repeated field whose declared
byte length is close to Integer.MAX_VALUE causes OutOfMemoryError and
crashes the JVM.
The root cause is an integer overflow in ArrayDecoders: the bounds check
fieldLimit > data.length runs after computing
fieldLimit = position + packedDataByteSize, which wraps to a negative value
when packedDataByteSize is large. A negative fieldLimit always passes the
data.length comparison, allowing ensureCapacity() to receive the
unchecked byte size. For decodePackedFixed32List, this allocates a
536-million-element int[] (~2 GB) from a 7-byte input.
repeated field whose declared
byte length is close to Integer.MAX_VALUE causes OutOfMemoryError and
crashes the JVM.
The root cause is an integer overflow in ArrayDecoders: the bounds check
fieldLimit > data.length runs after computing
fieldLimit = position + packedDataByteSize, which wraps to a negative value
when packedDataByteSize is large. A negative fieldLimit always passes the