Skip to content

guard short handle string in XsbReader.readHandle#73

Closed
aizu-m wants to merge 1 commit into
apache:trunkfrom
aizu-m:xsb-readhandle-short-handle
Closed

guard short handle string in XsbReader.readHandle#73
aizu-m wants to merge 1 commit into
apache:trunkfrom
aizu-m:xsb-readhandle-short-handle

Conversation

@aizu-m

@aizu-m aizu-m commented Jun 26, 2026

Copy link
Copy Markdown

Feeding the schema loader a crafted .xsb, it throws out of readHandle:

java.lang.StringIndexOutOfBoundsException: Index 2 out of bounds for length 2
    at java.lang.String.charAt(String.java:1555)
    at org.apache.xmlbeans.impl.schema.XsbReader.readHandle(XsbReader.java:444)

readHandle pulls a component handle off the .xsb string pool and switches on
handle.charAt(0) then handle.charAt(2) without checking the length first. An
empty handle trips charAt(0). A one or two char handle starting with '_' (say
"_X") trips charAt(2), and a three char one walks into QNameHelper.forPretty(handle, 4)
whose substring(4) throws too.

The loader is meant to surface a bad file as SchemaTypeLoaderException, the
reader only wraps IOException, and the method's own unresolved-handle branches
already throw BAD_HANDLE. So this index walk is the odd one out. Spotted it
fuzzing the reader with truncated handle strings.

Guarded the empty handle and the short '_' handle the same way. Valid handles
keep their existing path. Test in XsbReaderHandleTest.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant