Backport fix for #598: (protobuf) Protobuf parser state handling wrong for implicit close (END_OBJECT)#706
Open
cowtowncoder wants to merge 1 commit into
Open
Conversation
…t close (END_OBJECT) Add STATE_ROOT_END so that the parser separates returning the implicit root-level END_OBJECT from actually closing the underlying input/parser, matching jackson-core#1438 semantics. Also add integer-overflow guards for packed-array and message length decoding, and fix ProtobufField.compareTo() to use Integer.compare() instead of subtraction.
cowtowncoder
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backports the fix for #598 to the
2.21maintenance branch (ported from the 3.x fix, adapted to thecom.fasterxml.jackson.*package namespace).ProtobufParserpreviously reported the implicit root-levelEND_OBJECTand calledclose()in the same step. This worked in most cases, but conflicted with theParserBase.close()behavior fixed in jackson-core#1438 (current token no longer reset onclose()), since dataformats-binary 2.20 already picked up that jackson-core fix.STATE_ROOT_ENDparser state so that returningEND_OBJECTand closing the parser become two separate steps:nextToken()/nextFieldName()first returnEND_OBJECTwhile leaving the parser open (isClosed() == false,getCurrentToken() == END_OBJECT), and only close the parser on the following call.Also includes two small unrelated hardening fixes found while working in the same area:
ProtobufParser(_inputPtr + lencould wrap for maliciously large lengths).ProtobufField.compareTo()to useInteger.compare(id, other.id)instead ofid - other.id, which could overflow for extreme tag values.