Richard Zowalla created OPENNLP-1899:
----------------------------------------
Summary: Harden SymSpell model deserialization against oversized
count fields
Key: OPENNLP-1899
URL: https://issues.apache.org/jira/browse/OPENNLP-1899
Project: OpenNLP
Issue Type: Improvement
Affects Versions: 3.0.0-M5
Reporter: Richard Zowalla
Assignee: Richard Zowalla
Fix For: 3.0.0-M6
SymSpellModelSerializer.create() reads unigramCount and bigramCount as 32-bit
ints
from the binary model stream and passes them straight to
LinkedHashMap.newLinkedHashMap(...), guarded only against negative values.
A crafted .bin model declaring Integer.MAX_VALUE pre-sizes the map to 2^30
entries;
the first put() then allocates a 4-8 GB backing array and the JVM dies with
OutOfMemoryError.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
