Skip to content

str8 with length > 127 leads to Bad limit exception, v0.6.11 #213

@ArcsinX

Description

@ArcsinX

Problem is in the following code of MessagePackUnpacker.java

...
       case 0xd9: // str 8
        {
              int count = in.getByte();
...

byte is a signed type!
If string length > 127, then count will be negative number, so tryReferRawBody will be called with second parameter as negative number.

...
            if (!tryReferRawBody(a, count)) {

...

Thus we will get java.lang.IllegalArgumentException: Bad limit (capacity 1024): -65 expection

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions