#923 Fixed: IndexOutOfBoundsException in FBCachedBlob.getBytes(long, int) for position or length beyond end of data

Author: mrotteveel

src/docs/asciidoc/release_notes.adoc

@@ -49,6 +49,7 @@ This results in two minor breaking changes:
 ** Reserved words are no longer considered simple identifiers by `enquoteIdentifier` and `isSimpleIdentifier` and will be quoted (or -- for dialect 1 -- result in a `SQLFeatureNotSupportedException`)
 ** Presence of the NUL character (U+0000) in an identifier passed to `enquoteIdentifier` will result in a `SQLSyntaxErrorException`
 * Fixed: JDBC escapes should not be parsed inside dialect 3 delimited identifiers or dialect 1 string literals (https://github.com/FirebirdSQL/jaybird/issues/921[#921])
+* Fixed: `IndexOutOfBoundsException` in `FBCachedBlob.getBytes(long, int)` for position or length beyond end of data (https://github.com/FirebirdSQL/jaybird/issues/923[#923])
 
 === Jaybird 6.0.4
 

src/main/org/firebirdsql/jdbc/FBCachedBlob.java

@@ -20,6 +20,7 @@
 
 import org.firebirdsql.gds.JaybirdErrorCodes;
 import org.firebirdsql.gds.ng.FbExceptionBuilder;
+import org.firebirdsql.jaybird.util.ByteArrayHelper;
 import org.firebirdsql.util.InternalApi;
 
 import java.sql.SQLException;
@@ -88,15 +89,17 @@ public byte[] getBytes(long pos, int length) throws SQLException {
         if (pos < 1) {
             throw new SQLException("Expected value of pos > 0, got " + pos,
                     SQLStateConstants.SQL_STATE_INVALID_STRING_LENGTH);
-        }
-        if (length < 0) {
+        } else if (length < 0) {
             throw new SQLException("Expected value of length >= 0, got " + length,
                     SQLStateConstants.SQL_STATE_INVALID_STRING_LENGTH);
         }
         checkClosed();
+        byte[] blobData = this.blobData;
         if (blobData == null) return null;
 
-        // TODO What if pos or length are beyond blobData
+        if (pos > blobData.length) return ByteArrayHelper.emptyByteArray();
+        length = (int) Math.min(length, blobData.length - pos + 1L);
+
         byte[] result = new byte[length];
         System.arraycopy(blobData, (int) pos - 1, result, 0, length);
         return result;

src/test/org/firebirdsql/jdbc/FBCachedBlobTest.java

@@ -21,6 +21,8 @@
 import org.firebirdsql.gds.JaybirdErrorCodes;
 import org.hamcrest.Matcher;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 
 import java.io.ByteArrayOutputStream;
 import java.io.InputStream;
@@ -31,6 +33,7 @@
 import static org.firebirdsql.common.matchers.SQLExceptionMatchers.*;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.CoreMatchers.*;
+import static org.hamcrest.Matchers.greaterThan;
 import static org.junit.jupiter.api.Assertions.*;
 
 /**
@@ -162,6 +165,28 @@ void testGetBytes_long_int() throws Exception {
         assertArrayEquals(new byte[] { 5, 6, 7, 8, 9 }, data, "Unexpected data");
     }
 
+    @ParameterizedTest
+    @ValueSource(longs = { 11, Integer.MAX_VALUE, Integer.MAX_VALUE + 1L, Long.MAX_VALUE })
+    void testGetBytes_long_int_posBeyondEnd(long pos) throws Exception {
+        assertThat("Wrong value for pos", pos, greaterThan(10L));
+        FBCachedBlob blob = new FBCachedBlob(new byte[] { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 });
+
+        byte[] data = blob.getBytes(pos, 5);
+
+        assertNotNull(data, "Expected non-null array");
+        assertArrayEquals(new byte[0], data, "Unexpected data");
+    }
+
+    @Test
+    void testGetBytes_long_int_lengthBeyondEnd() throws Exception {
+        FBCachedBlob blob = new FBCachedBlob(new byte[] { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 });
+
+        byte[] data = blob.getBytes(5, 10);
+
+        assertNotNull(data, "Expected non-null array");
+        assertArrayEquals(new byte[] { 5, 6, 7, 8, 9, 10 }, data, "Unexpected data");
+    }
+
     @Test
     void testGetBytes() throws Exception {
         byte[] input = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 };