FileBackedOutputStream failing to write with system account on windows

[thebluemountain]

hi,

checking at CVE for an application, we are upgrading project dependencies.
among them, the application is using the guava library, 31.1-jre.

testing with the guava 32.0.1-jre on windows 2K12R2 with jdk 11.0.16.1, the FileBackedOutputStream failed to write when size exceeds the supplied threshold and the current user's account is the 'local system'

looking a bit further at the error, i see the error is occurring in the FileBackedOutputStream.update () method , when creating a new FileOutputStream from the temporary file created by the TempFileCreator.JavaNioCreator.createTempFile () method.

I created a test program to reproduce the error when running on windows 2K12R2 with 'local system' account.

It seems we can avoid this issue by using the Files.copy (InputStream, Path, CopyOption) to transfer the content of the memory buffer to the temporary file.

guava-issue.zip

attached is a log of the error and the source of sample program (Main.java) that generates the error and that allows for testing the Files.copy () equivalent, both packaged in a zip file.

Q: would it be possible to change the FileBackedOutputStream.update () method implementation to avoid such issue?

[cpovirk]

Sorry for the trouble. This is caused by the same problem as #6634. I found a fix last week, but my reviewer ended up out of the office for a little longer than expected, so I reassigned it yesterday. I hope to get it submitted soon. You can follow that other issue for updates.

[cpovirk]

Oh, I should ask: Are you using Java 8 or some newer version?

[thebluemountain]

hi,

this is the used jdk on windows: 11.0.16.1