Copilot commented on code in PR #3301:
URL: https://github.com/apache/cxf/pull/3301#discussion_r3555493723
##########
core/src/main/java/org/apache/cxf/helpers/IOUtils.java:
##########
@@ -426,15 +438,23 @@ public static void consume(final InputStream input,
n = input.read(buffer, 0, n);
}
}
-
+
+ /**
+ * @deprecated use {@link #readBytesFromStream(InputStream, int)}
+ */
+ @Deprecated(forRemoval = true)
public static byte[] readBytesFromStream(InputStream in) throws
IOException {
+ return readBytesFromStream(in, -1);
+ }
+
+ public static byte[] readBytesFromStream(InputStream in, int maxSize)
throws IOException {
Objects.requireNonNull(in, "The inputStream is required but null value
was provided");
int i = in.available();
if (i < DEFAULT_BUFFER_SIZE) {
i = DEFAULT_BUFFER_SIZE;
}
Review Comment:
`readBytesFromStream(InputStream,int)` still preallocates the
`ByteArrayOutputStream` based on `in.available()` without taking `maxSize` into
account. For streams where `available()` is large (e.g., `ByteArrayInputStream`
/ file-backed streams), this can allocate far more than `maxSize` (or even OOM)
before the size check in `copy(...)` can trigger.
##########
core/src/main/java/org/apache/cxf/helpers/IOUtils.java:
##########
@@ -228,6 +236,10 @@ public static int copy(final InputStream input, final
OutputStream output,
output.write(buffer, 0, n);
total += n;
n = input.read(buffer);
+
+ if (maxSize > 0 /* -1 sets to unlimited */ && total > maxSize) {
+ throw new IOException("The total limit of " + maxSize + "
bytes exceeded, data is too large");
+ }
Review Comment:
The inline comment says "-1 sets to unlimited", but the condition treats any
`maxSize <= 0` as unlimited (`maxSize > 0`). Either the comment or the
condition should be updated to avoid misleading callers/configuration.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
