[
https://issues.apache.org/jira/browse/RNG-199?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Alex Herbert updated RNG-199:
-----------------------------
Summary: JDKRandomBridge serialization may allocate negative-sized or large
byte array to read object data (was: JDKRandomBridge serialisation may
allocate negative-sized or large byte array to read object data)
> JDKRandomBridge serialization may allocate negative-sized or large byte array
> to read object data
> -------------------------------------------------------------------------------------------------
>
> Key: RNG-199
> URL: https://issues.apache.org/jira/browse/RNG-199
> Project: Commons RNG
> Issue Type: Bug
> Components: simple
> Affects Versions: 1.7
> Reporter: Alex Herbert
> Assignee: Alex Herbert
> Priority: Trivial
> Fix For: 1.8
>
>
> The JDKRandomBridge extends java.util.Random and supports all the methods
> using an underlying RandomSource implementation. This incudes serialization.
> The state of the generator is read a plain bytes from the ObjectInputStream.
> This includes the size to read. If this is incorrect due to a corrupted
> stream the number of bytes can be negative or very large leading to a bad
> allocation and unexpected negative array size exception, or a large memory
> allocation. Note that an incorrect large bytes length will still generate an
> IllegalArgumentException when the RandomSource is restored.
> This can be fixed by validating the size is positive and within a reasonable
> bound, e.g. 2^16. This is enough to serialize all the library implementations
> but will not allow obviously wrong memory allocation.
> Issue identified with a security scan.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
