coheigea commented on code in PR #3463:
URL: https://github.com/apache/cxf/pull/3463#discussion_r4006671272
##########
core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java:
##########
@@ -161,6 +161,9 @@ public final class StaxUtils {
getInteger(MAX_ELEMENT_DEPTH,
getInteger(INNER_ELEMENT_LEVEL_SYSTEM_PROP, 100));
private static final int MAX_CHILD_ELEMENTS_VAL =
getInteger(MAX_CHILD_ELEMENTS,
getInteger(INNER_ELEMENT_COUNT_SYSTEM_PROP, 50000));
+ // The MAX_ELEMENT_COUNT should be aligned with MAX_CHILD_ELEMENTS
+ private static final long MAX_ELEMENT_COUNT_VAL =
+ getLong(MAX_ELEMENT_COUNT, Math.max(100 * MAX_CHILD_ELEMENTS_VAL,
50000L));
Review Comment:
50000L only widens the second argument, which picks the Math.max(long,long)
overload. But 100 * MAX_CHILD_ELEMENTS_VAL is still int * int — it overflows
and wraps before anything gets widened. The L needs to go on the 100 (as well)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
