textAccumulator.addText(buf, start, end) introduces security issue.

[ChangXiaoning]

Reproduce code

import com.fasterxml.aalto.util.*;

public static void main (String[] args) {
   textAccumulator = new TextAccumulator();
   char[] buf = new char[1840165617];
   textAccumulator.addText(buf, 0, buf.length);
}

Output

Exception in thread "main" java.lang.OutOfMemoryError: Java heap space
	at java.lang.AbstractStringBuilder.<init>(AbstractStringBuilder.java:68)
	at java.lang.StringBuilder.<init>(StringBuilder.java:106)
	at com.fasterxml.aalto.util.TextAccumulator.addText(TextAccumulator.java:51)
	at TextAccumulatorTest.main(TextAccumulatorTest.java:31)

Environment

jdk 1.8
aalto-xml 1.3.2

Analysis

Our service invokes textAccumulator.addText(buf, start, end). However, if the user provides malicious start and end, making the variable len very large. When the program allocates heap for this.mBuilder, an OutOfMemoryError happens and our service crashes. textAccumulator.addText() should check user input start and end.