Uploaded image for project: 'Xerces2-J'
  1. Xerces2-J
  2. XERCESJ-1257

buffer overflow in UTF8Reader for characters out of BMP

Attach filesAttach ScreenshotAdd voteVotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Reopened
    • Priority: Minor
    • Resolution: Unresolved
    • Affects Version/s: 2.9.0
    • Fix Version/s: None
    • Labels:
      None
    • Environment:
      Any

      Description

      There is a ArrayOutOfBoundsException in org.apache.xerces.impl.io.UTF8Reader, in read(char[],int,int) for 4-byte utf-8 chars.

      Imagine a following scenario. read() has a buffer of size N, and it reads N-1 ascii chars, and stores it in the output buffer. Let the Nth char be the first byte of a 4 byte utf-8 char. The other 3 bytes are fetched by invoking read() on the input stream. From these a surrogate pair of java chars is made, however, method does not check if both chars can fit into the output buffer ... In most cases, they would fit into the ouput buffer (e.g. if there are some other multi-byte chars in the fetched text), so the bug is very rare, but it still happens.

        Attachments

        1. XERCESJ-1257_tests.patch
          3 kB
          Robert Muir
        2. UTF8Reader.patch
          0.8 kB
          Robert Stojnic
        3. TestXerces.java
          1 kB
          Robert Stojnic

        Issue Links

          Activity

            People

            • Assignee:
              mrglavas@ca.ibm.com Michael Glavassevich
              Reporter:
              rainmansr Robert Stojnic

              Dates

              • Created:
                Updated:

                Issue deployment