This is an automated email from the ASF dual-hosted git repository. chibenwa pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/james-mime4j.git
commit c5a88f2c1b7b22e406fc3fbaee9701dbec615e3a Author: Benoit TELLIER <[email protected]> AuthorDate: Wed Nov 4 14:54:37 2026 +0100 [PERF] AddressListParser: disable JavaCC error reporting, quadratic on long lookaheads address() starts with an unbounded syntactic lookahead for addr_spec. On a value such as a"b".a"b"... it scans the whole value, fails, falls back to phrase() and throws early. generateParseException() then ran jj_rescan_token(), which walks the token list from the current token for every scanned token: O(n^2), 2-3 s for a 32 KB To header under the fuzzer. With ERROR_REPORTING=false JavaCC generates neither the rescan nor the expected-token bookkeeping. The ParseException message still gives the position and the offending token, but no longer lists the expected tokens. Found by twake-fuzz, scenario 33-header-value-cost-scaling. --- .../james/mime4j/field/address/AddressListParser.jjt | 1 + .../mime4j/field/address/DefaultAddressBuilderTest.java | 14 ++++++++++++++ 2 files changed, 15 insertions(+) diff --git a/dom/src/main/jjtree/org/apache/james/mime4j/field/address/AddressListParser.jjt b/dom/src/main/jjtree/org/apache/james/mime4j/field/address/AddressListParser.jjt index 6d6ebe34..a6a1924c 100644 --- a/dom/src/main/jjtree/org/apache/james/mime4j/field/address/AddressListParser.jjt +++ b/dom/src/main/jjtree/org/apache/james/mime4j/field/address/AddressListParser.jjt @@ -28,6 +28,7 @@ options { STATIC=false; LOOKAHEAD=1; + ERROR_REPORTING=false; JDK_VERSION = "1.5"; VISITOR=true; MULTI=true; diff --git a/dom/src/test/java/org/apache/james/mime4j/field/address/DefaultAddressBuilderTest.java b/dom/src/test/java/org/apache/james/mime4j/field/address/DefaultAddressBuilderTest.java index b652c036..a5952feb 100644 --- a/dom/src/test/java/org/apache/james/mime4j/field/address/DefaultAddressBuilderTest.java +++ b/dom/src/test/java/org/apache/james/mime4j/field/address/DefaultAddressBuilderTest.java @@ -345,4 +345,18 @@ public class DefaultAddressBuilderTest { Assert.assertEquals("é", ((Group) list.get(1)).getName()); Assert.assertEquals("é", parser.parseGroup("=?ISO-8859-1?Q?=E9?=: [email protected];").getName()); } + + @Test(timeout = 2000) + public void parseAddressListShouldFailFastOnALongInvalidPhrase() { + StringBuilder sb = new StringBuilder(); + for (int i = 0; i < 20000; i++) { + sb.append("a\"b\"."); + } + try { + parser.parseAddressList(sb); + Assert.fail("ParseException expected"); + } catch (ParseException expected) { + // expected + } + } } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
