Merge pull request #130 from vt-middleware/passwd-gen-buffer-overflow

Passwd gen buffer overflow
vt-middleware · Jul 20, 2021 · ac7fe10 · ac7fe10
2 parents 836c515 + d8a799c
commit ac7fe10
Showing 4 changed files with 24 additions and 9 deletions.
diff --git a/src/main/java/org/passay/CyrillicSequenceData.java b/src/main/java/org/passay/CyrillicSequenceData.java
@@ -7,14 +7,15 @@
  * @author Middleware Services
  */
 public enum CyrillicSequenceData implements SequenceData {
+
   /**
    * Alphabetical sequence.
    */
   Alphabetical(
-          "ILLEGAL_ALPHABETICAL_SEQUENCE",
-          new CharacterSequence[] {
-                  new CharacterSequence("абвгдеёжзийклмнопрстуфхцчшщъыьэюяіѣѳѵ", "АБВГДЕЁЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯІѢѲѴ"),
-          });
+    "ILLEGAL_ALPHABETICAL_SEQUENCE",
+    new CharacterSequence[] {
+      new CharacterSequence("абвгдеёжзийклмнопрстуфхцчшщъыьэюяіѣѳѵ", "АБВГДЕЁЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯІѢѲѴ"),
+    });
 
   /**
    * Error code.

diff --git a/src/main/java/org/passay/CzechSequenceData.java b/src/main/java/org/passay/CzechSequenceData.java
@@ -12,10 +12,10 @@ public enum CzechSequenceData implements SequenceData {
    * Alphabetical sequence.
    */
   Alphabetical(
-  "ILLEGAL_ALPHABETICAL_SEQUENCE",
-      new CharacterSequence[] {
-        new CharacterSequence("aábcčdďeěéfghiíjklmnňoópqrřsštťuúůvwxyýzž", "AÁBCČDĎEĚÉFGHIÍJKLMNŇOÓPQRŘSŠTŤUÚŮVWXYÝZŽ"),
-      });
+    "ILLEGAL_ALPHABETICAL_SEQUENCE",
+    new CharacterSequence[] {
+      new CharacterSequence("aábcčdďeěéfghiíjklmnňoópqrřsštťuúůvwxyýzž", "AÁBCČDĎEĚÉFGHIÍJKLMNŇOÓPQRŘSŠTŤUÚŮVWXYÝZŽ"),
+    });
 
   /**
    * Error code.

diff --git a/src/main/java/org/passay/PasswordGenerator.java b/src/main/java/org/passay/PasswordGenerator.java
@@ -74,7 +74,10 @@ public String generatePassword(final int length, final List<CharacterRule> rules
     final CharBuffer buffer = CharBuffer.allocate(length);
     if (rules != null) {
       for (CharacterRule rule : rules) {
-        fillRandomCharacters(rule.getValidCharacters(), rule.getNumberOfCharacters(), buffer);
+        fillRandomCharacters(
+          rule.getValidCharacters(),
+          length <= rule.getNumberOfCharacters() ? length : rule.getNumberOfCharacters(),
+          buffer);
         allChars.append(rule.getValidCharacters());
       }
     }

diff --git a/src/test/java/org/passay/PasswordGeneratorTest.java b/src/test/java/org/passay/PasswordGeneratorTest.java
@@ -89,4 +89,15 @@ public void testGenerator(final String pass)
     AssertJUnit.assertFalse(failCharRule.validate(new PasswordData(pass)).isValid());
     AssertJUnit.assertTrue(verifyCharRule.validate(new PasswordData(pass)).isValid());
   }
+
+
+  /**
+   */
+  @Test(groups = "passgentest")
+  public void testBufferOverflow()
+  {
+    new PasswordGenerator().generatePassword(5, new CharacterRule(EnglishCharacterData.LowerCase, 10));
+    new PasswordGenerator().generatePassword(10, new CharacterRule(EnglishCharacterData.LowerCase, 5));
+    new PasswordGenerator().generatePassword(10, new CharacterRule(EnglishCharacterData.LowerCase, 10));
+  }
 }