JiBX
  1. JiBX
  2. JIBX-333

JiBX goes into infinite loop parsing errorneous XML string when encoding in unspecified.

    Details

    • Type: Bug Bug
    • Status: Closed Closed
    • Priority: Major Major
    • Resolution: Cannot Reproduce
    • Affects Version/s: JiBX 1.1.4
    • Fix Version/s: None
    • Component/s: core
    • Labels:
      None
    • Environment:
      Linux/Java 1.6.0_06
    • Number of attachments :
      0

      Description

      We spotted this as part of some security testing.

      The XML fragment "<?xml/.:/AAAAA.....(5000 times)...AAAAA="1.0" encoding="UTF-8"?>" caused the JIBX runtime to spin in an infinite loop while parsing the string.

      Under the debugger I noticed that the loop is in the InputStreamWrapper class. We are running an older version of JIBX 1.1.4.

      We don't specify the encoding while unmarshalling and this is the trigger. If we specify UTF-8 as the encoding this problem doesn't happen. I looked at the code and I see that the scan logic doesn't check to see that the end of buffer has been reached.

        Activity

        Hide
        Dennis Sosnoski added a comment -

        I added a JUnit test case to try this out, but can't reproduce the problem with the current code. If you can provide the exact document I'll try that, and if you can reproduce it using a current release that would be even better.

        Show
        Dennis Sosnoski added a comment - I added a JUnit test case to try this out, but can't reproduce the problem with the current code. If you can provide the exact document I'll try that, and if you can reproduce it using a current release that would be even better.

          People

          • Assignee:
            Dennis Sosnoski
            Reporter:
            Chandra Shetty
          • Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved: