Skip to content

Commit d004255

Browse files
aidancchxerial
aidancch
and
xerial
authored
Merge pull request from GHSA-fjpj-2g6w-x25r
* Fixed integer overflow by checking if bytesize is bigger than input length, then throwing exception * Fixed integer overflow by checking if bytesize is bigger than input length, then throwing exception * Fixed integer overflow by checking if bytesize is bigger than input length, then throwing exception * improved error messages by adding new error enum INPUT_TOO_LARGE in SnappyErrorCode.java, and added happy and sad cases in SnappyTest.java * fixed mispelling: validArrayInputLength --> isInvalidArrayInputLength * switched SnappyError into ILLEGAL_ARGUMENT in SnappyErrorCode.java and Snappy.java and fixed a typo in error comment * Fix buffer size boundary tests * Remove negative array size tests * updated comments for unit test --------- Co-authored-by: Taro L. Saito <[email protected]>
1 parent 3bf6785 commit d004255

File tree

2 files changed

+94
-8
lines changed

2 files changed

+94
-8
lines changed

‎src/main/java/org/xerial/snappy/Snappy.java‎

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -169,7 +169,11 @@ public static int compress(ByteBuffer uncompressed, ByteBuffer compressed)
169169
public static byte[] compress(char[] input)
170170
throws IOException
171171
{
172-
return rawCompress(input, input.length * 2); // char uses 2 bytes
172+
int byteSize = input.length * 2;
173+
if (byteSize < input.length) {
174+
throw new SnappyError(SnappyErrorCode.TOO_LARGE_INPUT, "input array size is too large: " + input.length);
175+
}
176+
return rawCompress(input, byteSize); // char uses 2 bytes
173177
}
174178

175179
/**
@@ -181,7 +185,11 @@ public static byte[] compress(char[] input)
181185
public static byte[] compress(double[] input)
182186
throws IOException
183187
{
184-
return rawCompress(input, input.length * 8); // double uses 8 bytes
188+
int byteSize = input.length * 8;
189+
if (byteSize < input.length) {
190+
throw new SnappyError(SnappyErrorCode.TOO_LARGE_INPUT, "input array size is too large: " + input.length);
191+
}
192+
return rawCompress(input, byteSize); // double uses 8 bytes
185193
}
186194

187195
/**
@@ -193,7 +201,11 @@ public static byte[] compress(double[] input)
193201
public static byte[] compress(float[] input)
194202
throws IOException
195203
{
196-
return rawCompress(input, input.length * 4); // float uses 4 bytes
204+
int byteSize = input.length * 4;
205+
if (byteSize < input.length) {
206+
throw new SnappyError(SnappyErrorCode.TOO_LARGE_INPUT, "input array size is too large: " + input.length);
207+
}
208+
return rawCompress(input, byteSize); // float uses 4 bytes
197209
}
198210

199211
/**
@@ -205,7 +217,11 @@ public static byte[] compress(float[] input)
205217
public static byte[] compress(int[] input)
206218
throws IOException
207219
{
208-
return rawCompress(input, input.length * 4); // int uses 4 bytes
220+
int byteSize = input.length * 4;
221+
if (byteSize < input.length) {
222+
throw new SnappyError(SnappyErrorCode.TOO_LARGE_INPUT, "input array size is too large: " + input.length);
223+
}
224+
return rawCompress(input, byteSize); // int uses 4 bytes
209225
}
210226

211227
/**
@@ -217,7 +233,11 @@ public static byte[] compress(int[] input)
217233
public static byte[] compress(long[] input)
218234
throws IOException
219235
{
220-
return rawCompress(input, input.length * 8); // long uses 8 bytes
236+
int byteSize = input.length * 8;
237+
if (byteSize < input.length) {
238+
throw new SnappyError(SnappyErrorCode.TOO_LARGE_INPUT, "input array size is too large: " + input.length);
239+
}
240+
return rawCompress(input, byteSize); // long uses 8 bytes
221241
}
222242

