Alex Herbert created RNG-199:
--------------------------------
Summary: JDKRandomBridge serialisation may allocate negative-sized
or large byte array to read object data
Key: RNG-199
URL: https://issues.apache.org/jira/browse/RNG-199
Project: Commons RNG
Issue Type: Bug
Components: simple
Affects Versions: 1.7
Reporter: Alex Herbert
The JDKRandomBridge extends java.util.Random and supports all the methods using
an underlying RandomSource implementation. This incudes serialization. The
state of the generator is read a plain bytes from the ObjectInputStream. This
includes the size to read. If this is incorrect due to a corrupted stream the
number of bytes can be negative or very large leading to a bad allocation and
unexpected negative array size exception, or a large memory allocation. Note
that an incorrect large bytes length will still generate an
IllegalArgumentException when the RandomSource is restored.
This can be fixed by validating the size is positive and within a reasonable
bound, e.g. 2^16. This is enough to serialize all the library implementations
but will not allow obviously wrong memory allocation.
Issue identified with a security scan.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
