Backport #418 fix to 2.8

FasterXML · Oct 20, 2017 · 144ba1f · 144ba1f
1 parent 444efa0
commit 144ba1f
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 2 deletions.
diff --git a/release-notes/VERSION b/release-notes/VERSION
@@ -18,6 +18,11 @@ JSON library.
 
 #304: Optimize `NumberOutput.outputLong()` method
 
+2.8.11 (not yet released)
+
+#418: ArrayIndexOutOfBoundsException from UTF32Reader.read on invalid input
+ (reported, contributed fix for by pfitzsimons-r7@github)
+
 2.8.10 (24-Aug-2017)
 
 No changes since 2.8.9

diff --git a/src/main/java/com/fasterxml/jackson/core/io/UTF32Reader.java b/src/main/java/com/fasterxml/jackson/core/io/UTF32Reader.java
@@ -133,7 +133,7 @@ public int read(char[] cbuf, int start, int len) throws IOException {
         }
 
         // 02-Jun-2017, tatu: Must ensure we don't try to read past buffer end:
-        final int _lastValidInputStart = (_length - 3);
+        final int lastValidInputStart = (_length - 4);
 
         main_loop:
         while (outPtr < outEnd) {
@@ -168,7 +168,7 @@ public int read(char[] cbuf, int start, int len) throws IOException {
                 }
             }
             cbuf[outPtr++] = (char) lo;
-            if (_ptr > _lastValidInputStart) {
+            if (_ptr > lastValidInputStart) {
                 break main_loop;
             }
         }

diff --git a/src/test/java/com/fasterxml/jackson/core/read/UTF32ParseTest.java b/src/test/java/com/fasterxml/jackson/core/read/UTF32ParseTest.java
@@ -53,4 +53,16 @@ public void testSimpleInvalidUTF32() throws Exception
         }
         parser.close();
     }
+
+    public void testSimpleSevenNullBytes() throws Exception {
+        byte[] data = new byte[7];
+        JsonParser parser = FACTORY.createParser(/*ObjectReadContext.empty(), */data);
+        try {
+            parser.nextToken();
+            fail("Should not pass");
+        } catch (JsonParseException e) {
+            verifyException(e, "Illegal character ((CTRL-CHAR, code 0))");
+        }
+        parser.close();
+    }
 }