[DIRAPI-402] unhandled exception (ArrayIndexOutOfBoundsException) in LDAP URL parser

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.1.6
• Fix Version/s: 2.1.7
• Assignee: Unassigned
• Reporter: Andrey Slepykh
• Created: 28/May/24 11:56
• Updated: 28/May/24 14:31
• Resolved: 28/May/24 14:31

Description

Hi, we have found another unhandled exception (ArrayIndexOutOfBoundsException) in LDAP URL parser version 2.1.6.

Steps to reproduce:
1. Download Apache Directory LDAP API v2.1.6:

wget wget https://github.com/apache/directory-ldap-api/archive/refs/tags/2.1.6.tar.gz
tar xf 2.1.6.tar.gz && rm 2.1.6.tar.gz

2. Compile the project (we used jdk-11 and mvn-3.9.6):

cd directory-ldap-api-2.1.6
mvn clean package

3. Get the reproducer:

mkdir fuzz && cd fuzz
mv <path/to/reproducer>/ReproducerIndexOutOfRange.java .

4. Compile the reproducer

javac -cp ../ldap/model/target/classes/ ./ReproducerIndexOutOfRange.java

5. Reproduce the exception:

java -cp ../ldap/model/target/classes/:../../jazzer/jazzer_standalone.jar:.:../util/target/classes/:../integ-osgi/target/dependency/slf4j-api-1.7.36.jar:../i18n/target/classes/:../integ-osgi/target/dependency/org.apache.servicemix.bundles.antlr-2.7.7_5.jar ReproducerIndexOutOfRange

 

Found by Linux Verification Center (portal.linuxtesting.ru) with jazzer.
Author L.Reviakin ([e-mail])