Created attachment 26454 [details] VML file illustrating the problem In the EvilUnclosedBRFixingInputStream.java file, it does not properly handle a case where there is a <br> in the overflow part of the buffer. It throws a NegativeArraySizeException. The fixup function needs to not process <br> tags past the end of the shortened buffer, and when returning the spare bytes it needs to run fixup. You can process the attached VML file through the EvilUnclosedBRFixingInputStream to reproduce the exception.
Created attachment 26456 [details] Patch to resolve the issue and unit test the fix Includes the changes to EvilUnclosedBRFixingInputStream and to its unit test to verify the problem is resolved.
Thanks for the patch and unit test After some pondering, I decided to refactor the class and fix a bit to make it clearer what is going on. I tweaked the test to try a wide range of buffer sizes, to simulate all the different cases of the br in the overflow, and it now passes all of them. Fix committed in r1067217.