Inputs from BufferedIndexInput.wrap and the default BufferedIndexInput.slice accept seek and skipBytes past the end instead of throwing EOFException

IndexInput#seek promises: "If this is beyond the end of the file then this will throw EOFException and then the stream is in an undetermined state", and skipBytes is "functionally equivalent" to that seek (IndexInput.java:69-91). The public static BufferedIndexInput.wrap(desc, in, offset, length) and the default BufferedIndexInput.slice(), which returns wrap(...), both return the private SlicedIndexInput. BufferedIndexInput.seek hands every target outside its buffer to seekInternal(pos), and SlicedIndexInput.seekInternal is empty, so seek(21) on a 20-byte input returns normally, getFilePointer() reports 21, and the error only comes at the next read. In normal use the core Directories' own inputs and slices (ByteBuffersDirectory, NIOFSDirectory, MMapDirectory) throw at the seek (an MMapDirectory input after a read has hit EOF is a separate bug, LFV-130), and NIOFSDirectory and RAFDirectory do it with exactly the check SlicedIndexInput lacks.

The empty method came with wrap() and the default slice() in LUCENE-4371 (4.9.0, 2014). It became a contract violation in 5.5.0, when LUCENE-6932 wrote the seek sentence and fixed four other inputs but not this one. Every release from 5.5.0 to 10.6.0 is affected. The reach is narrow: no default Directory on main produces this class; it is reached through direct wrap() calls, slices of BufferedIndexInput subclasses outside Lucene that keep the default slice(), and, in 9.0 to 10.1.x, slices of the opt-in DirectIODirectory. The first read after the accepted seek never returned data. A three-line check in SlicedIndexInput.seekInternal fixes it.

• IndexInput: Lucene's read handle on a file. seek(pos) moves the read position, getFilePointer() reports it, length() is the size, and skipBytes(n) is seek(getFilePointer() + n) (IndexInput.java:86-91).
• BufferedIndexInput (core, public, abstract, BufferedIndexInput.java:25): the base class for inputs that read through a buffer. Subclasses implement readInternal (fill the buffer from the current position) and seekInternal ("Sets current position in this file, where the next readInternal will occur", :336-342). The NIOFSDirectory and misc RAFDirectory inputs are subclasses.
• BufferedIndexInput.wrap(desc, in, offset, length) (public static, :371-379, javadoc: "in most cases ineffective, because it may double buffer!"): a buffered view of length bytes of another input, starting at offset. Its class is the private SlicedIndexInput (:382). The default slice() returns the same view (:354-357); the in-tree subclasses override it.

1. seek(pos) outside the buffer sets bufferStart = pos, empties the buffer and calls seekInternal(pos) (:326-334). It never compares pos with length(); that is left to the hook.
2. SlicedIndexInput.seekInternal is empty: protected void seekInternal(long pos) {} (:422-423). Any target is accepted, and getFilePointer(), which is bufferStart + buffer.position() (:321-322), returns it.
3. The first length check runs at the next read: refill() finds no bytes left and throws EOFException (:290-295); SlicedIndexInput.readInternal has a second check (:413-416). For some targets more than 2^31 bytes past the end, the int cast at :294 gives a value above the 1,024-byte buffer and the read fails with an unchecked IllegalArgumentException from buffer.limit (:303) instead (executed at 2^31+1 bytes past the end; at 2^32-10 or 2^32 bytes past the end the read still throws EOFException, at :415 or :295).
4. skipBytes goes through seek, and clones, slices and nested wraps of a wrapped input are SlicedIndexInputs too, so all of them accept the same targets.
5. The in-tree subclasses that conform put exactly this check in their own seekInternal (NIOFSDirectory.java:203-208, misc RAFDirectory.java:191-196: if (pos > length()) throw new EOFException(...)) and override slice().

30-byte file, wrap("w", in, 0, 20): seek(20) is legal; seek(21) returns normally and getFilePointer() is 21; skipBytes(21) on a fresh wrap also leaves it at 21; the next readByte() throws EOFException: read past EOF: ... [slice=w]. The stock ByteBuffersDirectory input (seek(31) on 30 bytes) and its own 20-byte slice (seek(21)) throw EOFException at the seek. The differential harness saw every past-end seek and skip accepted on the wrapper, its clones and its slices (144,211 sequences).

