DO NOT REPLY [Bug 20819] New: - Errors in NodeSet.java removeElement and removeElementAt

[bugzilla]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=20819>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=20819

Errors in NodeSet.java removeElement and removeElementAt

           Summary: Errors in NodeSet.java removeElement and removeElementAt
           Product: XalanJ2
           Version: CurrentCVS
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Major
          Priority: Other
         Component: org.apache.xpath
        AssignedTo: [EMAIL PROTECTED]
        ReportedBy: [EMAIL PROTECTED]


1. method removeElementAt - index on arraycopy incorrect, also m_firstFree not 
decremented. i > m_firstFree could pass end of array. Fix is:

public void removeElementAt(int i)
  {
    if ((null == m_map)||(i >= m_firstFree))
      return;
    if (i < m_firstFree-1)
      System.arraycopy(m_map, i + 1, m_map, i, m_firstFree - i);
    else
      m_map[i] = null;
    m_firstFree--;
  }

2. method removeElement(Node s)
Same arraycopy error as above:
Lines:
        if (i > m_firstFree)
          System.arraycopy(m_map, i + 1, m_map, i - 1, m_firstFree - i);

need to change to:

        if (i < m_firstFree-1)
          System.arraycopy(m_map, i + 1, m_map, i, m_firstFree - i);