From b46a6500b0302f0718536b1940d0cf19d34cd5ac Mon Sep 17 00:00:00 2001 From: Xueming Shen Date: Wed, 24 Jun 2015 11:15:23 -0700 Subject: [PATCH] 8129544: ArrayIndexOutOfBoundsException when decoding corrupt Base64 string To take input bytes as unsigned before check range Reviewed-by: alanb --- .../java.base/share/classes/java/util/Base64.java | 2 +- jdk/test/java/util/Base64/TestBase64.java | 13 +++++++++++-- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/jdk/src/java.base/share/classes/java/util/Base64.java b/jdk/src/java.base/share/classes/java/util/Base64.java index 2ccfdec9f60..9a34f279ab3 100644 --- a/jdk/src/java.base/share/classes/java/util/Base64.java +++ b/jdk/src/java.base/share/classes/java/util/Base64.java @@ -737,7 +737,7 @@ public class Base64 { // anything left is invalid, if is not MIME. // if MIME, ignore all non-base64 character while (sp < sl) { - if (isMIME && base64[src[sp++]] < 0) + if (isMIME && base64[src[sp++] & 0xff] < 0) continue; throw new IllegalArgumentException( "Input byte array has incorrect ending byte at " + sp); diff --git a/jdk/test/java/util/Base64/TestBase64.java b/jdk/test/java/util/Base64/TestBase64.java index bb2330721ec..0c5e27fd9fd 100644 --- a/jdk/test/java/util/Base64/TestBase64.java +++ b/jdk/test/java/util/Base64/TestBase64.java @@ -23,7 +23,7 @@ /** * @test 4235519 8004212 8005394 8007298 8006295 8006315 8006530 8007379 8008925 - * 8014217 8025003 8026330 8028397 + * 8014217 8025003 8026330 8028397 8129544 * @summary tests java.util.Base64 * @key randomness */ @@ -408,7 +408,16 @@ public class TestBase64 { }}); } } - } + + // anything left after padding is "invalid"/IAE, if + // not MIME. In case of MIME, non-base64 character(s) + // is ignored. + checkIAE(new Runnable() { public void run() { + Base64.getDecoder().decode("AA==\u00D2"); }}); + checkIAE(new Runnable() { public void run() { + Base64.getUrlDecoder().decode("AA==\u00D2"); }}); + Base64.getMimeDecoder().decode("AA==\u00D2"); + } private static void testDecodeUnpadded() throws Throwable { byte[] srcA = new byte[] { 'Q', 'Q' };