However, InputStream.read(byte[] b) doesn't guarantee that exactly b.length
bytes will be read. So, the code has potential problems in case less than bb.length
bytes are returned. While this is probably hardly reproducible in real
apps theoretically it might happen - so it seems better to update code to protect from this.
E.g.
int totalReaded = 0;
while (totalReaded < bb.length)
{
totaleReaded += in.read(bb, totaleReaded, bb.length - totaleReaded);
}
Note that similar problem is present in sun.awt.FontConfiguration.readShortTable:
1567 private static short[] readShortTable(DataInputStream in, int len)
1568 throws IOException {
1569 if (len == 0) {
1570 return EMPTY_SHORT_ARRAY;
1571 }
1572 short[] data = new short[len];
1573 byte[] bb = new byte[len * 2];
1574 in.read(bb);
1575 int i = 0,j = 0;
1576 while (i < len) {
1577 data[i++] = (short)(bb[j++] << 8 | (bb[j++] & 0xff));
1578 }
1579 return data;
1580 }