[IO-825] Some methods in EndianUtils throws IndexOutOfBoundsException when the provided byte array does not have enough data - ASF JIRA

Attach files

Attach Screenshot

Voters

Watch issue

Watchers

Create sub-task

Link

Clone

Update Comment Author

Replace String in Comment

Update Comment Visibility

Delete Comments

XML

Word

Printable

JSON

Details

Type: Bug
Status: Resolved
Priority: Minor
Resolution: Fixed
Affects Version/s: None
Fix Version/s: 2.16.0
Component/s: None
Labels:
None

External issue URL:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64748
External issue ID:
64748 64749

Description

In `EndianUtils` class, the method for handling swappedShort / swappedInteger / swappedLong from or to byte array assumes that the byte array still has enough space or data with the provided offset for an Integer / Long / Short reading or writing. Thus a byte array with a much shorter length could make the code throw IndexOutOfBoundsException. A possible fix is adding a validation to ensure the byte array has enough data space before processing.

Some example code snippets are attached below.

public static void writeSwappedInteger(final byte[] data, final int offset, final int value) {
    data[offset + 0] = (byte) (value >> 0 & 0xff);
    data[offset + 1] = (byte) (value >> 8 & 0xff);
    data[offset + 2] = (byte) (value >> 16 & 0xff);
    data[offset + 3] = (byte) (value >> 24 & 0xff);
}

public static int readSwappedUnsignedShort(final byte[] data, final int offset) {
    return ((data[offset + 0] & 0xff) << 0) + ((data[offset + 1] & 0xff) << 8);
}