Details
-
Bug
-
Status: Open
-
Major
-
Resolution: Unresolved
-
3.0.0
-
None
-
None
Description
There are a number of places where we are getting a length of an element or an array that could potentially cause an integer overflow to occur.
For example, all the binary number parsers have a getBitLength funciton that returns an int. It is unlikely for a binary number to have such a large length that it overflows, but if there were bad data or a bad dfdl:length expression, it could definately happen.
Currently there are calls in many different places that would need range checks to prevent this, so it may require some re-architecture to provide a clean solution.