223243
/**
@@ -229,7 +249,11 @@ public static byte[] compress(long[] input)
229249
public static byte[] compress(short[] input)
230250
throws IOException
231251
{
232-
return rawCompress(input, input.length * 2); // short uses 2 bytes
252+
int byteSize = input.length * 2;
253+
if (byteSize < input.length) {
254+
throw new SnappyError(SnappyErrorCode.TOO_LARGE_INPUT, "input array size is too large: " + input.length);
255+
}
256+
return rawCompress(input, byteSize); // short uses 2 bytes
233257
}
234258

235259
/**

‎src/test/java/org/xerial/snappy/SnappyTest.java‎

Lines changed: 64 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
// SnappyTest.java
2020
// Since: 2011/03/30
2121
//
22-
// $URL$
22+
// $URL$
2323
// $Author$
2424
//--------------------------------------
2525
package org.xerial.snappy;
@@ -331,8 +331,8 @@ public void isValidCompressedData()
331331
}
332332
}
333333

334-
/*
335334

335+
/*
336336
Tests happy cases for SnappyInputStream.read method
337337
- {0}
338338
*/
@@ -385,6 +385,67 @@ public void isInvalidChunkLengthForSnappyInputStreamOutOfMemory()
385385
- int: 0, 10
386386
- long: 0, 10
387387
- short: 0, 10
388+
*/
389+
@Test
390+
public void isValidArrayInputLength()
391+
throws Exception {
392+
byte[] a = Snappy.compress(new char[0]);
393+
byte[] b = Snappy.compress(new double[0]);
394+
byte[] c = Snappy.compress(new float[0]);
395+
byte[] d = Snappy.compress(new int[0]);
396+
byte[] e = Snappy.compress(new long[0]);
397+
byte[] f = Snappy.compress(new short[0]);
398+
byte[] g = Snappy.compress(new char[10]);
399+
byte[] h = Snappy.compress(new double[10]);
400+
byte[] i = Snappy.compress(new float[10]);
401+
byte[] j = Snappy.compress(new int[10]);
402+
byte[] k = Snappy.compress(new long[10]);
403+
byte[] l = Snappy.compress(new short[10]);
404+
}
405+
406+
/*
407+
Tests sad cases for Snappy.compress
408+
- Allocate a buffer whose byte size will be a bit larger than Integer.MAX_VALUE
409+
- char
410+
- double
411+
- float
412+
- int
413+
- long
414+
- short
415+
*/
416+
@Test(expected = SnappyError.class)
417+
public void isTooLargeDoubleArrayInputLength() throws Exception {
418+
Snappy.compress(new double[Integer.MAX_VALUE / 8 + 1]);
419+
}
420+
421+
@Test(expected = SnappyError.class)
422+
public void isTooLargeCharArrayInputLength() throws Exception {
423+
Snappy.compress(new char[Integer.MAX_VALUE / 2 + 1]);
424+
}
425+
426+
@Test(expected = SnappyError.class)
427+
public void isTooLargeFloatArrayInputLength() throws Exception {
428+
Snappy.compress(new float[Integer.MAX_VALUE / 4 + 1]);
429+
}
430+
431+
@Test(expected = SnappyError.class)
432+
public void isTooLargeIntArrayInputLength() throws Exception {
433+
Snappy.compress(new int[Integer.MAX_VALUE / 4 + 1]);
434+
}
435+
436+
@Test(expected = SnappyError.class)
437+
public void isTooLargeLongArrayInputLength() throws Exception {
438+
Snappy.compress(new long[Integer.MAX_VALUE / 8 + 1]);
439+
}
440+
441+
@Test(expected = SnappyError.class)
442+
public void isTooLargeShortArrayInputLength() throws Exception {
443+
Snappy.compress(new short[Integer.MAX_VALUE / 2 + 1]);
444+
}
445+
446+
/*
447+
Tests happy cases for Snappy.compress
448+
- char: 0, 10
388449
*/
389450
@Test
390451
public void isValidArrayInputLengthForBitShuffleShuffle()
@@ -435,5 +496,6 @@ public void isTooLargeLongArrayInputLengthForBitShuffleShuffle() throws Exceptio
435496
public void isTooLargeShortArrayInputLengthForBitShuffleShuffle() throws Exception {
436497
BitShuffle.shuffle(new short[Integer.MAX_VALUE / 2 + 1]);
437498

499+
438500
}
439501
}

0 commit comments

Comments
 (0)