FasterXML / jackson-dataformats-binary

Uber-project for standard Jackson binary format backends: avro, cbor, ion, protobuf, smile
Apache License 2.0
316 stars 136 forks source link

`IonReader.next()` throws `ArrayIndexOutOfBoundsException` for some corrupt content #473

Closed cowtowncoder closed 9 months ago

cowtowncoder commented 9 months ago

(note: OSS-Fuzz sourced from https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66131)

Looks like there's a code path that produces AIOOBE for corrupt content, with stack trace of:

    == Java Exception: java.lang.ArrayIndexOutOfBoundsException: Index 16 out of bounds for length 16
     at com.amazon.ion.impl.IonCursorBinary.uncheckedNextToken(IonCursorBinary.java:1571)
     at com.amazon.ion.impl.IonCursorBinary.nextValue(IonCursorBinary.java:1714)
     at com.amazon.ion.impl.IonReaderContinuableCoreBinary.nextValue(IonReaderContinuableCoreBinary.java:460)
     at com.amazon.ion.impl.IonReaderContinuableApplicationBinary.nextValue(IonReaderContinuableApplicationBinary.java:942)
     at com.amazon.ion.impl.IonReaderContinuableTopLevelBinary.handleIncompleteValue(IonReaderContinuableTopLevelBinary.java:150)
     at com.amazon.ion.impl.IonReaderContinuableTopLevelBinary.next(IonReaderContinuableTopLevelBinary.java:166)
     at com.fasterxml.jackson.dataformat.ion.IonParser.nextToken(IonParser.java:657)
     at com.fasterxml.jackson.core.JsonParser.nextTextValue(JsonParser.java:1161)
cowtowncoder commented 9 months ago

Unable to reproduce at this point; most code paths / call sequences produce proper IonException. Will try to tweak test case bit more to reproduce.

cowtowncoder commented 9 months ago

@tgregg This is for the 3rd OSS-Fuzz reported new-or-recycled issue, I was unable to reproduce.

@arthurscchan Maybe you can reproduce this issue? Idea is to reproduce but not add defensive programming yet, to let ion-java developers to handle at appropriate level

tgregg commented 9 months ago

477 tweaks the test case to reproduce the problematic stack trace.

cowtowncoder commented 9 months ago

Test now fails properly. Thank you @tgregg !