[
https://issues.apache.org/jira/browse/NUMBERS-212?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Alex Herbert updated NUMBERS-212:
---------------------------------
Description:
The MultidimensionalCounter uses int arithmetic to accumulate the product of
the dimensions. This rejects negative values as overflow. However it can be
constructed with a product of dimensions sizes above the limit of an unsigned
integer 2^32. This wraps around to a positive value and is not detected during
construction:
{code:java}
// 65537L * 65536 % (1L << 32) == 65536
MultidimensionalCounter mdc = MultidimensionalCounter.of(65537, 65536);{code}
The resulting counter will returned incorrect index mappings as there are too
many positions to map to 2^31 values.
This can be corrected by using long arithmetic to compute the product of two
representable positive int values (which cannot overflow) and rejecting any
size greater or equal to 2^31.
Issue identified with a security scanner.
was:
The MultidimensionalCounter uses int arithmetic to accumulate the product of
the dimensions. This rejects negative values as overflow. However it can be
constructed with a product of dimensions sizes above the limit of an unsigned
integer 2^32. This wraps around to a positive value and is not detected during
construction:
{code:java}
// 65537L * 65536 % (1L << 32) == 65536
MultidimensionalCounter mdc = MultidimensionalCounter.of(65537, 65536);{code}
The resulting counter will returned incorrect index mappings as there are too
many positions to map to 2^31 values.
This can be corrected by using long arithmetic to compute the product of two
representable positive int values (which cannot overflow) and rejecting any
size greater or equal to 2^31.
Issue identified with a security scanner.
> MultidimensionalCounter does not detect modulo 2^32 overflow in the
> cumulative size
> -----------------------------------------------------------------------------------
>
> Key: NUMBERS-212
> URL: https://issues.apache.org/jira/browse/NUMBERS-212
> Project: Commons Numbers
> Issue Type: Bug
> Components: arrays
> Affects Versions: 1.3
> Reporter: Alex Herbert
> Priority: Minor
>
> The MultidimensionalCounter uses int arithmetic to accumulate the product of
> the dimensions. This rejects negative values as overflow. However it can be
> constructed with a product of dimensions sizes above the limit of an unsigned
> integer 2^32. This wraps around to a positive value and is not detected
> during construction:
> {code:java}
> // 65537L * 65536 % (1L << 32) == 65536
> MultidimensionalCounter mdc = MultidimensionalCounter.of(65537, 65536);{code}
> The resulting counter will returned incorrect index mappings as there are too
> many positions to map to 2^31 values.
> This can be corrected by using long arithmetic to compute the product of two
> representable positive int values (which cannot overflow) and rejecting any
> size greater or equal to 2^31.
> Issue identified with a security scanner.
>
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
