Skip to content

(cbor) Overflow in BigDecimal input (by ossfuzzer) #267

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
cowtowncoder opened this issue Mar 27, 2021 · 3 comments
Closed

(cbor) Overflow in BigDecimal input (by ossfuzzer) #267

cowtowncoder opened this issue Mar 27, 2021 · 3 comments
Labels
cbor fuzz Issue found by OssFuzz

Comments

@cowtowncoder
Copy link
Member

(note: discovered by https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32579)

Looks like there is an unhandled Overflow for certain types of BigDecimal values fuzzer creates.
Would be nice to cleanly handle; but at very least catch exception and rethrow, if need be.
Does not immediately appear to be a security related as JDK code reports it based on checks.

@cowtowncoder
Copy link
Member Author

Hmmmh. Looks like comparing scale to any static limit will not solve the issue since number of trailing zeroes can vary.
Catching exception seems ugly but might be the only way...

@fmeum
Copy link

fmeum commented Mar 27, 2021

I think catching and not stripping zeros in that case could be sufficiently backwards compatible. It would have the advantage that this would never throw for any representable BigDecimal, which people may rightfully expect given that a default of stripping zeros is a bit arbitrary.

@cowtowncoder
Copy link
Member Author

New fix done in jackson-databind to just catch the exception: since this is continuation of
#264 will close as dup.

@cowtowncoder cowtowncoder added the fuzz Issue found by OssFuzz label Apr 5, 2021
cowtowncoder added a commit that referenced this issue Apr 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cbor fuzz Issue found by OssFuzz
Projects
None yet
Development

No branches or pull requests

2 participants