search

frizbog / gedcom4j

Java library for reading/writing genealogy files in GEDCOM format
http://gedcom4j.org
53 stars 36 forks source link

NullPointerException vulnerability in StringTreeBuilder #163

Closed frizbog closed 7 years ago

frizbog commented 7 years ago

User reports following crash:

Caused by: java.lang.NullPointerException: Attempt to invoke virtual method 'java.lang.String java.lang.String.intern()' on a null object reference at org.gedcom4j.parser.StringTreeBuilder.addNewNode(StringTreeBuilder.java) at org.gedcom4j.parser.StringTreeBuilder.getTree(StringTreeBuilder.java) appendLine(StringTreeBuilder.java) at org.gedcom4j.parser.GedcomParser.load(GedcomParser.java) ...

Will address in 3.2.2 release and 4.0 release.

frizbog commented 7 years ago

The problem here was that there was no valid tag value in the line to intern, which means a malformed file or something to that effect. There's no way to recover from this, but a GedcomParserException would be preferable to a NullPointerException, so that's what I'm doing.

frizbog commented 7 years ago

3.2.2-SNAPSHOT as of 2016-09-27T18:30:47-04:00 has a fix (which is to change the exception thrown, with a somewhat helpful message) 4.0.0-SNAPSHOT as of 2016-09-27T18:35:14-04:00 has the same fix.

frizbog commented 7 years ago

Released in v3.2.2