search

fusesource / jansi

Jansi is a small java library that allows you to use ANSI escape sequences to format your console output which works even on windows.
http://fusesource.github.io/jansi/
Apache License 2.0
1.1k stars 139 forks source link

Fix infinite loop bug #252

Closed arthurscchan closed 10 months ago

arthurscchan commented 11 months ago

This fixes an infinite loop bug in src/main/java/org/fusesource/jansi/Ansi.java.

The scrollUp(int) and scrollDown(int) methods first check the input and determine what value to return. If a negative row number is provided, the method will use a minus sign to change it to a positive number and call its counterpart to handle. In general, this has no problem at all. But if the provided number is Integer.MIN_VALUE, which is -2147483648, it will create an infinite loop. The main reason is -(-2147483648) = 2147483648. But the max value of integer is only 2147483647 in java. Thus the number 2147483648 will wrap around and become -2147483648 again. This creates an infinite loop because the number always remains negative.

This PR fixes this possible bug by adding a conditional checking to ensure Integer.MIN_VALUE is changed to Integer.MAX_VALUE before calling the counterpart method to avoid the infinite loop.

We found this bug using fuzzing by way of OSS-Fuzz, where we recently integrated jansi (https://github.com/google/oss-fuzz/pull/10705). OSS-Fuzz is a free service run by Google for fuzzing important open source software. If you'd like to know more about this then I'm happy to go in details and also set up things so you can receive emails and detailed reports when bugs are found.

gnodet commented 11 months ago

Thx, could you add an additional unit test ? that would be awesome @arthurscchan

arthurscchan commented 11 months ago

@gnodet Thanks for your reply. Yes I could add a unit test. Will do so soon.