Merge branch '2.9' into 2.10

FasterXML · Jul 17, 2019 · 155d1db · 155d1db
2 parents d88d8f0 + e473e99
commit 155d1db
Show file tree

Hide file tree

Showing 4 changed files with 28 additions and 3 deletions.
diff --git a/release-notes/CREDITS-2.x b/release-notes/CREDITS-2.x
@@ -164,6 +164,11 @@ Henrik Gustafsson (gsson@github)
   * Reported #516: _inputPtr off-by-one in UTF8StreamJsonParser._parseNumber2()
   (2.9.9)
 
+Alex Rebert (alpire@github)
+  * Reported #540, suggested fix: UTF8StreamJsonParser: fix byte to int conversion for
+    malformed escapes
+  (2.9.10)
+
 Philippe Marschall (marschall@github)
   * Requested #480: `SerializableString` value can not directly render to Writer
   (2.10.0)

diff --git a/release-notes/VERSION-2.x b/release-notes/VERSION-2.x
@@ -35,6 +35,11 @@ JSON library.
  (contributed by Fabien R)
 #539: Reduce max size of recycled byte[]/char[] blocks by `TextBuffer`, `ByteArrayBuilder`
 
+2.9.10 (not yet released)
+
+#540: UTF8StreamJsonParser: fix byte to int conversion for malformed escapes
+ (Alex R)
+
 2.9.9 (16-May-2019)
 
 #516: _inputPtr off-by-one in UTF8StreamJsonParser._parseNumber2()

diff --git a/src/main/java/com/fasterxml/jackson/core/json/UTF8StreamJsonParser.java b/src/main/java/com/fasterxml/jackson/core/json/UTF8StreamJsonParser.java
@@ -3281,7 +3281,7 @@ protected char _decodeEscaped() throws IOException
                     _reportInvalidEOF(" in character escape sequence", JsonToken.VALUE_STRING);
                 }
             }
-            int ch = (int) _inputBuffer[_inputPtr++];
+            int ch = _inputBuffer[_inputPtr++] & 0xFF;
             int digit = CharTypes.charToHex(ch);
             if (digit < 0) {
                 _reportUnexpectedChar(ch, "expected a hex-digit for character escape sequence");

diff --git a/src/test/java/com/fasterxml/jackson/core/json/TestCharEscaping.java b/src/test/java/com/fasterxml/jackson/core/json/TestCharEscaping.java
@@ -37,6 +37,8 @@ public SerializableString getEscapeSequence(int ch) {
     /**********************************************************
       */
 
+    private final static JsonFactory JSON_F = new JsonFactory();
+
     public void testMissingEscaping()
         throws Exception
     {
@@ -150,15 +152,28 @@ public void testWriteLongCustomEscapes() throws Exception
 
     // [jackson-core#116]
     public void testEscapesForCharArrays() throws Exception {
-        JsonFactory jf = new JsonFactory();
         StringWriter writer = new StringWriter();
-        JsonGenerator jgen = jf.createGenerator(writer);
+        JsonGenerator jgen = JSON_F.createGenerator(writer);
         // must call #writeString(char[],int,int) and not #writeString(String)
         jgen.writeString(new char[] { '\0' }, 0, 1);
         jgen.close();
         assertEquals("\"\\u0000\"", writer.toString());
     }
 
+    // [jackson-core#540]
+    public void testInvalidEscape() throws Exception {
+        JsonParser p = JSON_F.createParser(quote("\\u\u0080...").getBytes("UTF-8"));
+        assertToken(JsonToken.VALUE_STRING, p.nextToken());
+        // this is where we should get proper exception
+        try {
+            p.getText();
+            fail("Should not pass");
+        } catch (JsonParseException e) {
+            verifyException(e, "Unexpected character");
+        }
+        p.close();
+    }
+
     // [jackson-core#116]
     public void testEscapeNonLatin1Chars() throws Exception {
         _testEscapeNonLatin1ViaChars(false);