[
https://issues.apache.org/jira/browse/LANG-1721?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Gary D. Gregory resolved LANG-1721.
-----------------------------------
Fix Version/s: 3.14.1
Resolution: Fixed
> Wrong number checking in NumberUtils cause StringIndexOutOfBoundsException
> --------------------------------------------------------------------------
>
> Key: LANG-1721
> URL: https://issues.apache.org/jira/browse/LANG-1721
> Project: Commons Lang
> Issue Type: Bug
> Reporter: Sheung Chi Chan
> Priority: Minor
> Labels: StringIndexOutOfBound
> Fix For: 3.14.1
>
>
> There is a wrong conditional check in *_NumberUtils.createNumber_* method,
> that could result in StringIndexOutOfBoundsException with specially crafted
> invalid string.
>
> {code:java}
> public static Number createNumber(final String str) {
> ...
> final int decPos = str.indexOf('.');
> final int expPos = str.indexOf('e') + str.indexOf('E') + 1; //
> assumes both not present
> // if both e and E are present, this is caught by the checks on
> expPos (which prevent IOOBE)
> if (decPos > -1) { // there is a decimal point
> if (expPos > -1) { // there is an exponent
> if (expPos < decPos || expPos > length) { // prevents double
> exponent causing IOOBE
> throw new NumberFormatException(str + " is not a valid
> number.");
> }
> dec = str.substring(decPos + 1, expPos); {code}
> Although checking is implied for the case of both e and E are present, there
> is an exceptional case which are not taken care of. If we provide the String
> {_}*E123e.3*{_}, both _*decPos*_ and _*expPos*_ will be 5. Then it get pass
> the _*expPos < decPos*_ check and the substring will throw a
> StringIndexOutOfBoundsException because {_}*decPos + 1 > expPos*{_}.
> To fix this issue, the condition should be {*}_expPos <= decPst_{*}.
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
