Details
-
Type:
Bug
-
Status:
Resolved
-
Priority:
Critical
-
Resolution: Fixed
-
Affects Version/s: 6.0.0beta17
-
Fix Version/s: 6.0.0beta18, 6.0.0RC0
-
Component/s: None
-
Labels:None
-
Environment:Linux, special characters in HTML data
-
Number of attachments :
Description
There is a bug in jetty-6.0.0beta17\modules\jetty\src\main\java\org\mortbay\jetty\HttpGenerator.java at line 1244.
This is within the method OutputWriter.write().
The faulty line 1244 is:
_converter.write(_chars,i0,i-i0);
It should be:
_converter.write(_chars,i0,n-i0);
(n must be used instead of i)
And line 1241:
n+=_writeChunk/2;
should be changed to:
n+=(_writeChunk-1)/2;
because the _bytes buffer is only _writeChunk*2 long and n has already been increased by 1 at the previous line.
The stack trace for this error is:
java.lang.IndexOutOfBoundsException
at sun.nio.cs.StreamEncoder.write(Unknown Source)
at java.io.OutputStreamWriter.write(Unknown Source)
at org.mortbay.jetty.HttpGenerator$OutputWriter.write(HttpGenerator.java:1244)
at java.io.PrintWriter.write(Unknown Source)
at java.io.PrintWriter.write(Unknown Source)
at ApplServletResponseSender.sendTextResponse(Unknown Source)
at ApplServletResponseSender.sendHttpResponse(Unknown Source)
...
Is there a guarantee that _converter only produces at most twice as much bytes as the number of characters feed? (UTF8 may produce up to 4 bytes per character, but the UTF8 case seems to be already handled separately on line 1198.)
Correction: The change at line 1241 is probably not necessary, because the term _writeChunk/2 is not to prevent a buffer overflow. The outer loop continues to fill the buffer.
But line 1244 is a real bug.