• Who is hit. Code that calls the public static BufferedIndexInput.wrap(...) directly, and clones and slices of such inputs. Downstream example: Apache Solr's block-cache input CustomBufferedIndexInput, which extends IndexInput (not BufferedIndexInput), returns BufferedIndexInput.wrap(...) from its own slice() (source read, not run). Slices of any BufferedIndexInput subclass outside Lucene that keeps the default slice(): they accept seeks past their end even when the subclass's own seek rejects them (executed: a strict subclass's own seek(101) throws, its 10-byte default slice accepts seek(11)).
• Also hit in 9.0.0 to 10.1.x: slices of the opt-in misc DirectIODirectory, whose slice() returned wrap(...) (executed on 9.1.0, 9.12.3, 10.0.0 and 10.1.0; the slice class is BufferedIndexInput$SlicedIndexInput). 10.2.0 gave them their own class (#14103).
• Not hit: every default setup on main. No in-tree Directory produces a SlicedIndexInput, and nothing in-tree calls wrap() (grep). Fresh MMapDirectory, NIOFSDirectory and ByteBuffersDirectory inputs and slices throw at the seek (differential harness and controls, on fresh inputs; LFV-130 is a separate MMapDirectory exception after a read has hit EOF).
• What happens. The illegal seek or skip succeeds and getFilePointer() reports a position beyond length(); the next read throws EOFException, or, for some targets more than 2^31 bytes past the end, IllegalArgumentException. Code that checks getFilePointer() after a seek, or relies on the seek to reject a bad offset, sees the error one call later, or never if it does not read.
• What does not happen. The first read after the accepted seek never returned a byte: a probe of 56,550 accepted past-end seeks or skips and 82,650 reads per run (main with assertions on and off, 10.5.2), and 42,252 reads on DirectIODirectory slices of 9.12.3 and 10.1.0, found no byte from outside the input. Caveat from the same probe: a caller that catches that failure and reads again can, for some targets more than 2^31 bytes past the end, get zeros or bytes this input buffered earlier, never bytes from outside it; that stale-byte half is a separate, already tracked refill() defect (LFV-492), and fix A removes this route to it. No Lucene code path was found that reads the same input again after this exception; CodecUtil.checkFooter(in, priorException) does keep using an input after an earlier exception, but for a position past the end it throws CorruptIndexException before it reads (CodecUtil.java:482).
• Default vs opt-in, scale. Opt-in: an expert API (wrap(), or a custom BufferedIndexInput subclass), or the opt-in DirectIODirectory in 9.0 to 10.1.x. One byte past the end is enough; data size plays no part. Valid indexes never produce such a target. Likelihood: rare; no matching public report was found in the sources searched.

TestBufferedIndexInputWrapSeekPastEOF writes 30 zero bytes to a ByteBuffersDirectory file, opens it, takes BufferedIndexInput.wrap("w", in, 0, 20) and asserts expectThrows(EOFException.class, () -> wrapped.seek(21)). The file is 30 bytes so the target 21 is inside the file but one byte past the 20-byte input. Public API only (wrap is public static); the package is org.apache.lucene.store only because that is where an upstream test would live. No randomness of its own; seeds DEADBEEF and 5EED0480 (10 iterations) give the same failure.

As the regression test: this same test, for example as testWrapSeekPastEOF in TestBufferedIndexInput. With fix A it passes, and ./gradlew :lucene:core:check -x test passes with it as a new test file.

cp $REPRO/TestBufferedIndexInputWrapSeekPastEOF.java $LUCENE/lucene/core/src/test/org/apache/lucene/store/
cd $LUCENE && ./gradlew :lucene:core:test --tests org.apache.lucene.store.TestBufferedIndexInputWrapSeekPastEOF -Ptests.seed=DEADBEEF
# assertions off: add -Ptests.asserts=false (same result)

TestBufferedIndexInputWrapSeekPastEOF > testWrapSeekPastEOF FAILED
    junit.framework.AssertionFailedError: Expected exception EOFException but no exception was thrown
        at __randomizedtesting.SeedInfo.seed([DEADBEEF:56AA807DD014B8DF]:0)
        at app//org.apache.lucene.tests.util.LuceneTestCaseParent.expectThrows(LuceneTestCaseParent.java:1432)
        at app//org.apache.lucene.tests.util.LuceneTestCaseParent.expectThrows(LuceneTestCaseParent.java:1418)
        at app//org.apache.lucene.store.TestBufferedIndexInputWrapSeekPastEOF.testWrapSeekPastEOF(TestBufferedIndexInputWrapSeekPastEOF.java:33)

(gradle, scratch worktree of 645d4fe14a20, seed DEADBEEF, assertions off; the same with assertions on)

What the input does after the accepted seek (a main() probe on the same input, not part of the repro):
wrapped class=org.apache.lucene.store.BufferedIndexInput$SlicedIndexInput length()=20
seek(20) ok, getFilePointer()=20
seek(21) accepted, getFilePointer()=21
readByte() after seek(21): EOFException: read past EOF: (clone of) ByteBuffersIndexInput (file=f, buffers=30 bytes, block size: 1, blocks: 1, position: 0) [slice=w]
skipBytes(21) accepted, getFilePointer()=21
stock ByteBuffersDirectory slice seek(21): EOFException
stock ByteBuffersDirectory input seek(31) on 30 bytes: EOFException

