Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add explicit bounds checks for JsonGenerator methods that take byte[]/char[]/String-with-offsets input #811

Closed
cowtowncoder opened this issue Aug 13, 2022 · 0 comments
Labels
2.14 Issue planned (at earliest) for 2.14 oss-fuzz Issue uncovered by oss-fuzz fuzzer
Milestone

Comments

@cowtowncoder
Copy link
Member

(note: inspired by issues like https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50065 uncovered by oss-fuzz)

Currently many of the write methods, like:

    public void writeRaw(char[] text, int offset, int len);

in JsonGenerator do not explicitly check validity of offset and len wrt to input buffer (text).
So they will fail for things like ArrayIndexOutOfBounds exception, possibly after writing some of the content.
It would make more sense to validate bounds first and give meaningful exception instead (StreamWriteException).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
2.14 Issue planned (at earliest) for 2.14 oss-fuzz Issue uncovered by oss-fuzz fuzzer
Projects
None yet
Development

No branches or pull requests

1 participant