{"record":{"id":"6b0ca82b9ea02bd9","repo":"quarkusio/quarkus","slug":"access-out-of-bounds","errorCode":null,"errorMessage":"Access out of bounds","messagePattern":"Access out of bounds","errorType":"exception","errorClass":"NotEnoughDataDecoderException","httpStatus":null,"severity":"warning","filePath":"independent-projects/resteasy-reactive/client/runtime/src/main/java/org/jboss/resteasy/reactive/client/impl/multipart/QuarkusMultipartResponseDecoder.java","lineNumber":640,"sourceCode":"     */\n    private static void skipControlCharacters(ByteBuf undecodedChunk) {\n        if (!undecodedChunk.hasArray()) {\n            try {\n                skipControlCharactersStandard(undecodedChunk);\n            } catch (IndexOutOfBoundsException e1) {\n                throw new NotEnoughDataDecoderException(e1);\n            }\n            return;\n        }\n        QuarkusHttpPostBodyUtil.SeekAheadOptimize sao = new QuarkusHttpPostBodyUtil.SeekAheadOptimize(undecodedChunk);\n        while (sao.pos < sao.limit) {\n            char c = (char) (sao.bytes[sao.pos++] & 0xFF);\n            if (!Character.isISOControl(c) && !Character.isWhitespace(c)) {\n                sao.setReadPosition(1);\n                return;\n            }\n        }\n        throw new NotEnoughDataDecoderException(\"Access out of bounds\");\n    }\n\n    private static void skipControlCharactersStandard(ByteBuf undecodedChunk) {\n        for (;;) {\n            char c = (char) undecodedChunk.readUnsignedByte();\n            if (!Character.isISOControl(c) && !Character.isWhitespace(c)) {\n                undecodedChunk.readerIndex(undecodedChunk.readerIndex() - 1);\n                break;\n            }\n        }\n    }\n\n    /**\n     * Find the next Multipart Delimiter\n     *\n     * @param delimiter\n     *        delimiter to find\n     * @param dispositionStatus","sourceCodeStart":622,"sourceCodeEnd":658,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/independent-projects/resteasy-reactive/client/runtime/src/main/java/org/jboss/resteasy/reactive/client/impl/multipart/QuarkusMultipartResponseDecoder.java#L622-L658","documentation":"skipControlCharacters advances through the undecoded chunk discarding ISO control chars and whitespace before reading the next delimiter/disposition line. If it runs past the end of available data without finding a non-control character, NotEnoughDataDecoderException('Access out of bounds') is thrown, signaling more data is needed.","triggerScenarios":"findMultipartDelimiter or findMultipartDisposition is invoked while the current undecoded chunk contains only whitespace/control bytes (or is exhausted), i.e. the boundary line hasn't arrived yet.","commonSituations":"Offering chunks one byte at a time (slow/fragmented responses); the client feeding partial buffers without accumulating; a truncated response ending in whitespace.","solutions":["Accumulate chunks and only offer complete buffers when possible; treat NotEnoughDataDecoderException as 'need more data'","Check that the response is not truncated by the server/proxy (Content-Length vs actual bytes)","Ensure the decoder is fed the full HttpContent for each chunk, not a stale view","If the error persists on a complete response, inspect for corrupted boundary lines"],"exampleFix":"// before\ntry {\n    decoder.offer(chunk);\n} catch (NotEnoughDataDecoderException e) { /* treated as fatal */ }\n// after\ntry {\n    decoder.offer(chunk);\n} catch (NotEnoughDataDecoderException e) {\n    // normal: wait for the next chunk before continuing\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { decoder.offer(chunk); } catch (NotEnoughDataDecoderException e) { /* not fatal: buffer and wait for more data */ pending.add(chunk); }","preventionTips":["Treat NotEnoughDataDecoderException as a signal for more data, not an error","Avoid delivering tiny fragments when you can coalesce chunks","Verify response completeness (Content-Length vs received bytes)"],"tags":["http","multipart","buffering"],"backgroundTag":"not-enough-data-decoder","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}