From 8dc98502bdfbe20564f47dd8390eb2d51cf384df Mon Sep 17 00:00:00 2001
From: Naoaki Yamada <napo0703@gmail.com>
Date: Wed, 22 Jun 2022 23:54:26 +0900
Subject: [PATCH 1/2] Fixed UnpackerConfig.bufferSize to work

---
 .../java/org/msgpack/core/MessagePack.java    |  6 +-
 .../org/msgpack/core/MessageUnpacker.java     | 71 +++++++++++++------
 2 files changed, 53 insertions(+), 24 deletions(-)

diff --git a/msgpack-core/src/main/java/org/msgpack/core/MessagePack.java b/msgpack-core/src/main/java/org/msgpack/core/MessagePack.java
index edd449b34..83d9b286d 100644
--- a/msgpack-core/src/main/java/org/msgpack/core/MessagePack.java
+++ b/msgpack-core/src/main/java/org/msgpack/core/MessagePack.java
@@ -518,7 +518,7 @@ public static class UnpackerConfig
 
         private int stringSizeLimit = Integer.MAX_VALUE;
 
-        private int bufferSize = 8192;
+        private int bufferSize = 100 * 1024 * 1024;
 
         private int stringDecoderBufferSize = 8192;
 
@@ -744,8 +744,8 @@ public int getStringDecoderBufferSize()
         }
 
         /**
-         * When a packer is created with newUnpacker(OutputStream) or newUnpacker(WritableByteChannel), the stream will be
-         * buffered with this size of buffer (default: 8192).
+         * When a packer is created with {@link #newUnpacker(InputStream)} or {@link #newUnpacker(ReadableByteChannel)},
+         * the stream will be buffered with this size of buffer (default: 100MiB).
          */
         public UnpackerConfig withBufferSize(int bytes)
         {
diff --git a/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java b/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java
index ff638b744..297a42708 100644
--- a/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java
+++ b/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java
@@ -156,6 +156,7 @@ public class MessageUnpacker
     private final CodingErrorAction actionOnUnmappableString;
     private final int stringSizeLimit;
     private final int stringDecoderBufferSize;
+    private final int bufferSize;
 
     private MessageBufferInput in;
 
@@ -215,6 +216,7 @@ protected MessageUnpacker(MessageBufferInput in, MessagePack.UnpackerConfig conf
         this.actionOnUnmappableString = config.getActionOnUnmappableString();
         this.stringSizeLimit = config.getStringSizeLimit();
         this.stringDecoderBufferSize = config.getStringDecoderBufferSize();
+        this.bufferSize = config.getBufferSize();
     }
 
     /**
@@ -1324,27 +1326,38 @@ public Instant unpackTimestamp(ExtensionTypeHeader ext) throws IOException
      *
      * @return the size of the array to be read
      * @throws MessageTypeException when value is not MessagePack Array type
-     * @throws MessageSizeException when size of the array is larger than 2^31 - 1
+     * @throws MessageSizeException when size of the array is larger than 2^31 - 1 or bufferSize
      * @throws IOException when underlying input throws IOException
      */
     public int unpackArrayHeader()
             throws IOException
     {
         byte b = readByte();
+        int len;
         if (Code.isFixedArray(b)) { // fixarray
-            return b & 0x0f;
+            len = b & 0x0f;
         }
-        switch (b) {
-            case Code.ARRAY16: { // array 16
-                int len = readNextLength16();
-                return len;
-            }
-            case Code.ARRAY32: { // array 32
-                int len = readNextLength32();
-                return len;
+        else {
+            switch (b) {
+                case Code.ARRAY16: { // array 16
+                    len = readNextLength16();
+                    break;
+                }
+                case Code.ARRAY32: { // array 32
+                    len = readNextLength32();
+                    break;
+                }
+                default: {
+                    throw unexpected("Array", b);
+                }
             }
         }
-        throw unexpected("Array", b);
+
+        if (len > bufferSize) {
+            throw new MessageSizeException(String.format("cannot unpack a Array of size larger than %,d: %,d", bufferSize, len), len);
+        }
+
+        return len;
     }
 
     /**
@@ -1357,27 +1370,38 @@ public int unpackArrayHeader()
      *
      * @return the size of the map to be read
      * @throws MessageTypeException when value is not MessagePack Map type
-     * @throws MessageSizeException when size of the map is larger than 2^31 - 1
+     * @throws MessageSizeException when size of the map is larger than 2^31 - 1 or bufferSize
      * @throws IOException when underlying input throws IOException
      */
     public int unpackMapHeader()
             throws IOException
     {
         byte b = readByte();
+        int len;
         if (Code.isFixedMap(b)) { // fixmap
             return b & 0x0f;
         }
-        switch (b) {
-            case Code.MAP16: { // map 16
-                int len = readNextLength16();
-                return len;
-            }
-            case Code.MAP32: { // map 32
-                int len = readNextLength32();
-                return len;
+        else {
+            switch (b) {
+                case Code.MAP16: { // map 16
+                    len = readNextLength16();
+                    break;
+                }
+                case Code.MAP32: { // map 32
+                    len = readNextLength32();
+                    break;
+                }
+                default: {
+                    throw unexpected("Map", b);
+                }
             }
         }
-        throw unexpected("Map", b);
+
+        if (len > bufferSize / 2) {
+            throw new MessageSizeException(String.format("cannot unpack a Map of size larger than %,d: %,d", bufferSize / 2, len), len);
+        }
+
+        return len;
     }
 
     public ExtensionTypeHeader unpackExtensionTypeHeader()
@@ -1635,11 +1659,16 @@ public void readPayload(byte[] dst)
      *
      * @param length number of bytes to be read
      * @return the new byte array
+     * @throws MessageSizeException when length is larger than bufferSize
      * @throws IOException when underlying input throws IOException
      */
     public byte[] readPayload(int length)
             throws IOException
     {
+        if (length > bufferSize) {
+            throw new MessageSizeException(String.format("%,d exceeds bufferSize:%,d", length, bufferSize), length);
+        }
+
         byte[] newArray = new byte[length];
         readPayload(newArray);
         return newArray;

