[Bug] UnsafeByteArrayInputStream large skips can overflow and rewind the cursor #16520

Pre-check

• I am sure that all the content I provide is in English.

Search before asking

• I had searched in the issues and found no similar issues.

Apache Dubbo Component

Java SDK (apache/dubbo)

Dubbo Version

Apache Dubbo 3.3.7-SNAPSHOT, branch 3.3 at b73b9d1; OpenJDK 21; Windows. The actual dubbo-common module was built and tested (release 8 compiler target). Released artifacts and full-repository or production-network behavior were not separately tested.

Steps to reproduce this issue

Reproduce against the unmodified source above with JUnit 5:

import org.apache.dubbo.common.io.UnsafeByteArrayInputStream;
import org.junit.jupiter.api.Test;
import static org.junit.jupiter.api.Assertions.assertEquals;

class LargeSkipRegression {
    @Test
    void skipMustStayWithinTheRemainingSlice() {
        UnsafeByteArrayInputStream in = new UnsafeByteArrayInputStream(
                new byte[] {10, 20, 30, 40}, 1, 2);
        assertEquals(20, in.read());
        assertEquals(1L, in.skip(Long.MAX_VALUE));
        assertEquals(-1, in.read());
    }
}

The skip assertion fails: expected 1, actual 9223372036854775807. A second case exhausting a three-byte stream before skip(Long.MAX_VALUE) expects 0 but reports the same huge count. The implementation adds mPosition to the requested long before clamping; the addition can overflow, and the subsequent position update can move backwards.

What you expected to happen

A positive skip must return no more than the remaining bytes in the current slice, leave the cursor at its limit, and keep EOF stable. Zero and negative requests must leave the position unchanged. A request to skip beyond a finite in-memory slice should consume only the remaining bytes.

Anything else

Seven new regression invocations cover Long.MAX_VALUE / Long.MAX_VALUE-1, a large non-overflowing control, slice offsets, EOF, mark/reset and nonpositive counts. Three fail before the fix; all 13 class invocations and 48 I/O package tests pass with the one-line bounds-check fix. Maven lifecycle Spotless check and git diff --check pass.

Checked existing issues/PRs by class name and skip/overflow terms. #16072 adds writeTo for zero-copy support and does not fix skip. A tested proposed patch and regression tests are on hickey-ai/dubbo branch codex/fix-byte-array-skip-overflow; I will link the corresponding PR. This is an ordinary InputStream correctness report, not a security or production-impact claim. Investigation and patch preparation were AI-assisted; the reported tests were executed locally.

Do you have a (mini) reproduction demo?

• Yes, I have a minimal reproduction demo to help resolve this issue more effectively!

Are you willing to submit a pull request to fix on your own?

• Yes I am willing to submit a pull request on my own!

Code of Conduct

• I agree to follow this project's Code of Conduct