-
-
Notifications
You must be signed in to change notification settings - Fork 816
Closed
Labels
2.17Issues planned (at earliest) for 2.17Issues planned (at earliest) for 2.17
Milestone
Description
(note: found by OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61198)
Looks like there is a case where, if:
JsonParser
configured to accept non-standard leading plus sign (JsonReadFeature.ALLOW_LEADING_PLUS_SIGN_FOR_NUMBERS
)- Content is read using character-based parser (
ReaderBasedJsonParser
) - Some boundary condition is reached (can emulate with 1-char-at-a-time Reader)
- Call is made to
JsonParser.getNumberType()
(or possibly other number accessors)
there's an AIOOBE with stack trace like:
at com.fasterxml.jackson.core.io.NumberInput.parseInt(NumberInput.java:55)
at com.fasterxml.jackson.core.util.TextBuffer.contentsAsInt(TextBuffer.java:631)
at com.fasterxml.jackson.core.base.ParserBase._parseNumericValue(ParserBase.java:891)
at com.fasterxml.jackson.core.base.ParserBase.getNumberType(ParserBase.java:735)
Metadata
Metadata
Assignees
Labels
2.17Issues planned (at earliest) for 2.17Issues planned (at earliest) for 2.17