Skip to content

fix: guard exponent parsing against end-of-input in readNumber0 - #7832

Open
waterWang wants to merge 1 commit into
alibaba:mainfrom
waterWang:fix/issue7807-truncated-exponent
Open

fix: guard exponent parsing against end-of-input in readNumber0#7832
waterWang wants to merge 1 commit into
alibaba:mainfrom
waterWang:fix/issue7807-truncated-exponent

Conversation

@waterWang

Copy link
Copy Markdown

What this fixes

JSON.parse on a document that ends inside a number's exponent — "1e", "1e-", "1e+" and their uppercase variants — threw ArrayIndexOutOfBoundsException instead of JSONException.

In JSONReaderUTF8.readNumber0 and JSONReaderUTF16.readNumber0, the three reads that follow an exponent marker (e/E) consumed bytes without an end-of-input guard:

ch = bytes[offset++];   // offset may already equal end

When the buffer ended right at the marker, this read past the end and threw AIOOBE. Additionally, an exponent with no following digits ("1e") was accepted silently.

The fix

  • Guard all three reads after the exponent marker with offset == end ? EOI : bytes[offset++].
  • Track whether any exponent digit was consumed; if none, throw JSONException (consistent with how a trailing 1. is already rejected).

Verification

  • JSON.parse("1e"), "1E", "1e-", "1e+", "1.0e", "-1e" etc. all now throw JSONException.
  • Legal exponents still parse: "1e5"100000.0, "1e-2"0.01, "1e0"1.
  • Added Issue7807 test; 164 number/JSONReader tests pass, 0 failures.

Fixes #7807

For input like "1e", "1e-" or "1e+" (and uppercase variants), the
number reader consumed bytes past the end of the buffer, throwing
ArrayIndexOutOfBoundsException instead of JSONException. Guard the three
reads that follow an exponent marker and reject an exponent with no
following digits.

Fixes alibaba#7807
@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] ArrayIndexOutOfBoundsException on a truncated exponent — JSON.parse("1e")

2 participants