jackson-databind
jackson-databind copied to clipboard
Add explicit bounds checks for `ObjectMapper` and `ObjectReader` methods that take `byte[]`/`char[]` arrays
(note: inspired by OSS-Fuzz tests like https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50003 and similar issue for jackson-core
, https://github.com/FasterXML/jackson-core/issues/811 )
Currently methods like
ObjectReader.MappingIterator<T> readValues(byte[] src, int offset, int length)
do not actively verify that the range specified is valid and instead just let code that tries to access invalid location throw a range-out-of-bounds exception. It'd be better to pro-actively check validity first, both for ergonomics (can give better failure message for implementors) and for possibly more secure handling (we can give documented exception that caller knows to catch).