Fix problems from large array index #105
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This fixes a possible OutOfMemory problem and NegativeArraySizeException in diffutils/src/me/xdrop/diffutils/DiffUtils.java.
In the
getEditOps()
method of the DiffUtils class, the length of two strings (after removing matching suffix) are used to create the resulting matrix. The matrix is a 1D array with the size of the multiply of the two string lengths. There are two possible ways that this could go wrong if the two string length is too large. Firstly, if the multiplication result exceeds theInteger.MAX_VALUE
of java, it will wrap around and stored as a negative number. This makes the creation of the matrix array throws a NegativeArraySizeException. In other cases, if the multiplication result does not exceed theInteger.MAX_VALUE
of java but exceed the remaining size of the heap storage, it will cause an OutOfMemoryError. Sometimes, it does not need to happen immediately because there may be enough memory to create the big matrix but not enough to allocate for other variables in later operations.This PR suggests to fix the problem by setting a class variable to define the maximum matrix size allowed. If the multiplication result is larger than the limit or is negative, then just throw an IllegalArgumentException to indicate the two strings are too long to process.
We found this bug using fuzzing by way of OSS-Fuzz, where we recently integrated fuzzywuzzy (google/oss-fuzz#10744). OSS-Fuzz is a free service run by Google for fuzzing important open source software. If you'd like to know more about this then I'm happy to go into detail and also set up things so you can receive emails and detailed reports when bugs are found.