Describe the bug, including details regarding any error messages, version, and platform.
When a Variant object is built with the same key appended more than once, VariantBuilder.endObject() deduplicates the entries and keeps the last-written value. However, the total dataSize of the object's value region was computed from each key's first occurrence rather than the value that was actually retained.
When duplicate keys had values of different encoded sizes, this size mismatch corrupted the output:
- If the retained value was larger (e.g.
{"a": 1, "a": "hello"}), the buffer was under-reserved, the offset width could be undersized, and the final offset entry understated the real data length. Reading the field then threw IllegalArgumentException: Invalid byte-array offset or returned truncated data.
- If the retained value was smaller, the object reserved stale trailing bytes and overstated its size.
Component(s)
Core
Describe the bug, including details regarding any error messages, version, and platform.
When a Variant object is built with the same key appended more than once,
VariantBuilder.endObject()deduplicates the entries and keeps the last-written value. However, the totaldataSizeof the object's value region was computed from each key's first occurrence rather than the value that was actually retained.When duplicate keys had values of different encoded sizes, this size mismatch corrupted the output:
{"a": 1, "a": "hello"}), the buffer was under-reserved, the offset width could be undersized, and the final offset entry understated the real data length. Reading the field then threwIllegalArgumentException: Invalid byte-array offsetor returned truncated data.Component(s)
Core