Fix integer overflow leading to out-of-bounds read/write

polivar3 · dicej · commit 0871979b298a · 2020-10-27T09:35:05.000-06:00
diff --git a/classpath/java/io/FileOutputStream.java b/classpath/java/io/FileOutputStream.java
@@ -52,7 +52,7 @@ public void write(byte[] b, int offset, int length) throws IOException {
       throw new NullPointerException();
     }
 
-    if (offset < 0 || offset + length > b.length) {
+    if (offset < 0 || length < 0 || length > b.length || offset > b.length - length) {
       throw new ArrayIndexOutOfBoundsException();
     }
 

Original file line number	Diff line number	Diff line change
`@@ -52,7 +52,7 @@ public void write(byte[] b, int offset, int length) throws IOException {`
`52`	`52`	`throw new NullPointerException();`
`53`	`53`	`}`
`54`	`54`
`55`		`- if (offset < 0 \|\| offset + length > b.length) {`
	`55`	`+ if (offset < 0 \|\| length < 0 \|\| length > b.length \|\| offset > b.length - length) {`
`56`	`56`	`throw new ArrayIndexOutOfBoundsException();`
`57`	`57`	`}`
`58`	`58`