The method: java.text.DigitList.fitsIntoLong()
throws ArrayIndexOutOfBoundsException
There is negative indexing occurs to an array that may have no elements:
java.lang.ArrayIndexOutOfBoundsException
java.lang.ArrayIndexOutOfBoundsException
at java.text.DigitList.fitsIntoLong(DigitList.java:173)
at java.text.DecimalFormat.parse(DecimalFormat.java:817)
at java.text.SimpleDateFormat.subParse(SimpleDateFormat.java:1201)
at java.text.SimpleDateFormat.parse(SimpleDateFormat.java:730)
at java.text.DateFormat.parse(DateFormat.java:322)
at org.apache.catalina.servlets.DefaultServlet.checkIfHeaders(DefaultSer
vlet.java:754)
at org.apache.catalina.servlets.DefaultServlet.serveResource(DefaultServ
let.java:1100)
at org.apache.catalina.servlets.DefaultServlet.doGet(DefaultServlet.java
:520)
.
.
The code on the JDK 1.3.1.02 (where this happens): is as follows:
/**
* Return true if the number represented by this object can fit into
* a long.
* @param isPositive true if this number should be regarded as positive
* @param ignoreNegativeZero true if -0 should be regarded as identical to
* +0; otherwise they are considered distinct
* @return true if this number fits into a Java long
*/
boolean fitsIntoLong(boolean isPositive, boolean ignoreNegativeZero)
{
// Figure out if the result will fit in a long. We have to
// first look for nonzero digits after the decimal point;
// then check the size. If the digit count is 18 or less, then
// the value can definitely be represented as a long. If it is 19
// then it may be too large.
// Trim trailing zeros. This does not change the represented value.
while (count > 0 && digits[count - 1] == (byte)'0') --count;
'count' is initialized to zero, there is no prior check whether digits has
been initialized, nor what the value of 'count' is.