Skip to content

GuavaCollectionDeserializer still throws NPE in some circumstances #138

@arthurscchan

Description

@arthurscchan

In #124, the NullPointerException thrown from GuavaImmutableCollectionDeserializer::_deserializeContents(...) method is fixed by adding a _tryToAddNull() method to try if null could be added and wrap the NullPointerException if failed. But the call to the method is only added to the first branch of the conditional check. It is found that the second and third branches could also make value null. Thus the _tryToAddNull() method call should be moved outside of the conditional check, just before the builder.add(value) is called to ensure the value must not be null when invoking the builder.add(value) method.

        protected T _deserializeContents(JsonParser p, DeserializationContext ctxt)
        throws IOException
    {
        ...
        while ((t = p.nextToken()) != JsonToken.END_ARRAY) {
           ...
                if (value == null) {
                    if (value == null) {
                        _tryToAddNull(p, ctxt, builder);
                        continue;
                    }
                }
            } else if (typeDeser == null) {
                value = valueDes.deserialize(p, ctxt);
            } else {
                value = valueDes.deserializeWithType(p, ctxt, typeDeser);
            }

            builder.add(value);
        }
      ...

Fixes could be implemented by moving the _tryToAddNull() method call to the end of the conditional check, just before the invocation of the builder.add(value) method.

We found this issue by OSS-Fuzz and it is reported in https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65117 after the fixes from #124 have been merged.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions