[
https://issues.apache.org/jira/browse/TIKA-4830?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18108218#comment-18108218
]
ASF GitHub Bot commented on TIKA-4830:
--------------------------------------
THausherr opened a new pull request, #3072:
URL: https://github.com/apache/tika/pull/3072
…ed by Tim Scheckenbach
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
Thanks for your contribution to [Apache Tika](https://tika.apache.org/)!
Your help is appreciated!
Before opening the pull request, please verify that
* there is an open issue on the [Tika issue
tracker](https://issues.apache.org/jira/projects/TIKA) which describes the
problem or the improvement. We cannot accept pull requests without an issue
because the change wouldn't be listed in the release notes.
* the issue ID (`TIKA-XXXX`)
- is referenced in the title of the pull request
- and placed in front of your commit messages surrounded by square
brackets (`[TIKA-XXXX] Issue or pull request title`)
* commits are squashed into a single one (or few commits for larger changes)
* Tika is successfully built and unit tests pass by running `./mvnw clean
test`
* there should be no conflicts when merging the pull request branch into the
*recent* `main` branch. If there are conflicts, please try to rebase the pull
request branch on top of a freshly pulled `main` branch
* if you add new module that downstream users will depend upon add it to
relevant group in `tika-bom/pom.xml`.
We will be able to faster integrate your pull request if these conditions
are met. If you have any questions how to fix your problem or about using Tika
in general, please sign up for the [Tika mailing
list](http://tika.apache.org/mail-lists.html). Thanks!
> JackcessParser.parse leaks Jackcess RuntimeExceptions
> (IndexOutOfBoundsException / IllegalStateException) on malformed MDBs while
> reading the global usage map
> --------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: TIKA-4830
> URL: https://issues.apache.org/jira/browse/TIKA-4830
> Project: Tika
> Issue Type: Bug
> Components: parser
> Affects Versions: 4.0.0
> Reporter: Tim Scheckenbach
> Priority: Major
> Attachments: inputs.zip
>
>
> {{JackcessParser.parse}} is declared {{{}throws IOException, SAXException,
> TikaException{}}}. Two fuzz inputs for the same open path —
> {{DatabaseBuilder.open}} → {{PageChannel.initialize}} → {{UsageMap.read}}
> (global usage map, page 1, row 0)
> — make Jackcess throw a {{RuntimeException}} that Tika does not wrap. The
> OSS-Fuzz target {{JackcessParserFuzzer}} swallows only
> {{{}IllegalArgumentException | TikaException | SAXException |
> IOException{}}}, so both are fuzzer crashes. {{AutoDetectParser}} /
> {{CompositeParser}} would wrap them as {{{}TikaException: Unexpected
> RuntimeException from JackcessParser{}}}; callers of {{JackcessParser}}
> directly do not.
> Calling
> {code:java}
> new JackcessParser().parse(TikaInputStream.get(new
> File("crash-083680cb14186e1be3e26b93946ea43c538d2e62")),
> new ToTextContentHandler(), new Metadata(), new ParseContext());
> {code}
> on the first attached file (32768-byte Jet 4 MDB) results in:
> {code:java}
> java.lang.IndexOutOfBoundsException
> at java.base/java.nio.Buffer.checkIndex(Buffer.java:743)
> at java.base/java.nio.HeapByteBuffer.get(HeapByteBuffer.java:169)
> at com.healthmarketscience.jackcess.impl.UsageMap.read(UsageMap.java:133)
> at
> com.healthmarketscience.jackcess.impl.PageChannel.initialize(PageChannel.java:117)
> at
> com.healthmarketscience.jackcess.impl.DatabaseImpl.<init>(DatabaseImpl.java:598)
> at
> com.healthmarketscience.jackcess.impl.DatabaseImpl.open(DatabaseImpl.java:458)
> at
> com.healthmarketscience.jackcess.DatabaseBuilder.open(DatabaseBuilder.java:278)
> at
> org.apache.tika.parser.microsoft.JackcessParser.parse(JackcessParser.java:101)
> {code}
> {{UsageMap.read}} is declared {{throws IOException}} but does:
> {code:java}
> short rowStart = TableImpl.findRowStart(tableBuffer, rowNum, format);
> int rowEnd = TableImpl.findRowEnd(tableBuffer, rowNum, format);
> tableBuffer.limit(rowEnd);
> byte mapType = tableBuffer.get(rowStart); // IndexOutOfBoundsException
> {code}
> Tika does not catch {{IndexOutOfBoundsException}} at all.
> Calling the same parse on the second attached file,
> {{crash-107db845b1fe3fee58a3b1da3a4646e604af329b}} (24576-byte Jet 4 MDB),
> results in:
> {code:java}
> java.lang.IllegalStateException: invalid page number 169285950
> at
> com.healthmarketscience.jackcess.impl.PageChannel.validatePageNumber(PageChannel.java:203)
> at
> com.healthmarketscience.jackcess.impl.PageChannel.readPage(PageChannel.java:219)
> at
> com.healthmarketscience.jackcess.impl.TempPageHolder.setPage(TempPageHolder.java:86)
> at
> com.healthmarketscience.jackcess.impl.UsageMap$ReferenceHandler.<init>(UsageMap.java:724)
> at
> com.healthmarketscience.jackcess.impl.UsageMap.initHandler(UsageMap.java:146)
> at com.healthmarketscience.jackcess.impl.UsageMap.read(UsageMap.java:135)
> at
> com.healthmarketscience.jackcess.impl.PageChannel.initialize(PageChannel.java:117)
> at
> com.healthmarketscience.jackcess.impl.DatabaseImpl.open(DatabaseImpl.java:458)
> at
> com.healthmarketscience.jackcess.DatabaseBuilder.open(DatabaseBuilder.java:278)
> at
> org.apache.tika.parser.microsoft.JackcessParser.parse(JackcessParser.java:101)
> {code}
> Here the global usage map is a _reference_ map ({{{}MAP_TYPE_REFERENCE{}}}).
> Its constructor walks page pointers and {{validatePageNumber}} is declared
> {{throws IOException}} but does:
> {code:java}
> if ((pageNumber <= INVALID_PAGE_NUMBER) || (pageNumber >= nextPageNumber)) {
> throw new IllegalStateException("invalid page number " + pageNumber);
> }
> {code}
> Page 169285950 is far past the end of a 6-page file. Tika already catches
> {{{}IllegalStateException{}}}, but only to map "Incorrect password"; every
> other one is rethrown:
> {code:java}
> } catch (IllegalStateException e) {
> if (e.getMessage() != null && e.getMessage().contains("Incorrect
> password")) {
> throw new EncryptedDocumentException(e);
> }
> throw e;
> }
> {code}
> Suggested Tika-side fix: catch {{RuntimeException}} from
> {{DatabaseBuilder.open}} (or at least {{IndexOutOfBoundsException}} and
> remaining {{{}IllegalStateException{}}}) and rethrow as {{TikaException}} or
> {{{}CorruptedFileException{}}}. One catch covers both inputs. The
> Jackcess-side fix is to throw {{IOException}} for a corrupt usage map,
> matching the declared contracts of {{UsageMap.read}} and
> {{{}validatePageNumber{}}}.
> I have attached both files as an archive to the issue.
> Found by the CISPA Fandango Team
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
