From 54c11932fa01c618d89d2325c3dd7bf3c106634c Mon Sep 17 00:00:00 2001
From: Samir Ahmed <samirahmed2013@gmail.com>
Date: Thu, 20 May 2021 11:57:10 -0700
Subject: [PATCH] [Java] Flexbuffers - Negative signed object length (#6651)

* retry with correct email

* update JavaTest.java
---
 java/com/google/flatbuffers/FlexBuffers.java |  2 +-
 tests/JavaTest.java                          | 22 ++++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/java/com/google/flatbuffers/FlexBuffers.java b/java/com/google/flatbuffers/FlexBuffers.java
index 8263f9a0c..b8f879b6e 100644
--- a/java/com/google/flatbuffers/FlexBuffers.java
+++ b/java/com/google/flatbuffers/FlexBuffers.java
@@ -655,7 +655,7 @@ public class FlexBuffers {
 
         Sized(ReadBuf buff, int end, int byteWidth) {
             super(buff, end, byteWidth);
-            size = readInt(bb, end - byteWidth, byteWidth);
+            size = (int) readUInt(bb, end - byteWidth, byteWidth);
         }
 
         public int size() {
diff --git a/tests/JavaTest.java b/tests/JavaTest.java
index 23ebb5b25..202905676 100644
--- a/tests/JavaTest.java
+++ b/tests/JavaTest.java
@@ -862,6 +862,27 @@ class JavaTest {
         TestEq((byte)-1, result[3]);
     }
 
+    public static void testSingleElementLongBlob() {
+
+        // verifies blobs of up to 2^16 in length
+        for (int i = 2; i <= 1<<16; i = i<<1) {
+            byte[] input = new byte[i-1];
+            for (int index = 0; index < input.length; index++) {
+                input[index] = (byte)(index % 64);
+            }
+
+            FlexBuffersBuilder builder = new FlexBuffersBuilder();
+            builder.putBlob(input);
+            ByteBuffer b = builder.finish();
+            FlexBuffers.Reference r = FlexBuffers.getRoot(b);
+            byte[] result = r.asBlob().getBytes();
+            
+            for (int index = 0; index < input.length; index++) {
+                TestEq((byte)(index % 64), result[index]);
+            }
+        }
+    }
+
     public static void testSingleElementUByte() {
         FlexBuffersBuilder builder = new FlexBuffersBuilder();
         builder.putUInt(0xFF);
@@ -1084,6 +1105,7 @@ class JavaTest {
         testSingleElementSmallString();
         testSingleElementBigString();
         testSingleElementBlob();
+        testSingleElementLongBlob();
         testSingleElementVector();
         testSingleFixedTypeVector();
         testSingleElementUShort();