GCP: Reject invalid GCS buffered read ranges

[charliec05]

Summary

• validate offset and length in GCSInputStream.read(byte[], int, int)
• stop silently truncating reads whose requested range exceeds the destination buffer
• cover overflow, negative offset, and negative length cases

Motivation

GCSInputStream used Math.min when setting the reusable ByteBuffer limit. A request such as reading three bytes at offset two into a four-byte array was silently shortened to two bytes instead of throwing IndexOutOfBoundsException as required by the InputStream contract.

The existing EOF test also passed a length larger than its buffer; it now uses the buffer's actual length so it continues to exercise EOF with a valid range.

Testing

• ./gradlew :iceberg-gcp:spotlessApply :iceberg-gcp:test

---

AI Disclosure

• Model: GPT-5 (Codex)
• Platform/Tool: OpenAI Codex
• Human Oversight: fully reviewed
• Prompt Summary: Used a detailed, repository-aware prompt to inspect buffered read contracts, reproduce silent range truncation, implement explicit validation, review the resulting diff, and run the complete affected module test suite.

[charliec05]

Hi @szehon-ho, would you be willing to review this GCSInputStream contract fix? It rejects invalid buffered-read ranges instead of silently truncating them, includes boundary regression coverage, and all 42 CI checks pass. Thanks!

[uros-b]

+1, thank you @charliec05! Yes please ping @szehon-ho for additional review here

[charliec05]

Thanks for the review, @uros-b. @szehon-ho, could you take a look when you have time? The current revision has uros-b's approval and all 42 checks pass; there are no outstanding code-change requests.