Sheung Chi Chan created CODEC-314:
-------------------------------------
Summary: PercentCodec.insertAlwaysEncodeChars throws
IndexOutOfBoundException
Key: CODEC-314
URL: https://issues.apache.org/jira/browse/CODEC-314
Project: Commons Codec
Issue Type: Bug
Reporter: Sheung Chi Chan
The {{insertAlwaysEncodeChars()}} method takes in a random byte array (through
the constructor of PercentCodec class) and processes it byte by byte. Each byte
is passed to {{insertAlwaysEncodeChar()}} to set the corresponding bit in the
BitSet object {{alwaysEncodeChars}} to true by calling the {{set()}} method of
the BitSet object. As BitSet only accept positive index, if any byte is
negative, it will cause IndexOutOfBoundsException when calling the {{set()}}
method.
Possible fix could add a conditional check to ensure only valid bytes (positive
or zero) are processed.
We found this bug using fuzzing by way of OSS-Fuzz. It is reported at
[https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64362].
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
