check whether size has overflowed (#1013)

Author: pjfanning

src/main/java/com/fasterxml/jackson/core/util/TextBuffer.java

@@ -452,7 +452,11 @@ public String contentsAsString()
                     if (segLen == 0) { // yup
                         _resultString = (currLen == 0) ? "" : new String(_currentSegment, 0, currLen);
                     } else { // no, need to combine
-                        StringBuilder sb = new StringBuilder(segLen + currLen);
+                        final int builderLen = segLen + currLen;
+                        if (builderLen < 0) {
+                            throw new RuntimeException("size cannot be negative (probable int overflow)");
+                        }
+                        StringBuilder sb = new StringBuilder(builderLen);
                         // First stored segments
                         if (_segments != null) {
                             for (int i = 0, len = _segments.size(); i < len; ++i) {
@@ -852,6 +856,9 @@ public char[] finishCurrentSegment() {
         _segments.add(_currentSegment);
         int oldLen = _currentSegment.length;
         _segmentSize += oldLen;
+        if (_segmentSize < 0) {
+            throw new RuntimeException("_segmentSize cannot be negative (probable int overflow)");
+        }
         _currentSize = 0;
 
         // Let's grow segments by 50%
@@ -960,6 +967,9 @@ private void expand(int minNewSegmentSize)
         _hasSegments = true;
         _segments.add(curr);
         _segmentSize += curr.length;
+        if (_segmentSize < 0) {
+            throw new RuntimeException("_segmentSize cannot be negative (probable int overflow)");
+        }
         _currentSize = 0;
         int oldLen = curr.length;
 
@@ -993,6 +1003,9 @@ private char[] resultArray()
         // nope, not shared
         int size = size();
         if (size < 1) {
+            if (size < 0) {
+                throw new RuntimeException("size cannot be negative (probable int overflow)");
+            }
             return NO_CHARS;
         }
         int offset = 0;