[
https://issues.apache.org/jira/browse/PDFBOX-2869?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jesse Long updated PDFBOX-2869:
-------------------------------
Description:
Under some specific circumstances, ScratchFileBuffer can get corrupted when
reading.
These circumstances are, when the completely written buffer length is a
multiple of 4080, and the read(byte[], int, int) method is used to read till
the end of the buffer.
Each page contains 4080 bytes. The last 8 bytes are a pointer to the next page.
This next page pointer is only written if the next page is needed, not if the
page is full but no further pages are needed.
The bug is in the read(byte[], int, int) method which, after reading all bytes
from a page, tries to move to the next page, regardless of whether or not there
is actually a next page.
The read(byte[], int, int) method must be changed to only read the next page
pointer if the end of buffer is not reached.
was:
Under some specific circumstances, ScratchFileBuffer can get corrupted when
reading.
These circumstances are, when the completely written buffer length is a
multiple of 4080, and the read(byte[], int, int) method is used to read till
the end of the buffer, followed by a seek().
Each page contains 4080 bytes. The last 8 bytes are a pointer to the next page.
This next page pointer is only written if the next page is needed, not if the
page is full but no further pages are needed.
The bug is in the read(byte[], int, int) method which, after reading all bytes
from a page, tries to move to the next page, regardless of whether or not there
is actually a next page.
The read(byte[], int, int) method must be changed to only read the next page
pointer if the end of buffer is not reached.
> Corruption in ScratchFileBuffer
> -------------------------------
>
> Key: PDFBOX-2869
> URL: https://issues.apache.org/jira/browse/PDFBOX-2869
> Project: PDFBox
> Issue Type: Bug
> Components: Parsing
> Affects Versions: 2.0.0
> Reporter: Jesse Long
> Attachments: PDFBOX-2869.patch
>
>
> Under some specific circumstances, ScratchFileBuffer can get corrupted when
> reading.
> These circumstances are, when the completely written buffer length is a
> multiple of 4080, and the read(byte[], int, int) method is used to read till
> the end of the buffer.
> Each page contains 4080 bytes. The last 8 bytes are a pointer to the next
> page. This next page pointer is only written if the next page is needed, not
> if the page is full but no further pages are needed.
> The bug is in the read(byte[], int, int) method which, after reading all
> bytes from a page, tries to move to the next page, regardless of whether or
> not there is actually a next page.
> The read(byte[], int, int) method must be changed to only read the next page
> pointer if the end of buffer is not reached.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
