CODEC-231 StringUtils.equals(CharSequence cs1, CharSequence cs2) can fail with String Index OBE

git-svn-id: https://svn.apache.org/repos/asf/commons/proper/codec/trunk@1788777 13f79535-47bb-0310-9956-ffa450edef68

Author: sebbASF

src/changes/changes.xml

@@ -45,6 +45,7 @@ The <action> type attribute can be add,update,fix,remove.
     <release version="1.11" date="2017-MM-DD" description="Feature and fix release.">
       <!-- The first attribute below should be the issue id; makes it easier to navigate in the IDE outline -->
 
+      <action issue="CODEC-231" dev="sebb" type="fix">StringUtils.equals(CharSequence cs1, CharSequence cs2) can fail with String Index OBE</action>
       <action issue="CODEC-230" dev="sebb" type="fix">URLCodec.WWW_FORM_URL should be private</action>
       <action issue="CODEC-229" dev="sebb" type="fix">StringUtils.newStringxxx(null) should return null, not NPE</action>
       <action issue="CODEC-220" dev="sebb" type="add">Fluent interface for DigestUtils</action>

src/main/java/org/apache/commons/codec/binary/StringUtils.java

@@ -78,7 +78,7 @@ public static boolean equals(final CharSequence cs1, final CharSequence cs2) {
         if (cs1 instanceof String && cs2 instanceof String) {
             return cs1.equals(cs2);
         }
-        return CharSequenceUtils.regionMatches(cs1, false, 0, cs2, 0, Math.max(cs1.length(), cs2.length()));
+        return cs1.length() == cs2.length() && CharSequenceUtils.regionMatches(cs1, false, 0, cs2, 0, cs1.length());
     }
 
     /**

src/test/java/org/apache/commons/codec/binary/StringUtilsTest.java

@@ -208,4 +208,33 @@ public void testNewStringUtf8() throws UnsupportedEncodingException {
         final String actual = StringUtils.newStringUtf8(BYTES_FIXTURE);
         Assert.assertEquals(expected, actual);
     }
+
+    @Test
+    public void testEqualsString() {
+        Assert.assertTrue(StringUtils.equals(null, null));
+        Assert.assertFalse(StringUtils.equals("abc", null));
+        Assert.assertFalse(StringUtils.equals(null, "abc"));
+        Assert.assertTrue(StringUtils.equals("abc", "abc"));
+        Assert.assertFalse(StringUtils.equals("abc", "abcd"));
+        Assert.assertFalse(StringUtils.equals("abcd", "abc"));
+        Assert.assertFalse(StringUtils.equals("abc", "ABC"));
+    }
+
+    @Test
+    public void testEqualsCS1() {
+        Assert.assertFalse(StringUtils.equals(new StringBuilder("abc"), null));
+        Assert.assertFalse(StringUtils.equals(null, new StringBuilder("abc")));
+        Assert.assertTrue(StringUtils.equals(new StringBuilder("abc"), new StringBuilder("abc")));
+        Assert.assertFalse(StringUtils.equals(new StringBuilder("abc"), new StringBuilder("abcd")));
+        Assert.assertFalse(StringUtils.equals(new StringBuilder("abcd"), new StringBuilder("abc")));
+        Assert.assertFalse(StringUtils.equals(new StringBuilder("abc"), new StringBuilder("ABC")));
+    }
+
+    @Test
+    public void testEqualsCS2() {
+        Assert.assertTrue(StringUtils.equals("abc", new StringBuilder("abc")));
+        Assert.assertFalse(StringUtils.equals(new StringBuilder("abc"), "abcd"));
+        Assert.assertFalse(StringUtils.equals("abcd", new StringBuilder("abc")));
+        Assert.assertFalse(StringUtils.equals(new StringBuilder("abc"), "ABC"));
+    }
 }