[IO-640] NPE in org.apache.commons.io.IOUtils.contentEquals(InputStream,

InputStream) when only one input is null.
Mohammed22too · Nov 25, 2019 · fa36ecd · fa36ecd
1 parent e6c81e6
commit fa36ecd
Show file tree

Hide file tree

Showing 3 changed files with 27 additions and 7 deletions.
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
@@ -165,6 +165,9 @@ The <action> type attribute can be add,update,fix,remove.
         Add and reuse org.apache.commons.io.IOUtils.closeQuitely(Closeable, Consumer&lt;IOException&gt;).
         Add and reuse org.apache.commons.io.IOUtils.close(Closeable, IOConsumer&lt;IOException&gt;).
       </action>
+      <action issue="IO-640" dev="ggregory" type="add" due-to="Gary Gregory">
+        NPE in org.apache.commons.io.IOUtils.contentEquals(InputStream, InputStream) when only one input is null.
+      </action>
     </release>
 
     <release version="2.6" date="2017-10-15" description="Java 7 required, Java 9 supported.">

diff --git a/src/main/java/org/apache/commons/io/IOUtils.java b/src/main/java/org/apache/commons/io/IOUtils.java
@@ -712,6 +712,9 @@ public static boolean contentEquals(final InputStream input1, final InputStream
         if (input1 == input2) {
             return true;
         }
+        if (input1 == null ^ input2 == null) {
+            return false;
+        }
         final BufferedInputStream bufferedInput1 = buffer(input1);
         final BufferedInputStream bufferedInput2 = buffer(input2);
         int ch = bufferedInput1.read();
@@ -740,25 +743,26 @@ public static boolean contentEquals(final InputStream input1, final InputStream
      * @throws IOException          if an I/O error occurs
      * @since 1.1
      */
-    public static boolean contentEquals(Reader input1, Reader input2)
+    @SuppressWarnings("resource")
+    public static boolean contentEquals(final Reader input1, final Reader input2)
             throws IOException {
         if (input1 == input2) {
             return true;
         }
 
-        input1 = toBufferedReader(input1);
-        input2 = toBufferedReader(input2);
+        BufferedReader bufferedInput1 = toBufferedReader(input1);
+        BufferedReader bufferedInput2 = toBufferedReader(input2);
 
-        int ch = input1.read();
+        int ch = bufferedInput1.read();
         while (EOF != ch) {
-            final int ch2 = input2.read();
+            final int ch2 = bufferedInput2.read();
             if (ch != ch2) {
                 return false;
             }
-            ch = input1.read();
+            ch = bufferedInput1.read();
         }
 
-        final int ch2 = input2.read();
+        final int ch2 = bufferedInput2.read();
         return ch2 == EOF;
     }
 
@@ -776,6 +780,7 @@ public static boolean contentEquals(Reader input1, Reader input2)
      * @throws IOException          if an I/O error occurs
      * @since 2.2
      */
+    @SuppressWarnings("resource")
     public static boolean contentEqualsIgnoreEOL(final Reader input1, final Reader input2)
             throws IOException {
         if (input1 == input2) {

diff --git a/src/test/java/org/apache/commons/io/IOUtilsTestCase.java b/src/test/java/org/apache/commons/io/IOUtilsTestCase.java
@@ -229,6 +229,18 @@ public synchronized void close() throws IOException {
     }
 
     @Test public void testContentEquals_InputStream_InputStream() throws Exception {
+        {
+            final ByteArrayInputStream input1 = new ByteArrayInputStream("".getBytes(StandardCharsets.UTF_8));
+            assertTrue(IOUtils.contentEquals((InputStream) null, null));
+        }
+        {
+            final ByteArrayInputStream input1 = new ByteArrayInputStream("".getBytes(StandardCharsets.UTF_8));
+            assertFalse(IOUtils.contentEquals(input1, null));
+        }
+        {
+            final ByteArrayInputStream input1 = new ByteArrayInputStream("".getBytes(StandardCharsets.UTF_8));
+            assertFalse(IOUtils.contentEquals(null, input1));
+        }
         {
             final ByteArrayInputStream input1 = new ByteArrayInputStream("".getBytes(StandardCharsets.UTF_8));
             assertTrue(IOUtils.contentEquals(input1, input1));