This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-bcel.git
The following commit(s) were added to refs/heads/master by this push:
new 262ad94d f011: typeSignatureToString recurses per generic-nesting
level, unbounded, with quadratic substring copies
262ad94d is described below
commit 262ad94d1bba2bd7f003e2d4aa3255178c32902d
Author: Gary Gregory <[email protected]>
AuthorDate: Fri Sep 4 16:28:02 2026 -0400
f011: typeSignatureToString recurses per generic-nesting level,
unbounded, with quadratic substring copies
---
src/changes/changes.xml | 1 +
.../java/org/apache/bcel/classfile/Utility.java | 30 +++++++++++++++++++---
.../org/apache/bcel/classfile/UtilityTest.java | 25 ++++++++++++++++++
3 files changed, 52 insertions(+), 4 deletions(-)
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index a4d1bfea..5b73886d 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -98,6 +98,7 @@ The <action> type attribute can be add,update,fix,remove.
<action type="fix" dev="ggregory" due-to="Gary
Gregory">Subroutines.noRecursiveCalls enumerates exponentially many JSR call
paths (f008).</action>
<action type="fix" dev="ggregory" due-to="Gary
Gregory">Disassembler and Class2HTML re-implement the unchecked switch-table
allocation (f009).</action>
<action type="fix" dev="ggregory" due-to="Gary
Gregory">ConstantPool.constantToString recurses forever on self-referencing
CONSTANT_MethodHandle (f010).</action>
+ <action type="fix" dev="ggregory" due-to="Gary
Gregory">Utility.typeSignatureToString recurses per generic-nesting level,
unbounded, with quadratic substring copies. (f011).</action>
<!-- ADD -->
<action type="add" dev="ggregory" due-to="nbauma109,
Gary Gregory">Add support for permitted subclasses #493.</action>
<action type="add" dev="ggregory" due-to="nbauma109,
Gary Gregory">Add RecordComponentInfo.getAttribute(byte tag)#494.</action>
diff --git a/src/main/java/org/apache/bcel/classfile/Utility.java
b/src/main/java/org/apache/bcel/classfile/Utility.java
index ddee58cf..d0a5482d 100644
--- a/src/main/java/org/apache/bcel/classfile/Utility.java
+++ b/src/main/java/org/apache/bcel/classfile/Utility.java
@@ -48,6 +48,12 @@ import org.apache.commons.lang3.StringUtils;
// @since 6.0 methods are no longer final
public abstract class Utility {
+ /*
+ * Maximum nesting depth accepted by typeSignatureToString(). Signatures
are attacker-controlled bytes from untrusted class files; without a limit, a
deeply
+ * nested generic signature such as "LA<LA<LA<...>;>;>;" drives one stack
frame per nesting level and kills the calling thread with a StackOverflowError.
+ */
+ private static final int MAX_SIGNATURE_NESTING = 512;
+
/**
* Decode characters into bytes. Used by <a
href="Utility.html#decode(java.lang.String, boolean)">decode()</a>
*/
@@ -1460,6 +1466,22 @@ public abstract class Utility {
* @since 6.4.0
*/
public static String typeSignatureToString(final String signature, final
boolean chopit) throws ClassFormatException {
+ return typeSignatureToString(signature, chopit, 0);
+ }
+
+ /**
+ * Recursive worker for {@link #typeSignatureToString(String, boolean)}
carrying the current nesting depth.
+ *
+ * @param signature type signature.
+ * @param chopit flag that determines whether chopping is executed or
not.
+ * @param depth current nesting depth.
+ * @return string containing human readable type signature.
+ * @throws ClassFormatException if the signature is malformed or nested
deeper than {@code MAX_SIGNATURE_NESTING}.
