jackson-databind icon indicating copy to clipboard operation
jackson-databind copied to clipboard

Add explicit bounds checks for `ObjectMapper` and `ObjectReader` methods that take `byte[]`/`char[]` arrays

Open cowtowncoder opened this issue 1 year ago • 0 comments

(note: inspired by OSS-Fuzz tests like https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50003 and similar issue for jackson-core, https://github.com/FasterXML/jackson-core/issues/811 )

Currently methods like

ObjectReader.MappingIterator<T> readValues(byte[] src, int offset, int length)

do not actively verify that the range specified is valid and instead just let code that tries to access invalid location throw a range-out-of-bounds exception. It'd be better to pro-actively check validity first, both for ergonomics (can give better failure message for implementors) and for possibly more secure handling (we can give documented exception that caller knows to catch).

cowtowncoder avatar Aug 14 '22 23:08 cowtowncoder