FULL PRODUCT VERSION :
java version "1.6.0_18"
Java(TM) SE Runtime Environment (build 1.6.0_18-b07)
Java HotSpot(TM) Client VM (build 16.0-b13, mixed mode, sharing)


ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows XP [Wersja 5.1.2600]


A DESCRIPTION OF THE PROBLEM :
ArrayIndexOutOfBounds exception thrown during call of com.sun.org.apache.xml.internal.security.utils.UnsyncByteArrayOutputStream.write(byte[] arg0) method, when (pos+arg0.length) > (size<<2).

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Execute the following sequence:

import com.sun.org.apache.xml.internal.security.utils.UnsyncByteArrayOutputStream;
//----------------------------------------------------------------
try {
    UnsyncByteArrayOutputStream out = new UnsyncByteArrayOutputStream();
    out.write(new byte[(4*1024 /*initial buffer size*/) << 2 + 1]);
    System.out.println("OK, continue");
} catch (ArrayIndexOutOfBoundsException ex) {
    System.err.println("Old bug!");
}



EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
display: "OK, continue"
ACTUAL -
display: "Old bug!"


REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
import com.sun.org.apache.xml.internal.security.utils.UnsyncByteArrayOutputStream;
//----------------------------------------------------------------
try {
    UnsyncByteArrayOutputStream out = new UnsyncByteArrayOutputStream();
    out.write(new byte[(4*1024 /*initial buffer size*/) << 2 + 1]);
    System.out.println("OK, continue");
} catch (ArrayIndexOutOfBoundsException ex) {
    System.err.println("Old bug!");
}


---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
Substitute UnsyncByteArrayOutputStream class by the correct one: changes are marked with my initials (it is, of course, only one of many possible solutions):

/*
 * Copyright  1999-2005 The Apache Software Foundation.
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 *
 */
package com.sun.org.apache.xml.internal.security.utils;

import java.io.ByteArrayOutputStream;

/**
 * A simple Unsynced ByteArryOutputStream
 * @author raul
 *
 */
public class UnsyncByteArrayOutputStream extends ByteArrayOutputStream {
	int size=4*1024;
	byte []buf=new byte[size];
	int pos;
	/** @inheritDoc */
	public void write(byte[] arg0) {
		int newPos=pos+arg0.length;
// MB		if (newPos>size) {
// MB			expandSize();
// MB		}
		ensureSize(newPos); // MB
		System.arraycopy(arg0,0,buf,pos,arg0.length);
		pos=newPos;
	}
	/** @inheritDoc */
	public void write(byte[] arg0, int arg1, int arg2) {
		int newPos=pos+arg2;
// MB		if (newPos>size) {
// MB			expandSize();
// MB		}
		ensureSize(newPos); // MB
		System.arraycopy(arg0,arg1,buf,pos,arg2);
		pos=newPos;
	}
	/** @inheritDoc */
	public void write(int arg0) {
		if (pos>=size) {
			expandSize();
		}
		buf[pos++]=(byte)arg0;
	}
	/** @inheritDoc */
	public byte[] toByteArray() {
		byte result[]=new byte[pos];
		System.arraycopy(buf,0,result,0,pos);
		return result;
	}
	
	/** @inheritDoc */
	public void reset() {
		pos=0;
	}
	
	/** @inheritDoc */
	void expandSize() {
		int newSize=size<<2;
		byte newBuf[]=new byte[newSize];
		System.arraycopy(buf,0,newBuf,0,pos);
		buf=newBuf;
		size=newSize;
		
	}
	
	/* MB */
	void ensureSize(int requested) {
		if (requested > size) {
			do size <<= 2; while (requested > size);
			byte newBuf[] = new byte[size];
			System.arraycopy(buf, 0, newBuf, 0, pos);
			buf = newBuf;
		}
	}
}