[IO-825] Some methods in EndianUtils throws IndexOutOfBoundsException when the provided byte array does not have enough data

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 2.16.0
• External issue URL: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64748
• External issue ID: 64748 64749
• Assignee: Unassigned
• Reporter: Sheung Chi Chan
• Created: 06/Dec/23 20:56
• Updated: 07/Dec/23 15:53
• Resolved: 07/Dec/23 15:53

Description

In `EndianUtils` class, the method for handling swappedShort / swappedInteger / swappedLong from or to byte array assumes that the byte array still has enough space or data with the provided offset for an Integer / Long / Short reading or writing. Thus a byte array with a much shorter length could make the code throw IndexOutOfBoundsException. A possible fix is adding a validation to ensure the byte array has enough data space before processing.

Some example code snippets are attached below.

public static void writeSwappedInteger(final byte[] data, final int offset, final int value) {
    data[offset + 0] = (byte) (value >> 0 & 0xff);
    data[offset + 1] = (byte) (value >> 8 & 0xff);
    data[offset + 2] = (byte) (value >> 16 & 0xff);
    data[offset + 3] = (byte) (value >> 24 & 0xff);
} 

public static int readSwappedUnsignedShort(final byte[] data, final int offset) {
    return ((data[offset + 0] & 0xff) << 0) + ((data[offset + 1] & 0xff) << 8);
}

Issue Links

• links to: GitHub Pull Request #521