https://bz.apache.org/bugzilla/show_bug.cgi?id=70162
Bug ID: 70162
Summary: Fix potential ArrayIndexOutOfBoundsException in
JSONParser.generateParseException()
Product: Tomcat 9
Version: 9.0.x
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Util
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: -----
Created attachment 40203
--> https://bz.apache.org/bugzilla/attachment.cgi?id=40203&action=edit
Fix potential ArrayIndexOutOfBoundsException in JSONParser
The generateParseException() method in JSONParser.java contains a loop that
iterates over all 32 bits of an integer bitmask (jj_la1_0[i]) using `for (int j
= 0; j < 32; j++)`.
However, the `la1tokens` boolean array used to store the results is initialized
with a size of 29 (the number of actual tokens in the grammar). If bits 29, 30,
or 31 are set in the bitmask, the code attempts to write to an index outside
the array bounds, causing an ArrayIndexOutOfBoundsException.
Since the grammar only defines 29 tokens, bits 29-31 should never represent
valid tokens. The loop boundary should match the actual token count to prevent
the exception and ensure logical consistency with the subsequent read loop
(`for (int i = 0; i < 29; i++)`).
Proposed fix: Change the loop condition from `< 32` to `< 29`.
Found by Linux Verification Center (linuxtesting.org) with Svace.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
