Validate ByteBufferBackedInputStream.read() parameters per InputStream contract

[Copilot]

ByteBufferBackedInputStream.read(byte[] bytes, int off, int len) doesn't validate parameters, violating the InputStream contract which requires throwing NullPointerException for null arrays and IndexOutOfBoundsException for negative or out-of-bounds values.

Changes

• Add Objects.requireNonNull(bytes, "bytes") to validate the byte array is not null and throw NullPointerException if it is
• Add Objects.checkFromIndexSize(off, len, bytes.length) to validate parameters and throw IndexOutOfBoundsException when:
  • off is negative
  • len is negative
  • off + len > bytes.length (would exceed array bounds)
• Add comprehensive test cases to verify parameter validation behavior

Example

Current behavior with invalid parameters:

ByteBufferBackedInputStream stream = new ByteBufferBackedInputStream(buffer);
stream.read(null, 0, 5);    // May propagate wrong exception from ByteBuffer.get()
stream.read(bytes, 0, -1);  // May propagate wrong exception from ByteBuffer.get()

Fixed behavior:

ByteBufferBackedInputStream stream = new ByteBufferBackedInputStream(buffer);
stream.read(null, 0, 5);    // Throws NullPointerException as per InputStream spec
stream.read(bytes, 0, -1);  // Throws IndexOutOfBoundsException as per InputStream spec

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[pjfanning]

https://docs.oracle.com/javase/8/docs/api/java/io/InputStream.html#read-byte:A-int-int- agrees that IndexOutOfBoundsException should be thrown for negative len

[pjfanning]

@copilot add calls (if needed) to Objects.requireNonNull for the input byte array param and also to Objects.checkFromIndexSize

[Copilot]

@copilot add calls (if needed) to Objects.requireNonNull for the input byte array param and also to Objects.checkFromIndexSize

Added Objects.requireNonNull(bytes, "bytes") and Objects.checkFromIndexSize(off, len, bytes.length) as requested. This ensures proper validation of all parameters according to the InputStream contract. Commit: 80fe95b

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• central.sonatype.com
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --enable-native-access=ALL-UNNAMED -classpath /home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.11/a2d47e15/boot/plexus-classworlds-2.9.0.jar -Dclassworlds.conf=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.11/a2d47e15/bin/m2.conf -Dmaven.home=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.11/a2d47e15 -Dlibrary.jansi.path=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.11/a2d47e15/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/jackson-databind/jackson-databind org.codehaus.plexus.classworlds.launcher.Launcher test -Dtest=ByteBufferUtilsTest -q (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[cowtowncoder]

Hmmmh. I guess this is good, although note that this class is not part of public API nor intended to be used from outside databind code itself.

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	81.15%	📈 +0.000%
Branches	74.27%	📈 +0.000%

Coverage data generated from JaCoCo test results