Add maximum buffer size cap to ByteArrayOutputStream

Cap individual buffer allocations to 16MB to prevent excessive memory usage.
The previous implementation allowed buffers to double indefinitely, which could
lead to very large single allocations (32MB, 64MB, 128MB, etc.) that contribute
to heap exhaustion.

With this cap, when more than 16MB of data needs to be stored, the
ByteArrayOutputStream will create multiple 16MB buffers instead of one giant
buffer. This spreads the memory allocation across multiple smaller chunks
and prevents heap fragmentation issues.

Combined with the reduced threshold in ConcurrentJarCreator, this provides
defense-in-depth against OutOfMemoryError during zip archive creation.

Co-authored-by: slachiewicz <[email protected]>

Author: Copilot

src/main/java/org/codehaus/plexus/archiver/zip/ByteArrayOutputStream.java

@@ -57,6 +57,12 @@ public class ByteArrayOutputStream extends OutputStream {
      */
     private static final byte[] EMPTY_BYTE_ARRAY = new byte[0];
 
+    /**
+     * Maximum size of a single buffer (16MB) to prevent excessive memory allocation.
+     * When buffers need to grow beyond this size, additional buffers are created instead.
+     */
+    private static final int MAX_BUFFER_SIZE = 16 * 1024 * 1024;
+
     /**
      * The list of buffers, which grows and never reduces.
      */
@@ -136,6 +142,9 @@ private void needNewBuffer(final int newcount) {
                 filledBufferSum += currentBuffer.length;
             }
 
+            // Cap the buffer size to prevent excessive memory allocation
+            newBufferSize = Math.min(newBufferSize, MAX_BUFFER_SIZE);
+
             currentBufferIndex++;
             currentBuffer = new byte[newBufferSize];
             buffers.add(currentBuffer);