SI-7880 Fix infinite loop in ResizableArray#ensureSize

This issue was triggered for values greater than Int.MaxValue/2, which
caused the computation of the new array size to overflow and become
negative, leading to an infinite loop.

1 files changed, 13 insertions, 9 deletions

diff --git a/src/library/scala/collection/mutable/ResizableArray.scala b/src/library/scala/collection/mutable/ResizableArray.scala
index 4a12f9588c..c3047522e2 100644
--- a/src/library/scala/collection/mutable/ResizableArray.scala
+++ b/src/library/scala/collection/mutable/ResizableArray.scala
@@ -89,16 +89,20 @@ trait ResizableArray[A] extends IndexedSeq[A]
     }
   }
 
-  /** Ensure that the internal array has at `n` cells. */
+  /** Ensure that the internal array has at least `n` cells. */
   protected def ensureSize(n: Int) {
-    if (n > array.length) {
-      var newsize = array.length * 2
-      while (n > newsize)
-        newsize = newsize * 2
-
-      val newar: Array[AnyRef] = new Array(newsize)
-      scala.compat.Platform.arraycopy(array, 0, newar, 0, size0)
-      array = newar
+    // Use a Long to prevent overflows
+    val arrayLength: Long = array.length
+    if (n > arrayLength) {
+      var newSize: Long = arrayLength * 2
+      while (n > newSize)
+        newSize = newSize * 2
+      // Clamp newSize to Int.MaxValue
+      if (newSize > Int.MaxValue) newSize = Int.MaxValue
+
+      val newArray: Array[AnyRef] = new Array(newSize.toInt)
+      scala.compat.Platform.arraycopy(array, 0, newArray, 0, size0)
+      array = newArray
     }
   }