ArrayTuple resizing multiply the capacity by 4 instead of doubling and adding 1

Questions

Version

3.9.x

Context

when initializing an ArrayTuple using the length constructor with 0 length, it would throw the indexoutofbound exception.

Do you have a reproducer?

the bug is easy to reproduce.

Tuple params = new ArrayTuple(0);
params.addInteger(1).addInteger(2);

Steps to reproduce

1. just run the code above with vertx 3.9+. it is working well with 3.8.x

Extra

it seems on the line 60 in the file io\vertx\sqlclient\impl\ArrayTuple.java , the + operator is evaluated prior to the << operator due to higher precedence. when 0 argument is passed, it is still 0 after shift, and then the problem occurs.

  public Tuple addValue(Object value) {
    if (size >= values.length) {
      Object[] copy = new Object[values.length << 1 + 1];
      System.arraycopy(values, 0, copy, 0, values.length);
      values = copy;
    }
    values[size++] = value;
    return this;
  }

also, when I tried to find the source code of 3.8.x, I noticed that the branch 3.8 was also changed by the merge. but the maven repo of 3.8.x remains the old implementation(ArrayTuple extending ArrayList). not sure if it is correct though. anyway, here is the commit

[vietj]

thanks for reporting it should be fine now

On Wed, Jun 17, 2020 at 2:46 PM Ysc [e-mail] wrote:

did you encounter this issue in an actual case ? ArrayTuple is an implementation and should not be instantiated directly. Not saying there is not bug, but I’m curious to hear how this issue happened in practice (unless you do a query on a table with 0 columns ?)

yes, it actually is a real case, but happening embarrassingly. Here is the code snippet we write in practice.

String SQL = " SELECT * FROM xxx_tbl “; int flag = params.getInteger(“flag”, 0); Tuple queryParams = new ArrayTuple(1); if(flag > 0) { SQL += " WHERE flag = ?”; queryParams.addInteger(flag); }

Promise<JsonObject> promise = Promise.promise(); conn.preparedQuery(SQL).execute(queryParams, res -> { if(res.succeeded()) { promise.complete(); }else{ promise.fail(“”); } });

somehow this time, one of our team members, who has little knowledege of programming, changes new ArrayTuple(1) to new ArrayTuple(0). I actually asked him why he was doing this, he said he thought it makes no difference since ArrayTuple could grow its capacity itself. sounds terrible, I know.

anyway, that`s how it is found.

— You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub https://github.com/eclipse-vertx/vertx-sql-client/issues/680#issuecomment-645351592, or unsubscribe https://github.com/notifications/unsubscribe-auth/AABXDCXYELQ2ZKUXF44PKYDRXC3JNANCNFSM4N2DDEJA .

[sc-yan]

did you encounter this issue in an actual case ? ArrayTuple is an implementation and should not be instantiated directly. Not saying there is not bug, but I’m curious to hear how this issue happened in practice (unless you do a query on a table with 0 columns ?)

yes, it actually is a real case, but happening embarrassingly. Here is the code snippet we write in practice.

String SQL = " SELECT * FROM xxx_tbl ";
int flag = params.getInteger("flag", 0); 
Tuple queryParams = new ArrayTuple(1);
if(flag > 0) {
	SQL += " WHERE flag = ?";
	queryParams.addInteger(flag);
}
		
Promise<JsonObject> promise = Promise.promise();
conn.preparedQuery(SQL).execute(queryParams, res ->  {
	if(res.succeeded()) {
		promise.complete();
	}else{
		promise.fail("");
	}
});

somehow this time, one of our team members, who has little knowledege of programming, changes new ArrayTuple(1) to new ArrayTuple(0). I actually asked him why he was doing this, he said he thought it makes no difference since ArrayTuple could grow its capacity itself. sounds terrible, I know.

anyway, that`s how it is found.