[LANG-1722] SerializationUtils.deserialize could throw NegativeArraySizeException if invalid input is provided

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 3.15.0
• External issue URL: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64578
• External issue ID: 64578 64756
• Assignee: Unassigned
• Reporter: Sheung Chi Chan
• Created: 04/Dec/23 22:34
• Updated: 07/Dec/23 13:51
• Resolved: 07/Dec/23 13:51

Description

SerializationUtils.deserialize(InputStream)  transform the provided InputStream object into an ObjectInputStream object then call the readObject method of the newly created ObjectInputStream object. But there is one problem, the readObject method (and its underlying methods) will create an temporary array with the size provided from the data of the provided InputStream. Thus if the designated bytes of the InputStream object is negative and are used for the array creation. It will result in NegativeArraySizeException.

public static <T> T deserialize(final InputStream inputStream) {
        Objects.requireNonNull(inputStream, "inputStream");
        try (ObjectInputStream in = new ObjectInputStream(inputStream)) {
            @SuppressWarnings("unchecked")
            final T obj = (T) in.readObject();
            return obj;
        } catch (final ClassNotFoundException | IOException ex) {
            throw new SerializationException(ex);
        }
    } 

Issue Links

• links to: GitHub Pull Request #1141