+ */
+ private static String typeSignatureToString(final String signature, final
boolean chopit, final int depth) throws ClassFormatException {
+ if (depth > MAX_SIGNATURE_NESTING) {
+ throw new ClassFormatException("Invalid signature: nesting depth
exceeds " + MAX_SIGNATURE_NESTING);
+ }
// corrected concurrent private static field acess
wrap(CONSUMER_CHARS, 1); // This is the default, read just one char
like 'B'
try {
@@ -1539,7 +1561,7 @@ public abstract class Utility {
type.append("?");
consumedChars++;
} else {
-
type.append(typeSignatureToString(signature.substring(consumedChars), chopit));
+
type.append(typeSignatureToString(signature.substring(consumedChars), chopit,
depth + 1));
// update our consumed count by the number of characters
the for type argument
consumedChars = unwrap(CONSUMER_CHARS) + consumedChars;
wrap(CONSUMER_CHARS, consumedChars);
@@ -1560,7 +1582,7 @@ public abstract class Utility {
type.append("?");
consumedChars++;
} else {
-
type.append(typeSignatureToString(signature.substring(consumedChars), chopit));
+
type.append(typeSignatureToString(signature.substring(consumedChars), chopit,
depth + 1));
// update our consumed count by the number of
characters the for type argument
consumedChars = unwrap(CONSUMER_CHARS) + consumedChars;
wrap(CONSUMER_CHARS, consumedChars);
@@ -1576,7 +1598,7 @@ public abstract class Utility {
type.append(".");
// convert SimpleClassTypeSignature to fake
ClassTypeSignature
// and then recurse to parse it
- type.append(typeSignatureToString("L" +
signature.substring(consumedChars + 1), chopit));
+ type.append(typeSignatureToString("L" +
signature.substring(consumedChars + 1), chopit, depth + 1));
// update our consumed count by the number of characters
the for type argument
// note that this count includes the "L" we added, but
that is ok
// as it accounts for the "." we didn't consume
@@ -1603,7 +1625,7 @@ public abstract class Utility {
}
final int consumedChars = n; // Remember value
// The rest of the string denotes a '<field_type>'
- final String type =
typeSignatureToString(signature.substring(n), chopit);
+ final String type =
typeSignatureToString(signature.substring(n), chopit, depth + 1);
// corrected concurrent private static field acess
// consumed_chars += consumed_chars; is replaced by:
final int temp = unwrap(CONSUMER_CHARS) + consumedChars;
diff --git a/src/test/java/org/apache/bcel/classfile/UtilityTest.java
b/src/test/java/org/apache/bcel/classfile/UtilityTest.java
index 3d276583..e3ee1b14 100644
--- a/src/test/java/org/apache/bcel/classfile/UtilityTest.java
+++ b/src/test/java/org/apache/bcel/classfile/UtilityTest.java
@@ -35,8 +35,12 @@ import org.apache.bcel.Repository;
import org.apache.bcel.util.ByteSequence;
import org.junit.jupiter.api.Test;
+/**
+ * Tests {@link Utility}.
+ */
class UtilityTest {
+
@Test
void testClearBit() {
assertEquals(0, Utility.clearBit(0, 0));
@@ -91,6 +95,7 @@ class UtilityTest {
}
}
+
@Test
void testCodeToStringOversizedLookupSwitch() {
// A LOOKUPSWITCH claiming Integer.MAX_VALUE pairs without any table
bytes behind it
@@ -149,6 +154,21 @@ class UtilityTest {
assertEquals("abc", Utility.convertString("abc"));
}
+ @Test
+ void testDeeplyNestedTypeSignatureThrows() {
+ // One recursion level per generic nesting level: must fail fast, not
StackOverflowError.
+ final int depth = 20_000;
+ final StringBuilder sig = new StringBuilder();
+ for (int i = 0; i < depth; i++) {
+ sig.append("LA<");
+ }
+ sig.append("LB;");
+ for (int i = 0; i < depth; i++) {
+ sig.append(">;");
+ }
+ assertThrows(ClassFormatException.class, () ->
Utility.typeSignatureToString(sig.toString(), false));
+ }
+
@Test
void testIsSet() {
assertTrue(Utility.isSet(1, 0));
@@ -161,6 +181,11 @@ class UtilityTest {
assertFalse(Utility.isSet(9, 1));
}
+ @Test
+ void testModeratelyNestedTypeSignatureStillParses() {
+ assertEquals("A<A<B>>", Utility.typeSignatureToString("LA<LA<LB;>;>;",
false));
+ }
+
@Test
void testPrintArray() {
assertNull(Utility.printArray(null, false, false));
