A DESCRIPTION OF THE PROBLEM :
Location.getCharacterOffset() answers values well beyond input length. This appears to be a bug in com.sun.org.apache.xerces.internal.impl.XMLEntityScanner#getCharacterOffset() & com.sun.org.apache.xerces.internal.impl.XMLEntityScanner#load().

From debugging it seems loading can operate consecutively into the buffer, without advancing the logical start offset, but this is incorrectly added to fTotalCountTillLastLoad. Since both position and fTotalCountTillLastLoad increase the resulting character-offset tends to be double-counted.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Run test case below.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Location.CharacterOffset should be <= input length (69). Testcase should pass.
ACTUAL -
Location.CharacterOffset is 133, far beyond input length. Testcase fails.

---------- BEGIN SOURCE ----------
package example.xml;

import org.junit.Assert;
import org.junit.Test;

import javax.xml.stream.XMLInputFactory;
import javax.xml.stream.XMLStreamReader;
import java.io.StringReader;

public class XmlInputStream_Location_Test {

    @Test
    public void testStaxLocationOOB() throws Exception {
        var EXAMPLE = "<?xml version='1.0' encoding='UTF-8'?><configuration></configuration>";
        System.out.println(String.format("XML input length=%d", EXAMPLE.length()));

        // parse via STAX InputStreamReader
        XMLInputFactory factory = XMLInputFactory.newInstance(); // gives com.sun.xml.internal.stream.XMLInputFactoryImpl
        var reader = factory.createXMLStreamReader(new StringReader(EXAMPLE));
        // read
        Assert.assertEquals( XMLStreamReader.START_ELEMENT, reader.next());
        Assert.assertEquals( XMLStreamReader.END_ELEMENT, reader.next());
        int charOffset = reader.getLocation().getCharacterOffset();
        //
        // check End Element location is within size of input string.
        System.out.println(String.format("END_ELEMENT at charOffset=%d", charOffset));
        Assert.assertTrue("CharOffset expected within/ or at end of input", charOffset <= EXAMPLE.length());
    }

}
---------- END SOURCE ----------