[
https://issues.apache.org/jira/browse/LANG-1722?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Gary D. Gregory resolved LANG-1722.
-----------------------------------
Fix Version/s: 3.14.1
Resolution: Fixed
> SerializationUtils.deserialize could throw NegativeArraySizeException if
> invalid input is provided
> --------------------------------------------------------------------------------------------------
>
> Key: LANG-1722
> URL: https://issues.apache.org/jira/browse/LANG-1722
> Project: Commons Lang
> Issue Type: Bug
> Reporter: Sheung Chi Chan
> Priority: Minor
> Fix For: 3.14.1
>
>
> _*SerializationUtils.deserialize(InputStream)*_ transform the provided
> _InputStream_ object into an _*ObjectInputStream*_ object then call the
> _*readObject*_ method of the newly created *_ObjectInputStream_* object. But
> there is one problem, the *_readObject_* method (and its underlying methods)
> will create an temporary array with the size provided from the data of the
> provided {_}*InputStream*{_}. Thus if the designated bytes of the
> _*InputStream*_ object is negative and are used for the array creation. It
> will result in {_}*NegativeArraySizeException*{_}.
> {code:java}
> public static <T> T deserialize(final InputStream inputStream) {
> Objects.requireNonNull(inputStream, "inputStream");
> try (ObjectInputStream in = new ObjectInputStream(inputStream)) {
> @SuppressWarnings("unchecked")
> final T obj = (T) in.readObject();
> return obj;
> } catch (final ClassNotFoundException | IOException ex) {
> throw new SerializationException(ex);
> }
> } {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
