From 41e797f4da74e898ea32042d1619cc37383df26d Mon Sep 17 00:00:00 2001 From: Sean Mullan Date: Wed, 12 Oct 2016 09:46:35 -0400 Subject: [PATCH] 8162723: Array index overflow in Base64 utility class Reviewed-by: ascarpino, jnimeh --- .../org/apache/xml/internal/security/utils/Base64.java | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/jdk/src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/utils/Base64.java b/jdk/src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/utils/Base64.java index de822922b36..37dd499e727 100644 --- a/jdk/src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/utils/Base64.java +++ b/jdk/src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/utils/Base64.java @@ -376,14 +376,14 @@ public class Base64 { return null; } - int lengthDataBits = binaryData.length * EIGHTBIT; - if (lengthDataBits == 0) { + long lengthDataBits = ((long) binaryData.length) * ((long) EIGHTBIT); + if (lengthDataBits == 0L) { return ""; } - int fewerThan24bits = lengthDataBits % TWENTYFOURBITGROUP; - int numberTriplets = lengthDataBits / TWENTYFOURBITGROUP; - int numberQuartet = fewerThan24bits != 0 ? numberTriplets + 1 : numberTriplets; + long fewerThan24bits = lengthDataBits % TWENTYFOURBITGROUP; + int numberTriplets = (int) (lengthDataBits / TWENTYFOURBITGROUP); + int numberQuartet = fewerThan24bits != 0L ? numberTriplets + 1 : numberTriplets; int quartesPerLine = length / 4; int numberLines = (numberQuartet - 1) / quartesPerLine; char encodedData[] = null;