From 74fed2d6a7144c30d4c921dc4c8fb513205b38ef Mon Sep 17 00:00:00 2001
From: Naoaki Yamada <napo0703@gmail.com>
Date: Wed, 29 Jun 2022 02:25:34 +0900
Subject: [PATCH 2/2] Fix default buffer size and buffer size check.

---
 .../java/org/msgpack/core/MessagePack.java    |  4 +-
 .../org/msgpack/core/MessageUnpacker.java     | 64 ++++++-------------
 2 files changed, 23 insertions(+), 45 deletions(-)

diff --git a/msgpack-core/src/main/java/org/msgpack/core/MessagePack.java b/msgpack-core/src/main/java/org/msgpack/core/MessagePack.java
index 83d9b286d..4e25adc07 100644
--- a/msgpack-core/src/main/java/org/msgpack/core/MessagePack.java
+++ b/msgpack-core/src/main/java/org/msgpack/core/MessagePack.java
@@ -518,7 +518,7 @@ public static class UnpackerConfig
 
         private int stringSizeLimit = Integer.MAX_VALUE;
 
-        private int bufferSize = 100 * 1024 * 1024;
+        private int bufferSize = 8192;
 
         private int stringDecoderBufferSize = 8192;
 
@@ -745,7 +745,7 @@ public int getStringDecoderBufferSize()
 
         /**
          * When a packer is created with {@link #newUnpacker(InputStream)} or {@link #newUnpacker(ReadableByteChannel)},
-         * the stream will be buffered with this size of buffer (default: 100MiB).
+         * the stream will be buffered with this size of buffer (default: 8192).
          */
         public UnpackerConfig withBufferSize(int bytes)
         {
diff --git a/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java b/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java
index 297a42708..6093bace2 100644
--- a/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java
+++ b/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java
@@ -1326,38 +1326,27 @@ public Instant unpackTimestamp(ExtensionTypeHeader ext) throws IOException
      *
      * @return the size of the array to be read
      * @throws MessageTypeException when value is not MessagePack Array type
-     * @throws MessageSizeException when size of the array is larger than 2^31 - 1 or bufferSize
+     * @throws MessageSizeException when size of the array is larger than 2^31 - 1
      * @throws IOException when underlying input throws IOException
      */
     public int unpackArrayHeader()
             throws IOException
     {
         byte b = readByte();
-        int len;
         if (Code.isFixedArray(b)) { // fixarray
-            len = b & 0x0f;
+            return b & 0x0f;
         }
-        else {
-            switch (b) {
-                case Code.ARRAY16: { // array 16
-                    len = readNextLength16();
-                    break;
-                }
-                case Code.ARRAY32: { // array 32
-                    len = readNextLength32();
-                    break;
-                }
-                default: {
-                    throw unexpected("Array", b);
-                }
+        switch (b) {
+            case Code.ARRAY16: { // array 16
+                int len = readNextLength16();
+                return len;
+            }
+            case Code.ARRAY32: { // array 32
+                int len = readNextLength32();
+                return len;
             }
         }
-
-        if (len > bufferSize) {
-            throw new MessageSizeException(String.format("cannot unpack a Array of size larger than %,d: %,d", bufferSize, len), len);
-        }
-
-        return len;
+        throw unexpected("Array", b);
     }
 
     /**
@@ -1370,38 +1359,27 @@ public int unpackArrayHeader()
      *
      * @return the size of the map to be read
      * @throws MessageTypeException when value is not MessagePack Map type
-     * @throws MessageSizeException when size of the map is larger than 2^31 - 1 or bufferSize
+     * @throws MessageSizeException when size of the map is larger than 2^31 - 1
      * @throws IOException when underlying input throws IOException
      */
     public int unpackMapHeader()
             throws IOException
     {
         byte b = readByte();
-        int len;
         if (Code.isFixedMap(b)) { // fixmap
             return b & 0x0f;
         }
-        else {
-            switch (b) {
-                case Code.MAP16: { // map 16
-                    len = readNextLength16();
-                    break;
-                }
-                case Code.MAP32: { // map 32
-                    len = readNextLength32();
-                    break;
-                }
-                default: {
-                    throw unexpected("Map", b);
-                }
+        switch (b) {
+            case Code.MAP16: { // map 16
+                int len = readNextLength16();
+                return len;
+            }
+            case Code.MAP32: { // map 32
+                int len = readNextLength32();
+                return len;
             }
         }
-
-        if (len > bufferSize / 2) {
-            throw new MessageSizeException(String.format("cannot unpack a Map of size larger than %,d: %,d", bufferSize / 2, len), len);
-        }
-
-        return len;
+        throw unexpected("Map", b);
     }
 
     public ExtensionTypeHeader unpackExtensionTypeHeader()