jsoniter-scala
jsoniter-scala copied to clipboard
Possible out of bound write serializing double
I was porting your schubfach implementation (it's very nice by the way so thank you for that) and encountered a case where I was seeing a write past the end of the buffer.
I think an example case would be something like: Double.longBitsToDouble(-6634365113987401870L)
It appeared what was happening was the initial ensureCapacity(24) reserves all the space needed for the double representation, but when write3Digits runs to write the last 3 digits of a double that will take the full 24 bytes then it writes 4 bytes (even though only 3 are used) and the last byte could be past the end of the buffer. Of course, I may have missed something in the port, but I thought I would report it just in case.
@ctrychta Thanks for reporting! Probably the bug exists in jsoniter-scala-core code for both JVM and Scala Native platforms. I'll try to reproduce it in unit tests.
@ctrychta Thanks again! The bug was reproduced by unit tests after improving them to use buffers of different sizes.
Also, I cut v2.30.2 release with a fix.