Jackson-core missing number length validation causing performance issues and fix

Vulnerability Overview This vulnerability involves the absence of a digit length validator in the asynchronous parser for streaming integer paths. This omission can lead to performance issues or potential security risks when processing large numbers of digits. Impact Scope Affected Versions: jackson-core-2.10.8 and earlier. Affected Components: and . Specific Scenarios: When the parser processes integers exceeding the limit, it may trigger a . Remediation Plan 1. Add Digit Length Validator: - Implement digit length validation in and . - Ensure that the digit length is checked during parsing, throwing an exception if the limit is exceeded. 2. Update Test Cases: - Add a new test case, , to verify the effectiveness of the fix. - The test case includes streaming processing for both integer and fractional paths, ensuring that the correct exception is thrown when is exceeded. POC Code The following is a key code snippet after the fix: ```java // JsonParserBase.java protected final JsonToken startPositiveNumber(int ch) throws IOException { if (++_inputPtr >= _inputEnd) { _minorState = MINOR_NUMBER_INTEGER_DIGITS; _textBuffer.setCurrentLength(_inputPtr); _textBuffer.setCurrentLength(_inputPtr); return _updateToken(_inputPtr); } ch = getByteFromBuffer(_inputPtr) & 0xFF; if (++_inputPtr >= _inputEnd) { _minorState = MINOR_NUMBER_INTEGER_DIGITS; _textBuffer.setCurrentLength(_inputPtr); _textBuffer.setCurrentLength(_inputPtr); return _updateToken(_inputPtr); } ch = getByteFromBuffer(_inputPtr) & 0xFF; if (++_inputPtr >= _inputEnd) { _minorState = MINOR_NUMBER_INTEGER_DIGITS; _textBuffer.setCurrentLength(_inputPtr); _textBuffer.setCurrentLength(_inputPtr); return _updateToken(_inputPtr); } ch = getByteFromBuffer(_inputPtr) & 0xFF; if (++_inputPtr >= _inputEnd) { _minorState = MINOR_NUMBER_INTEGER_DIGITS; _textBuffer.setCurrentLength(_inputPtr); _textBuffer.setCurrentLength(_inputPtr); return _updateToken(_inputPtr); } ch = getByteFromBuffer(_inputPtr) & 0xFF; if (++_inputPtr >= _inputEnd) { _minorState = MINOR_NUMBER_INTEGER_DIGITS; _textBuffer.setCurrentLength(_inputPtr); _textBuffer.setCurrentLength(_inputPtr); return _updateToken(_inputPtr); } ch = getByteFromBuffer(_inputPtr) & 0xFF; if (++_inputPtr >= _inputEnd) { _minorState = MINOR_NUMBER_INTEGER_DIGITS; _textBuffer.setCurrentLength(_inputPtr); _textBuffer.setCurrentLength(_inputPtr); return _updateToken(_inputPtr); } ch = getByteFromBuffer(_inputPtr) & 0xFF; if (++_inputPtr >= _inputEnd) { _minorState = MINOR_NUMBER_INTEGER_DIGITS; _textBuffer.setCurrentLength(_inputPtr); _textBuffer.setCurrentLength(_inputPtr); return _updateToken(_inputPtr); } ch = getByteFromBuffer(_inputPtr) & 0xFF; if (++_inputPtr >= _inputEnd) { _minorState = MINOR_NUMBER_INTEGER_DIGITS; _textBuffer.setCurrentLength(_inputPtr); _textBuffer.setCurrentLength(_inputPtr); return _updateToken(_inputPtr); } ch = getByteFromBuffer(_inputPtr) & 0xFF; if (++_inputPtr >= _inputEnd) { _minorState = MINOR_NUMBER_INTEGER_DIGITS; _textBuffer.setCurrentLength(_inputPtr); _textBuffer.setCurrentLength(_inputPtr); return _updateToken(_inputPtr); } ch = getByteFromBuffer(_inputPtr) & 0xFF; if (++_inputPtr >= _inputEnd) { _minorState = MINOR_NUMBER_INTEGER_DIGITS; _textBuffer.setCurrentLength(_inputPtr); _textBuffer.setCurrentLength(_inputPtr); return _updateToken(_inputPtr); } ch = getByteFromBuffer(_inputPtr) & 0xFF; if (++_inputPtr >= _inputEnd) { _minorState = MINOR_NUMBER_INTEGER_DIGITS; _textBuffer.setCurrentLength(_inputPtr); _textBuffer.setCurrentLength(_inputPtr); return _updateToken(_inputPtr); } ch = getByteFromBuffer(_inputPtr) & 0xFF; if (++_inputPtr >= _inputEnd) { _minorState = MINOR_NUMBER_INTEGER_DIGITS; _textBuffer.setCurrentLength(_inputPtr); _textBuffer.setCurrentLength(_inputPtr); return _updateToken(_inputPtr); } ch = getByteFromBuffer(_inputPtr) & 0xFF; if (++_inputPtr >= _inputEnd) { _minorState = MINOR_NUMBER_INTEGER_DIGITS; _textBuffer.setCurrentLength(_inputPtr); _textBuffer.setCurrentLength(_inputPtr); return _updateToken(_inputPtr); } ch = getByteFromBuffer(_inputPtr) & 0xFF; if (++_inputPtr >= _inputEnd) { _minorState = MINOR_NUMBER_INTEGER_DIGITS; _textBuffer.setCurrentLength(_inputPtr); _textBuffer.setCurrentLength(_inputPtr); return _updateToken(_inputPtr); } ch = getByteFromBuffer(_inputPtr) & 0xFF; if (++_inputPtr >= _inputEnd) { _minorState = MINOR_NUMBER_INTEGER_DIGITS; _textBuffer.setCurrentLength(_inputPtr); _textBuffer.setCurrentLength(_inputPtr); return _updateToken(_inputPtr); } ch = getByteFromBuffer(_inputPtr) & 0xFF; if (++_inputPtr >= _inputEnd) { _minorState = MINOR_NUMBER_INTEGER_DIGITS; _textBuffer.setCurrentLength(_inputPtr); _textBuffer.setCurrentLength(_inputPtr); return _updateToken(_inputPtr); } ch = getByteFromBuffer(_inputPtr) & 0xFF; if (++_inputPtr >= _inputEnd) { _minorState = MINOR_NUMBER_INTEGER_DIGITS; _textBuffer.setCurrentLength(_inputPtr); _textBuffer.setCurrentLength(_inputPtr); return _updateToken(_inputPtr); } ch = getByteFromBuffer(_inputPtr

Goal Reached Thanks to every supporter — we hit 100%!

Jackson-core missing number length validation causing performance issues and fix

More from this source