easyice opened a new pull request, #13376: URL: https://github.com/apache/lucene/pull/13376
Closes: https://github.com/apache/lucene/issues/13373 This exception occurs because a negative integer value stores as positive long. In line 376, after a long value `<< 1`, if the sign bit of the **integer** value is 1, it will be a negative number as integer, but a positive numbers as long, when we stores this value as positive long, it would cause `Math.toIntExact` to throw `ArithmeticException` exception. https://github.com/apache/lucene/blob/f12e4899bf0420693e4f524a515dafcf0f21a3d3/lucene/core/src/java/org/apache/lucene/codecs/lucene99/Lucene99PostingsWriter.java#L373-L379 POC code: ```java public void testDelta() { int delta = 1 << 30; long deltaL = delta; deltaL = (deltaL << 1) | 1; System.out.println(deltaL > Integer.MAX_VALUE); // true System.out.println(deltaL); // 2147483649 System.out.println((int) deltaL); // -2147483647 Math.toIntExact(deltaL); // ArithmeticException: integer overflow } ``` TODO: - [ ] add more tests -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: issues-unsubscr...@lucene.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: issues-unsubscr...@lucene.apache.org For additional commands, e-mail: issues-h...@lucene.apache.org
