Fix integer overflow leading to out-of-bounds read/write

Techcable · Oct 27, 2020 · 0871979 · 0871979
1 parent 9bbd495
commit 0871979
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/classpath/java/io/FileOutputStream.java b/classpath/java/io/FileOutputStream.java
@@ -52,7 +52,7 @@ public void write(byte[] b, int offset, int length) throws IOException {
       throw new NullPointerException();
     }
 
-    if (offset < 0 || offset + length > b.length) {
+    if (offset < 0 || length < 0 || length > b.length || offset > b.length - length) {
       throw new ArrayIndexOutOfBoundsException();
     }