• Contract, this exact call. IndexInput#seek: "Sets current position in this file, where the next read will occur. If this is beyond the end of the file then this will throw EOFException and then the stream is in an undetermined state." (IndexInput.java:69-71). skipBytes: "Behavior is functionally equivalent to seeking to getFilePointer() + numBytes" (:80). Neither wrap() nor slice() documents an exception.
• Written on purpose, for all implementations. LUCENE-6932 (#7990, ddc65d977f92, 2016-01-21, 5.5.0) added that sentence and the API-change entry "IndexInput.seek implementations now throw EOFException if you seek beyond the end of the file" (lucene/CHANGES.txt:9726-9727). Its discussion chose to "throw EOFException immediately if you try to seek beyond the end of the file, rather than delaying it until the next read" (patch comment, 2016-01-21). It fixed the RAM, NIOFS, SimpleFS and RAF inputs; its 30 comments never mention SlicedIndexInput or wrap.
• Tests. BaseDirectoryTestCase#testSeekPastEOF ("Seeking past EOF should always throw EOFException", :731) and #testSeekBeyondEndOfFile run against Directories; no in-tree Directory produces this class and no upstream test calls wrap(), so it was never exercised.
• Consistency. In normal use the core Directories' inputs and slices (ByteBuffersDirectory, NIOFSDirectory, MMapDirectory) throw at the seek in the same differential harness, and the two in-tree BufferedIndexInput subclasses implement the check in their seekInternal. (Two separate, state- or class-specific exceptions are tracked on their own: an MMapDirectory input after a read hit EOF, LFV-130, and the DirectIOIndexInput slice slack pinned by #16619.) Executed 5.4.1 against 5.5.0: the wrap results are identical, only the stock controls switch from accepting to throwing.

The strongest case for "not a bug" (verifiers and the adjudication built it): lazy EOF on the next read is how BufferedIndexInput always worked, and seekInternal's javadoc does not ask for a check; wrap() is discouraged ("in most cases ineffective, because it may double buffer!"; LUCENE-5681: "It is almost always a better idea to implement slicing on your own!") and a 2014 Won't Fix (#6890, LUCENE-5828) said "The slice wrapper is not used in any core directories, so maybe we should leave it as it is"; #16619 (2026-09) tolerates an analogous slack in DirectIOIndexInput, and one of its tests deliberately keeps a seek beyond a slice's length working there; and nothing in-tree reaches it on main.

Why it fails: LUCENE-6932 replaced the lazy model on purpose, two years after #6890, and listed it under API changes for all implementations. The warnings about wrap() concern double buffering and per-byte bounds-check cost, not seek semantics, and the fix adds nothing per byte (seekInternal runs only for seeks outside the buffer). #16619 is partly a fair point: it made the first fill of a DirectIOIndexInput slice lazy and pinned the old behaviour in two tests, one called "a characterization test, not an endorsement" (TestDirectIODirectory.java:380-386), the other (testSeekBeyondSliceLengthMatchesEagerBehaviour, :448-483) keeping a seek beyond a slice's length working, with the next read returning the byte past the slice's end while the target stays inside the buffered window. It is a different class with a different fix site, and the tests keep old behaviour through a refactor rather than define the contract, but they show maintainers keeping a similar quirk for compatibility. "Not reached in-tree" limits impact, not validity: wrap() is public static and BufferedIndexInput is a public, non-final base class whose default slice() returns it. This is a real contract violation; maintainers may still accept it as long-standing, low-value compatibility behaviour, which is a choice of priority, compatibility or fix site, not "works as designed".

Fix A is the recommended, validated fix. Fix B, the alternative site the adjudication named, was validated too. Option C is listed for completeness. All gradle runs were in scratch worktrees of 645d4fe14a20, removed afterwards.

Throw EOFException from SlicedIndexInput.seekInternal when pos > length, with the same check and message as NIOFSDirectory and RAFDirectory. seek(length) stays legal.

--- a/lucene/core/src/java/org/apache/lucene/store/BufferedIndexInput.java
+++ b/lucene/core/src/java/org/apache/lucene/store/BufferedIndexInput.java
@@ -420,7 +420,11 @@
     }
 
     @Override
-    protected void seekInternal(long pos) {}
+    protected void seekInternal(long pos) throws EOFException {
+      if (pos > length) {
+        throw new EOFException("read past EOF: pos=" + pos + " vs length=" + length + ": " + this);
+      }
+    }
 
     @Override
     public void close() throws IOException {

Trade-offs

• Covers wrap(), the default slice(), clones and nested wraps (all SlicedIndexInput), skipBytes (through seek) and positional RandomAccessInput reads, which call seekInternal directly (BufferedIndexInput.java:239); far targets then get EOFException instead of IllegalArgumentException too (executed in a probe with this check shadowed: 0 accepted).
• Cost: one comparison per seek outside the buffer, nothing per byte (the concern of #6890).
• Does not help third-party subclasses whose own seekInternal is empty.
• It throws from seekInternal, which BufferedIndexInput.seek calls after it has set bufferStart = pos and emptied the buffer (:330-332), so after the exception getFilePointer() reports the rejected target. IndexInput#seek allows that ("then the stream is in an undetermined state"), but callers must not keep using the input after catching it; fix B rejects before any state change.

