Skip to content

fix off-by-one out-of-bounds write in EmulatedCharset.getBytes#10326

Open
metsw24-max wants to merge 1 commit into
gwtproject:mainfrom
metsw24-max:emulatedcharset-latin-offset
Open

fix off-by-one out-of-bounds write in EmulatedCharset.getBytes#10326
metsw24-max wants to merge 1 commit into
gwtproject:mainfrom
metsw24-max:emulatedcharset-latin-offset

Conversation

@metsw24-max

Copy link
Copy Markdown

Noticed LatinCharset.getBytes writes bytes[i] while i runs from offset, but bytes is only count long. So OutputStreamWriter.write(buf, offset, count) with a non-zero offset on ISO-8859-1/Latin-1 writes past the output array and leaves bytes[0..offset) unwritten; the precondition check only validates offset/count against the input buffer. Index the destination with i - offset.

@niloc132

niloc132 commented Jun 1, 2026

Copy link
Copy Markdown
Member

Thanks - at a quick glance that looks correct, and confirmed that the test fails without the change (and passes with it).

The fork Google made also appears to need this fix: https://github.com/google/j2cl/blob/master/jre/java/javaemul/internal/EmulatedCharset.java

@metsw24-max

Copy link
Copy Markdown
Author

Good point, the LatinCharset code is identical over there. I'll send the same one-line fix to j2cl.

@zbynek zbynek added the ready This PR has been reviewed by a maintainer and is ready for a CI run. label Jun 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ready This PR has been reviewed by a maintainer and is ready for a CI run.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants