possible bug in org/w3c/www/mux/MuxReader.java

Hi,

here's a possible bug in MuxReader.java:

If 'buffer[bufptr]' is negative, you sign-extend and 'buffer[bufptr+1]' is ignored.  
For instance, [0xff 0x01] will become 0xffff.
(IMO, you'd need to do: a[i] = ((buffer[bufptr] & 0xff) | (buffer[bufptr+1] << 8)) & 0xffff;)

Could you confirm/deny this bug?

Thanks!

	- Godmar

Jigsaw-2.2.2/src/classes/org/w3c/www/mux/MuxReader.java

    protected int[] msgShortArrayToIntArray()
        throws IOException
    {
        if (buffer.length < msglen)
            throw new RuntimeException("ShortArray doesn't hold in buffer !");
        while (buflen < msglen)
            fillBuffer();
        int a[] = new int[msglen >> 1];
        for (int i = 0 ; i < a.length ; i++) {
            a[i] = (buffer[bufptr] | (buffer[bufptr+1] << 8)) & 0xffff;
            bufptr += 2;
        }
        buflen -= msglen;
        return a;
    }


Test case:

    package tests;

    public class sbyte {

	byte buffer[] = null;
	int bufptr = 0;
	int msglen = -1;

	sbyte(byte [] buffer) {
	    this.buffer = buffer;
	    msglen = buffer.length;
	}

	public static void main(String []av) {
	    sbyte msg = new sbyte(new byte[] { /* 0xff */ -1, 0x1 });
	    int []iarray = msg.msgShortArrayToIntArray();
	    System.out.println(iarray[0]);
	}

	int[] msgShortArrayToIntArray() {
	    int a[] = new int[msglen >> 1];
	    for (int i = 0 ; i < a.length ; i++) {
		a[i] = (buffer[bufptr] | (buffer[bufptr+1] << 8)) & 0xffff;
		bufptr += 2;
	    }
	    return a;
	}
    }

Received on Friday, 16 May 2003 18:31:36 UTC