What the checks validated

• Gradle, scratch worktree of 645d4fe14a20, seed DEADBEEF, 2026-11-01: without the fix the repro fails with assertions on and off; with it, it passes with assertions on and off.
• Every core store test, ./gradlew :lucene:core:test --tests 'org.apache.lucene.store.*' with the repro: 29 classes, 777 tests, 0 failures, 17 skipped (among them TestBufferedIndexInput, TestNIOFSDirectory, TestMMapDirectory, TestByteBuffersDirectory).
• ./gradlew :lucene:core:check -x test with the fix and the repro as a new test file: passes (google-java-format, ecj lint, forbidden APIs; error-prone skipped). The full Lucene test suite was not run.
• A first pass with the finder's two-line message passed every test but failed google-java-format, which wants the message on one line; the diff above is the formatted one.
• Earlier, with the fix shadowed into the stock jars: the finder's 3 tests, the independent reproducer's 6 tests and upstream TestNIOFSDirectory plus TestBufferedIndexInput (67 tests) pass; the minimal repro passes with assertions on and off; a 5.5.0 port passes with the same check.

Reject pos > length() in the out-of-buffer branch of BufferedIndexInput.seek, before any state changes.

--- a/lucene/core/src/java/org/apache/lucene/store/BufferedIndexInput.java
+++ b/lucene/core/src/java/org/apache/lucene/store/BufferedIndexInput.java
@@ -327,6 +327,10 @@
     if (pos >= bufferStart && pos < (bufferStart + buffer.limit()))
       buffer.position((int) (pos - bufferStart)); // seek within buffer
     else {
+      if (pos > length()) {
+        throw new EOFException(
+            "seek past EOF: pos=" + pos + " vs length=" + length() + ": " + this);
+      }
       bufferStart = pos;
       buffer.limit(0); // trigger refill() on read
       seekInternal(pos);

Trade-offs

• Enforces the contract for every BufferedIndexInput subclass, including outside ones whose seekInternal is a no-op (the in-tree test helper FaultyIndexInput in TestFieldsReader has one; it overrides slice(), so it is not this class).
• A behaviour change for all subclasses, not just this class; one virtual length() call per out-of-buffer seek; duplicates the checks NIOFSDirectory and RAFDirectory already make.
• Positional reads call seekInternal without seek (:239) and keep today's behaviour: EOFException from refill(), but IllegalArgumentException for some targets more than 2^31 bytes past the end (code reading). A and B can be combined.

What the checks validated

• Gradle, same worktree setup, seed DEADBEEF: the repro passes with assertions on and off.
• Every core store test plus TestFieldsReader: 30 classes, 779 tests, 0 failures, 17 skipped; every misc store test (TestRAFDirectory, TestDirectIODirectory and three more): 5 classes, 244 tests, 0 failures, 6 skipped.
• ./gradlew :lucene:core:check -x test with the fix and the repro: passes.

State in the wrap() and default slice() javadoc that a seek past the end is detected only on the next read.

Trade-offs

• No behaviour change, but it leaves IndexInputs that break their own interface's contract, which LUCENE-6932 removed elsewhere; the regression test would pin the lenient behaviour instead.

• Method: bounded-exhaustive differential checking of the real jar against exact semantics (the hunt's semi-formal tier), in the hunt unit on store implementations. The harness ran every 1- and 2-operation sequence on BufferedIndexInput.wrap over a ByteBuffersDirectory input, on the top-level wrapper, its clones and its slices (144,211 sequences, 301,319 checks), against an independent reference model and the stock Directory inputs, comparing returned values, file pointers and exception classes.
• Signal: every seek or skipBytes past the end was accepted (bucket ACCEPTS_ILLEGAL) where the reference model and the stock inputs in the harness throw EOFException, with no value or file-pointer mismatch on legal operations.
• Then: code reading located the empty SlicedIndexInput.seekInternal, and the finding was reduced to a public-API JUnit test; later an independent reproducer, an intended-behaviour devil's advocate, cross-model reviews and an adjudication checked it, the history was bisected by execution, and the test was reduced to one method (2026-10-29).