[
https://issues.apache.org/jira/browse/RNG-199?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Alex Herbert resolved RNG-199.
------------------------------
Fix Version/s: 1.8
Assignee: Alex Herbert
Resolution: Fixed
Byte array size validated in commit:
f7937b999d510ac0b2c65a74dfb001f927453c27
> JDKRandomBridge serialisation may allocate negative-sized or large byte array
> to read object data
> -------------------------------------------------------------------------------------------------
>
> Key: RNG-199
> URL: https://issues.apache.org/jira/browse/RNG-199
> Project: Commons RNG
> Issue Type: Bug
> Components: simple
> Affects Versions: 1.7
> Reporter: Alex Herbert
> Assignee: Alex Herbert
> Priority: Trivial
> Fix For: 1.8
>
>
> The JDKRandomBridge extends java.util.Random and supports all the methods
> using an underlying RandomSource implementation. This incudes serialization.
> The state of the generator is read a plain bytes from the ObjectInputStream.
> This includes the size to read. If this is incorrect due to a corrupted
> stream the number of bytes can be negative or very large leading to a bad
> allocation and unexpected negative array size exception, or a large memory
> allocation. Note that an incorrect large bytes length will still generate an
> IllegalArgumentException when the RandomSource is restored.
> This can be fixed by validating the size is positive and within a reasonable
> bound, e.g. 2^16. This is enough to serialize all the library implementations
> but will not allow obviously wrong memory allocation.
> Issue identified with a security scan.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
