{"record":{"id":"538c0baf00a44768","repo":"apache/hadoop","slug":"offs-len-buf-length","errorCode":null,"errorMessage":"offs({}) + len({}) > buf.length({}).","messagePattern":"offs\\((.+?)\\) \\+ len\\((.+?)\\) > buf\\.length\\((.+?)\\)\\.","errorType":"exception","errorClass":"IndexOutOfBoundsException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/io/compress/bzip2/CBZip2OutputStream.java","lineNumber":869,"sourceCode":"  /**\n  * Returns the blocksize parameter specified at construction time.\n  * @return blocksize.\n  */\n  public final int getBlockSize() {\n    return this.blockSize100k;\n  }\n\n  @Override\n  public void write(final byte[] buf, int offs, final int len)\n      throws IOException {\n    if (offs < 0) {\n      throw new IndexOutOfBoundsException(\"offs(\" + offs + \") < 0.\");\n    }\n    if (len < 0) {\n      throw new IndexOutOfBoundsException(\"len(\" + len + \") < 0.\");\n    }\n    if (offs + len > buf.length) {\n      throw new IndexOutOfBoundsException(\"offs(\" + offs + \") + len(\"\n          + len + \") > buf.length(\" + buf.length + \").\");\n    }\n    if (this.out == null) {\n      throw new IOException(\"stream closed\");\n    }\n\n    for (int hi = offs + len; offs < hi;) {\n      write0(buf[offs++]);\n    }\n  }\n\n  private void write0(int b) throws IOException {\n    if (this.currentChar != -1) {\n      b &= 0xff;\n      if (this.currentChar == b) {\n        if (++this.runLength > 254) {\n          writeRun();\n          this.currentChar = -1;","sourceCodeStart":851,"sourceCodeEnd":887,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/io/compress/bzip2/CBZip2OutputStream.java#L851-L887","documentation":"Third guard in CBZip2OutputStream.write(byte[], offs, len): if offs + len exceeds buf.length it throws IndexOutOfBoundsException(\"offs(...) + len(...) > buf.length(...)\"). The codec refuses ranges that run past the end of the source array. Note offs and len are already proven non-negative by the earlier checks, so this is purely the 'range exceeds array' case.","triggerScenarios":"write(buf, offs, len) where offs + len > buf.length: reusing a stale len after swapping to a smaller buffer, offsets relative to a substring/subregion without adjusting, or off-by-one loops passing len == buf.length while offs > 0.","commonSituations":"Buffer reuse across iterations (buffer shrinks, length not recomputed); passing (fullArrayLength) as len when starting at a non-zero offset; views over slices (ByteBuffer.array()) where the array length differs from the view's limit; ported C code using pointer + length pairs.","solutions":["Compute the length from the actual region: int len = Math.min(requestedLen, buf.length - offs); and skip when <= 0.","Recompute lengths whenever the underlying buffer is replaced or resized — never cache len across buffer swaps.","Use Objects.checkFromToIndex(offs, offs + len, buf.length) to validate the whole range in one call.","For ByteBuffer-backed writes, derive offs/len from position()/remaining() of the same buffer instance."],"exampleFix":"// before\ncbz.write(buf, 10, buf.length); // 10 + buf.length > buf.length\n\n// after\ncbz.write(buf, 10, Math.min(buf.length - 10, wantedLen));","handlingStrategy":"validation","validationCode":"int safeLen = Math.min(len, buf.length - offs);\nif (safeLen > 0) {\n  cbz.write(buf, offs, safeLen);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Recompute lengths whenever the backing buffer is swapped or resized.","For ByteBuffer.array(), derive off/len from that buffer's position/remaining, not the view's.","Use Objects.checkFromToIndex for one-shot range validation."],"tags":["bzip2","compression","invalid-argument","bounds","off-by-one","hadoop"],"backgroundTag":"invalid-offset-length","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}