FastByteArrayOutputStream input stream rejects valid skip(long) arguments
维护者通常 1 天内回复
@hickey-ai 已经在做这个了。
开始于 2026年10月17日。
评估
调研方向
该缺陷位于 spring-core/src/main/java/org/springframework/util/FastByteArrayOutputStream.java 中输入流的 skip(long) 方法里,该方法在检查剩余字节数之前就拒绝了负数和过大的值。编译并运行 issue 中的 Repro.java,查看两个 IllegalArgumentException 的情况。完成的标准是 skip(-1) 返回 0,skip(Integer.MAX_VALUE + 1) 返回剩余字节数,并且现有测试仍然通过。
由索引模型根据 Issue 内容生成。
描述
Affected versions
Verified with the published spring-core 7.0.9 and 6.2.19 artifacts on JDK 21. The same result was reproduced with the affected classes compiled from main at 85a532dce455655aec8fd5a301b37c6c5ceda5bb, with the remaining dependencies supplied by spring-core 7.0.9. This was a focused reproduction, not a full Gradle build.
Problem
The input stream returned by FastByteArrayOutputStream.getInputStream() throws IllegalArgumentException from skip(long) for negative amounts and for amounts larger than Integer.MAX_VALUE.
The InputStream contract says negative amounts skip no bytes and return 0. A large positive amount should skip the available bytes, even if fewer than requested are available. This can break generic stream code that uses a long skip amount independent of the backing stream's capacity.
The reproduction below buffers only three bytes; it does not require a large allocation.
Minimal reproduction
Save as Repro.java:
import java.io.ByteArrayInputStream;
import org.springframework.util.FastByteArrayOutputStream;
public class Repro {
public static void main(String[] args) throws Exception {
byte[] bytes = {1, 2, 3};
var output = new FastByteArrayOutputStream();
output.write(bytes);
for (long amount : new long[] {-1, (long) Integer.MAX_VALUE + 1}) {
System.out.println("JDK: " + new ByteArrayInputStream(bytes).skip(amount));
try {
System.out.println("Spring: " + output.getInputStream().skip(amount));
} catch (IllegalArgumentException ex) {
System.out.println("Spring: " + ex);
}
}
}
}
Run on Java 17 or later:
curl -fLO https://repo.maven.apache.org/maven2/org/springframework/spring-core/7.0.9/spring-core-7.0.9.jar
java -cp spring-core-7.0.9.jar Repro.java
Actual output:
JDK: 0
Spring: java.lang.IllegalArgumentException: n must be 0 or greater: -1
JDK: 3
Spring: java.lang.IllegalArgumentException: n exceeds maximum (2147483647): 2147483648
Expected: the Spring results should also be 0 and 3, respectively. A positive request larger than the stream's remaining size should simply consume the remaining bytes.
Cause
FastByteArrayInputStream.skip rejects those values before examining the available bytes. The stream's int-sized internal buffers do not require rejection of long requests; the request can be bounded by the remaining byte count before conversion.
See the Java InputStream.skip contract.
Related reports checked
I searched issues and pull requests for FastByteArrayOutputStream skip, FastByteArrayInputStream, and skip Integer.MAX_VALUE. The older reports found (#18431, #18783, #18809, #22024) concern read/EOF behavior, not the skip argument handling above. I did not find a direct duplicate.
- 主要语言
- Java
- 星标
- 60.3k
- 派生
- 38.7k
- 平均合并
- 1 天 9 小时
- 30 天内合并 PR
- 34
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue,再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库,在一个分支上完成修改。
- 提交 Pull Request,并在描述里引用这个 Issue 编号。
spring-projects/spring-framework 的其他 Issue
-
`YamlProcessor.getFlattenedMap` with `includeEmpty` returns a `null` key for an empty root mapping可能重新可做 @erfannvb 于 8 天前认领,目前没有进行中的 PR。 未关闭status: waiting-for-triage
难度 2/5 1-3 小时 新手友好度 78/100
spring-projects/spring-framework#37522 · 1 条评论 ·
维护者通常 1 天内回复
-
`WebClient` with default codecs drops `ProblemDetail` extension members可能重新可做 关联的 PR 已关闭且未合并。 未关闭status: waiting-for-triage
难度 2/5 1-3 小时 新手友好度 70/100
spring-projects/spring-framework#37503 · 1 条评论 ·
维护者通常 1 天内回复
-
StandardApiVersionDeprecationHandler generates nonconforming Sunset HTTP dates可能重新可做 关联的 PR 已关闭且未合并。 未关闭status: waiting-for-triage
难度 2/5 1-3 小时 新手友好度 68/100
spring-projects/spring-framework#37486 · 4 条评论 ·
维护者通常 1 天内回复
-
LinkedCaseInsensitiveMap.keySet().remove returns false after removing a null-valued entry可能重新可做 关联的 PR 已关闭且未合并。 未关闭status: waiting-for-triage
难度 2/5 1-3 小时 新手友好度 78/100
spring-projects/spring-framework#37470 · 3 条评论 ·
维护者通常 1 天内回复
-
ServerSentEventHttpMessageReader does not recognize data fields without a colon可能重新可做 关联的 PR 已关闭且未合并。 未关闭in: web status: waiting-for-triage
难度 2/5 1-3 小时 新手友好度 76/100
spring-projects/spring-framework#37461 · 1 条评论 ·
维护者通常 1 天内回复
查看 spring-projects/spring-framework 的全部 Issue
相似的 Issue
-
Good First Issue
难度 1/5 1 小时以内 新手友好度 75/100
hiero-ledger/hiero-sdk-java#3025 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 80/100
-
DogFooding
难度 1/5 1 小时以内 新手友好度 88/100
OpenAEV-Platform/openaev#8768 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 82/100
federicoiosue/Omni-Notes#1039 ·
-
type: bug
难度 2/5 1-3 小时 新手友好度 64/100
micronaut-projects/micronaut-core#14179 ·
维护者通常 1 天内回复