Merge branch '2.15' into 2.16

Author: cowtowncoder

release-notes/VERSION-2.x

@@ -69,6 +69,9 @@ JSON library.
 #990: Backport removal of BigDecimal to BigInt conversion (#987)
  (contributed by @pjfanning)
 #1004: FastDoubleParser license
+#1012: Got `NegativeArraySizeException` when calling `writeValueAsString()`
+ (reported by @klettier)
+ (fix contributed by @pjfanning)
 
 2.14.2 (28-Jan-2023)
 

src/main/java/com/fasterxml/jackson/core/util/TextBuffer.java

@@ -479,8 +479,13 @@ public String contentsAsString() throws IOException
                             _resultString = new String(_currentSegment, 0, currLen);
                         }
                     } else { // no, need to combine
-                        validateStringLength(segLen + currLen);
-                        StringBuilder sb = new StringBuilder(segLen + currLen);
+                        final int builderLen = segLen + currLen;
+                        if (builderLen < 0) {
+                            _reportBufferOverflow(segLen, currLen);
+                        }
+                        validateStringLength(builderLen);
+                        StringBuilder sb = new StringBuilder(builderLen);
+
                         // First stored segments
                         if (_segments != null) {
                             for (int i = 0, len = _segments.size(); i < len; ++i) {
@@ -927,6 +932,9 @@ public char[] finishCurrentSegment() throws IOException {
         _segments.add(_currentSegment);
         int oldLen = _currentSegment.length;
         _segmentSize += oldLen;
+        if (_segmentSize < 0) {
+            _reportBufferOverflow(_segmentSize - oldLen, oldLen);
+        }
         _currentSize = 0;
         validateStringLength(_segmentSize);
 
@@ -1087,6 +1095,9 @@ private void expand()
         _hasSegments = true;
         _segments.add(curr);
         _segmentSize += curr.length;
+        if (_segmentSize < 0) {
+            _reportBufferOverflow(_segmentSize - curr.length, curr.length);
+        }
         _currentSize = 0;
         int oldLen = curr.length;
 
@@ -1121,6 +1132,9 @@ private char[] resultArray() throws IOException
         // nope, not shared
         int size = size();
         if (size < 1) {
+            if (size < 0) {
+                _reportBufferOverflow(_segmentSize, _currentSize);
+            }
             return NO_CHARS;
         }
         validateStringLength(size);
@@ -1146,6 +1160,12 @@ private char[] resultArray() throws IOException
     /**********************************************************************
      */
 
+    protected void _reportBufferOverflow(int prev, int curr) {
+        long newSize = (long) prev + (long) curr;
+        throw new IllegalStateException("TextBuffer overrun: size reached ("
+                +newSize+") exceeds maximum of "+Integer.MAX_VALUE);
+    }
+
     /**
      * Convenience method that can be used to verify that a String
      * of specified length does not exceed maximum specific by this