WSIT Large Upload (MTOM) with Security OutOfMemoryError

Hi,
i have written a small WebService with MTOM-Feature.
If i want to secure this service (signing/encrypting) it runs into an
java.lang.OutOfMemoryError, it seems that the implementation of security does
not stream the attachments.

On the client and server side i have enabled MTOMFeature.

The Stacktrace is:
java.lang.OutOfMemoryError: Java heap space
at
org.jvnet.staxex.ByteArrayOutputStreamEx.readFrom(ByteArrayOutputStreamEx.java:71)
at org.jvnet.staxex.Base64Data.get(Base64Data.java:236)
at org.jvnet.staxex.Base64Data.length(Base64Data.java:277)
at
com.sun.xml.ws.encoding.MtomCodec$MtomXMLStreamReaderEx.getTextCharacters(MtomCodec.java:525)
at
com.sun.xml.ws.util.xml.XMLStreamReaderToXMLStreamWriter.handleCharacters(XMLStreamReaderToXMLStreamWriter.java:141)
at
com.sun.xml.ws.util.xml.XMLStreamReaderToXMLStreamWriter.bridge(XMLStreamReaderToXMLStreamWriter.java:106)
at
com.sun.xml.ws.message.stream.StreamMessage.writePayloadTo(StreamMessage.java:305)
at com.sun.xml.ws.message.stream.StreamMessage.writeEnvelope(StreamMessage.java:335)
at com.sun.xml.ws.message.stream.StreamMessage.writeTo(StreamMessage.java:313)
at
com.sun.xml.ws.message.stream.LazyStreamBasedMessage.readMessage(LazyStreamBasedMessage.java:484)
at
com.sun.xml.wss.jaxws.impl.SecurityTubeBase.verifyInboundMessage(SecurityTubeBase.java:442)
at
com.sun.xml.wss.jaxws.impl.SecurityServerTube.processRequest(SecurityServerTube.java:206)
at com.sun.xml.ws.api.pipe.Fiber.__doRun(Fiber.java:598)
at com.sun.xml.ws.api.pipe.Fiber._doRun(Fiber.java:557)
at com.sun.xml.ws.api.pipe.Fiber.doRun(Fiber.java:542)
at com.sun.xml.ws.api.pipe.Fiber.runSync(Fiber.java:439)
at com.sun.xml.ws.server.WSEndpointImpl$2.process(WSEndpointImpl.java:243)
at
com.sun.xml.ws.transport.http.HttpAdapter$HttpToolkit.handle(HttpAdapter.java:444)
at com.sun.xml.ws.transport.http.HttpAdapter.handle(HttpAdapter.java:244)
at
com.sun.xml.ws.transport.http.servlet.ServletAdapter.handle(ServletAdapter.java:135)
at
com.sun.xml.ws.transport.http.servlet.WSServletDelegate.doGet(WSServletDelegate.java:129)
at
com.sun.xml.ws.transport.http.servlet.WSServletDelegate.doPost(WSServletDelegate.java:160)
at com.sun.xml.ws.transport.http.servlet.WSServlet.doPost(WSServlet.java:75)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:710)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
#### Environment
Operating System: All
Platform: All
#### Affected Versions
[current]

Source: [https://github.com/javaee/metro-wsit/issues/1081](https://github.com/javaee/metro-wsit/issues/1081)
Author: glassfishrobot

Start with the stack-trace path through com.sun.xml.ws.encoding.MtomCodec, com.sun.xml.ws.message.stream.StreamMessage, and com.sun.xml.wss.jaxws.impl.SecurityTubeBase.verifyInboundMessage. Reproduce a secured MTOM upload with a large attachment and trace where attachment data is materialized; done means the upload no longer exhausts the Java heap during security processing.

Written by the indexing model from the issue text.