Fix WriterBasedJsonGenerator AIOOBE for zero-length custom escape - #1669
Fix WriterBasedJsonGenerator AIOOBE for zero-length custom escape#1669kalayciburak wants to merge 2 commits into
Conversation
| @hdimitrieski | ||
| * Reported #1668: WriterBasedJsonGenerator AIOOBE when a zero-length custom | ||
| escape lands at the output buffer boundary | ||
| (3.3.0) |
There was a problem hiding this comment.
this is fine for the moment but is likely to be added to an earlier release since this is a bug fix - we can give you the details when we decide on which release to target. It may end up needing to be a 2.18 fix and we will forward merge it
There was a problem hiding this comment.
I'd be ok with 2.21 backport (2.18 only for secvuln at this point, will be closed by end of 2026)
|
@kalayciburak If you haven't submitted a CLA, we will need one from you. https://github.com/FasterXML/jackson/blob/main/CLA-jackson-2026.pdf which is usually done by printing, filling/signing, scan/photo, email to cla at fasterxml dot com. |
| throw _wrapIOFailure(e); | ||
| } | ||
| } else if (_outputTail >= _outputEnd) { | ||
| // 18-Aug-2026, [core#1668]: a zero-length custom escape can leave |
There was a problem hiding this comment.
This really should not be necessary.... Seems like wrong place for fix (side-effect)
There was a problem hiding this comment.
fair point, flushBuffer was the wrong place. empty escape now just skips the write so we dont leave tail at the buffer end. pushed
|
Thank you for reporthing the issue and contributing this @kalayciburak. I am bit confused by fix -- 0-length should append nothing, so why change "flushBuffer()" and not prevent call. |
…sterXML#1668) A CharacterEscapes sequence of length 0 at the last character of a string can leave _outputHead == _outputTail at the buffer end. The closing quote then wrote past the buffer. Skip the empty escape write instead of changing _flushBuffer. After the custom-escape scan, recycle the buffer if it is empty at the end so the next write does not need a no-op flush.
274b5cf to
f68bff1
Compare
cowtowncoder
added
the
cla-needed
cowtowncoder
added
cla-received
📈 Overall Code Coverage
|
|
Ok; good news, got the CLA! I also realized that maybe change in Thank you! |
3 participants
Summary
Fixes #1668.
WriterBasedJsonGenerator.writeString(String)throwsArrayIndexOutOfBoundsExceptionwhen aCharacterEscapesimplementationreturns a zero-length sequence and that escaped character is the last
character of the string, aligned with the output buffer end.
_writeStringCustomplus_prependOrWriteCharacterEscapeleft_outputHead == _outputTailat the buffer end. The closing quote thenwrote at index 4000 of a 4000-char buffer.
Changes
changing
_flushBuffer.the end so the next write does not need a no-op flush.
ZeroLengthCustomEscape1668Testcovering Writer and UTF-8generators, plus
writeString(String)andwriteString(char[]).Testing
Result: 9/9 GREEN.
Result: 1836 tests, 0 failures, 2 skipped.
The same empty-escape case exists on 2.21 if a backport is wanted.