[
https://issues.apache.org/jira/browse/LANG-1824?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18078999#comment-18078999
]
Veijo Vainionpää commented on LANG-1824:
----------------------------------------
{code:java}
@Test
public void testReplaceWithLargerReplacement() {
final String searchString = "$$PLACEHOLDER$$";
final String text = "--BEGIN--\n" + searchString + "\n--END--";
final String replacement = RandomStringUtils.random( 134217727 +
searchString.length() );
final int expected = text.replace( searchString, replacement ).length();
final int result = StringUtils.replace( text, searchString, replacement
).length();
assertEquals( expected, result );
}{code}
> NegativeArraySizeException thrown from Strings.replace with larger replacement
> ------------------------------------------------------------------------------
>
> Key: LANG-1824
> URL: https://issues.apache.org/jira/browse/LANG-1824
> Project: Commons Lang
> Issue Type: Bug
> Components: lang.*
> Affects Versions: 3.20.0
> Reporter: Veijo Vainionpää
> Priority: Major
>
> NegativeArraySizeException thrown from Strings.replace with larger
> replacement when {{replacement.length() - searchString.length()}} is bigger
> than 134217727 bytes (~132 MB).
> {{public String replace(final String text, String searchString, final String
> replacement, int max) {}}
> {{...}}
> {{final int replLength = searchString.length();}}
> {{int increase = Math.max(replacement.length() - replLength, 0);}}
> {{increase *= max < 0 ? 16 : Math.min(max, 64);}}
> {{final StringBuilder buf = new StringBuilder(text.length() + increase);}}
> {{...}}
> {{}}}
> The main reason is that the integer overflows after multiplication.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
