Skip to content

IonReader.next() throws ArrayIndexOutOfBoundsException for some corrupt content #473

@cowtowncoder

Description

@cowtowncoder

(note: OSS-Fuzz sourced from https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66131)

Looks like there's a code path that produces AIOOBE for corrupt content, with stack trace of:

 	== Java Exception: java.lang.ArrayIndexOutOfBoundsException: Index 16 out of bounds for length 16
	 at com.amazon.ion.impl.IonCursorBinary.uncheckedNextToken(IonCursorBinary.java:1571)
	 at com.amazon.ion.impl.IonCursorBinary.nextValue(IonCursorBinary.java:1714)
	 at com.amazon.ion.impl.IonReaderContinuableCoreBinary.nextValue(IonReaderContinuableCoreBinary.java:460)
	 at com.amazon.ion.impl.IonReaderContinuableApplicationBinary.nextValue(IonReaderContinuableApplicationBinary.java:942)
	 at com.amazon.ion.impl.IonReaderContinuableTopLevelBinary.handleIncompleteValue(IonReaderContinuableTopLevelBinary.java:150)
	 at com.amazon.ion.impl.IonReaderContinuableTopLevelBinary.next(IonReaderContinuableTopLevelBinary.java:166)
	 at com.fasterxml.jackson.dataformat.ion.IonParser.nextToken(IonParser.java:657)
	 at com.fasterxml.jackson.core.JsonParser.nextTextValue(JsonParser.java:1161)

Metadata

Metadata

Assignees

No one assigned

    Labels

    2.17fuzzIssue found by OssFuzzion

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions