[XMLBeans-666] XsTypeConverter: Fix out-of-bounds read in trimTrailingZeros for empty decimal

. Thanks to aizu-m. This closes #36

git-svn-id: https://svn.apache.org/repos/asf/xmlbeans/trunk@1935058 13f79535-47bb-0310-9956-ffa450edef68

Author: pjfanning

src/main/java/org/apache/xmlbeans/impl/util/XsTypeConverter.java

@@ -558,7 +558,7 @@ private static String trimInitialPlus(String xml) {
 
     private static String trimTrailingZeros(String xsd_decimal) {
         final int last_char_idx = xsd_decimal.length() - 1;
-        if (xsd_decimal.charAt(last_char_idx) == '0') {
+        if (last_char_idx >= 0 && xsd_decimal.charAt(last_char_idx) == '0') {
             final int last_point = xsd_decimal.lastIndexOf('.');
             if (last_point >= 0) {
                 //find last trailing zero

src/test/java/misc/checkin/XsTypeConverterTest.java

@@ -76,4 +76,17 @@ void lexFloatAcceptsValidValues() {
         assertEquals(Float.POSITIVE_INFINITY, XsTypeConverter.lexFloat("INF"));
         assertEquals(Float.NEGATIVE_INFINITY, XsTypeConverter.lexFloat("-INF"));
     }
+
+    @Test
+    void lexDecimalRejectsEmptyString() {
+        // an empty value used to read charAt(-1) in trimTrailingZeros and
+        // throw StringIndexOutOfBoundsException instead of NumberFormatException.
+        assertThrows(NumberFormatException.class, () -> XsTypeConverter.lexDecimal(""));
+    }
+
+    @Test
+    void lexDecimalTrimsTrailingZeros() {
+        assertEquals(0, new java.math.BigDecimal("1.5").compareTo(XsTypeConverter.lexDecimal("1.500")));
+        assertEquals(0, new java.math.BigDecimal("12").compareTo(XsTypeConverter.lexDecimal("12.000")));
+    }
 }