From 6f90c9d6cd663f4d4cda9891e107c05df9e086f0 Mon Sep 17 00:00:00 2001 From: Kamil Krzywanski Date: Wed, 15 Jul 2026 11:52:48 +0200 Subject: [PATCH] fix: keep strBuf in sync after mid-loop growth, for issue #7671 JSONReaderUTF16 grew a local strBuf while decoding escaped strings but did not always write the larger array back to this.strBuf. Later reads then re-grew from a stale smaller buffer. Always assign this.strBuf after allocate/grow (including mid-loop) so the reusable buffer stays in sync. The AIOOBE reported in #7671 on 2.0.61 is already fixed on main by #3989; this is a buffer-reuse follow-up. --- .../main/java/com/alibaba/fastjson2/JSONReaderUTF16.java | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/core/src/main/java/com/alibaba/fastjson2/JSONReaderUTF16.java b/core/src/main/java/com/alibaba/fastjson2/JSONReaderUTF16.java index 94232139b3..74c0f370d3 100644 --- a/core/src/main/java/com/alibaba/fastjson2/JSONReaderUTF16.java +++ b/core/src/main/java/com/alibaba/fastjson2/JSONReaderUTF16.java @@ -3254,12 +3254,10 @@ public String readString() { char[] strBuf = this.strBuf; if (strBuf == null) { strBuf = new char[stroff + 512]; - this.strBuf = strBuf; } else if (stroff > strBuf.length) { - int newCapacity = newCapacity(stroff, strBuf.length); - strBuf = new char[newCapacity]; - this.strBuf = strBuf; + strBuf = new char[newCapacity(stroff, strBuf.length)]; } + this.strBuf = strBuf; System.arraycopy(chars, start, strBuf, 0, stroff); while (true) { @@ -3272,6 +3270,7 @@ public String readString() { if (stroff + 4 >= strBuf.length) { strBuf = Arrays.copyOf(strBuf, newCapacity(stroff + 4, strBuf.length)); + this.strBuf = strBuf; } IOUtils.putLongLE(strBuf, stroff, v); @@ -3300,6 +3299,7 @@ public String readString() { } if (stroff == strBuf.length) { strBuf = Arrays.copyOf(strBuf, newCapacity(stroff + 1, strBuf.length)); + this.strBuf = strBuf; } strBuf[stroff++] = c; offset++;