This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-bcel.git
The following commit(s) were added to refs/heads/master by this push:
new b27feadf f001 Nested Code/Record attributes drive unbounded parse-time
recursion in ClassParser.
b27feadf is described below
commit b27feadfce6dcc6755b6123499ddfd2b12aebfc8
Author: Gary Gregory <[email protected]>
AuthorDate: Fri Sep 4 10:28:58 2026 -0400
f001 Nested Code/Record attributes drive unbounded parse-time recursion
in ClassParser.
- Checkstylle
- Sort members
---
.../java/org/apache/bcel/classfile/Attribute.java | 32 +++++++++++-----------
1 file changed, 16 insertions(+), 16 deletions(-)
diff --git a/src/main/java/org/apache/bcel/classfile/Attribute.java
b/src/main/java/org/apache/bcel/classfile/Attribute.java
index 61144e07..cc671a36 100644
--- a/src/main/java/org/apache/bcel/classfile/Attribute.java
+++ b/src/main/java/org/apache/bcel/classfile/Attribute.java
@@ -46,7 +46,7 @@ import org.apache.bcel.util.Args;
* legitimately nest (for example, a <em>Code</em> attribute carries its own
attribute table, and <em>Record</em> components carry theirs), but a malicious
* class file can nest such attributes deeply enough to overflow the parser's
stack.
* </p>
- *
+ *
* @see ConstantValue
* @see SourceFile
* @see Code
@@ -152,6 +152,21 @@ public abstract class Attribute implements Cloneable, Node
{
}
}
+ /**
+ * Class method reads one attribute from the input data stream. This
method must not be accessible from the outside. It
+ * is called by the Field and Method constructor methods.
+ *
+ * @see Field
+ * @see Method
+ * @param dataInputStream Input stream.
+ * @param constantPool Array of constants.
+ * @return Attribute.
+ * @throws IOException Thrown if an I/O error occurs.
+ */
+ public static Attribute readAttribute(final DataInputStream
dataInputStream, final ConstantPool constantPool) throws IOException {
+ return readAttribute((DataInput) dataInputStream, constantPool);
+ }
+
/**
* Reads one attribute without tracking the nesting depth; only to be
called by {@link #readAttribute(DataInput, ConstantPool)}.
*/
@@ -249,21 +264,6 @@ public abstract class Attribute implements Cloneable, Node
{
}
}
- /**
- * Class method reads one attribute from the input data stream. This
method must not be accessible from the outside. It
- * is called by the Field and Method constructor methods.
- *
- * @see Field
- * @see Method
- * @param dataInputStream Input stream.
- * @param constantPool Array of constants.
- * @return Attribute.
- * @throws IOException Thrown if an I/O error occurs.
- */
- public static Attribute readAttribute(final DataInputStream
dataInputStream, final ConstantPool constantPool) throws IOException {
- return readAttribute((DataInput) dataInputStream, constantPool);
- }
-
/**
* Remove attribute reader
*
