From 1235b6f01f5cab9d28d107655809162384477687 Mon Sep 17 00:00:00 2001 From: "Bruce.Deng" Date: Fri, 22 Sep 2023 10:58:33 +0800 Subject: [PATCH] =?UTF-8?q?REPORT-103466=20=E5=AF=BC=E5=87=BA=E8=B4=9F?= =?UTF-8?q?=E8=BD=BD=E9=AB=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../fr/third/com/lowagie/text/pdf/ByteBuffer.java | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/fine-itext-old/src/main/java/com/fr/third/com/lowagie/text/pdf/ByteBuffer.java b/fine-itext-old/src/main/java/com/fr/third/com/lowagie/text/pdf/ByteBuffer.java index e48934ef0..cc145c26b 100644 --- a/fine-itext-old/src/main/java/com/fr/third/com/lowagie/text/pdf/ByteBuffer.java +++ b/fine-itext-old/src/main/java/com/fr/third/com/lowagie/text/pdf/ByteBuffer.java @@ -82,7 +82,8 @@ public class ByteBuffer extends OutputStream { */ public static boolean HIGH_PRECISION = false; private static final DecimalFormatSymbols dfs = new DecimalFormatSymbols(Locale.US); - + private static final int HALF_INTEGER = Integer.MAX_VALUE >> 1; + /** Creates new ByteBuffer with capacity 128 */ public ByteBuffer() { this(128); @@ -188,8 +189,11 @@ public class ByteBuffer extends OutputStream { */ public ByteBuffer append_i(int b) { int newcount = count + 1; + if (newcount < 0) { + throw new OutOfMemoryError(); + } if (newcount > buf.length) { - byte newbuf[] = new byte[Math.max(buf.length << 1, newcount)]; + byte newbuf[] = new byte[Math.max(Math.min(buf.length, HALF_INTEGER) << 1, newcount)]; System.arraycopy(buf, 0, newbuf, 0, count); buf = newbuf; } @@ -211,8 +215,11 @@ public class ByteBuffer extends OutputStream { ((off + len) > b.length) || ((off + len) < 0) || len == 0) return this; int newcount = count + len; + if (newcount < 0) { + throw new OutOfMemoryError(); + } if (newcount > buf.length) { - byte newbuf[] = new byte[Math.max(buf.length << 1, newcount)]; + byte newbuf[] = new byte[Math.max(Math.min(buf.length, HALF_INTEGER) << 1, newcount)]; System.arraycopy(buf, 0, newbuf, 0, count); buf = newbuf; }