Return-Path: Delivered-To: apmail-cocoon-dev-archive@www.apache.org Received: (qmail 55322 invoked from network); 20 Oct 2004 16:16:15 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (209.237.227.199) by minotaur-2.apache.org with SMTP; 20 Oct 2004 16:16:15 -0000 Received: (qmail 70670 invoked by uid 500); 20 Oct 2004 16:16:08 -0000 Delivered-To: apmail-cocoon-dev-archive@cocoon.apache.org Received: (qmail 70584 invoked by uid 500); 20 Oct 2004 16:16:07 -0000 Mailing-List: contact dev-help@cocoon.apache.org; run by ezmlm Precedence: bulk list-help: list-unsubscribe: list-post: Reply-To: dev@cocoon.apache.org Delivered-To: mailing list dev@cocoon.apache.org Received: (qmail 70545 invoked by uid 99); 20 Oct 2004 16:16:07 -0000 X-ASF-Spam-Status: No, hits=1.5 required=10.0 tests=GAPPY_SUBJECT X-Spam-Check-By: apache.org Received-SPF: neutral (hermes.apache.org: local policy) Received: from [81.209.148.130] (HELO dd2020.kasserver.com) (81.209.148.130) by apache.org (qpsmtpd/0.28) with ESMTP; Wed, 20 Oct 2004 09:16:05 -0700 Received: from [192.168.20.145] (unknown [81.2.149.2]) by dd2020.kasserver.com (Postfix) with ESMTP id 7A7AF144930 for ; Wed, 20 Oct 2004 18:15:58 +0200 (CEST) Message-ID: <41768FFC.804@apache.org> Date: Wed, 20 Oct 2004 18:19:08 +0200 From: Torsten Curdt User-Agent: Mozilla Thunderbird 0.8 (X11/20041012) X-Accept-Language: en-us, en MIME-Version: 1.0 To: dev@cocoon.apache.org Subject: Re: ArrayIndexOOB in o.a.c.c.serializers.util.Namespaces References: In-Reply-To: X-Enigmail-Version: 0.86.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N Pier, I was referring to something similar in the serializer thread. cheers -- Torsten > The problem occurs here (line marked with *): > > public String[][] commit() { > int size = this.depth - this.last; > String result[][] = new String[size][2]; > int k = 0; > for (int x = this.last; x < this.depth; x++) { > * result[k][NAMESPACE_PREFIX] = this.pre[x]; > > > > For debugging, I added some logging to the push() and pop() methods. > This is the result (the number at the end of the line is the current > Namespaces.last field): > > > [...] > push [i18n] 4 > push [xsp] 4 > push [input] 4 > push [xspdoc] 4 > push [esql] 4 > push [xsp-vvz-e] 4 > push [tree] 4 > pop [tree] 3 > pop [xsp-vvz-e] 2 > pop [esql] 1 > pop [xspdoc] 0 > pop [input] -1 > pop [xsp] -2 > pop [i18n] -3 > pop [vvz] -4 > [...] > > > Apparently this.last is increased on push, but not decreased on pop > which leads to a negative array index. Any ideas what goes wrong?