Uploaded image for project: 'Java Support'
  1. Java Support
  2. JSPT-49

array bounds exception in IPRange parser

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 4.0.0
    • Fix Version/s: 6.0.0
    • Component/s: net
    • Labels:
      None

      Description

      The Javadoc is not as explicit as I'd like, but I think the contract of IPRange.parseCIDRBlock is intended to be that it either returns an IPRange object or throws IllegalArgumentException saying why not.

      In practice, if you pass it something like "1.2.3.4" (not no '/n' component saying the size of the mask) then it throws an ArrayIndexOutOfBoundsException from line 179:

      int maskSize = Integer.parseInt(blockParts[1]);

      which a caller probably isn't expecting and which is certainly unhelpful, as it won't indicate the erroneous CIDR string, the source context (probably somewhere in a configuration file) or really anything else.

      There are two things we could do to fix this.

      Route 1 would be to explicitly throw an IllegalArgumentException immediately after this line, if the array size is other than 2:

      String[] blockParts = block.split("/");

      This would mean that "1.2.3.4" would be rejected and "1.2.3.4/27/52" would also be detected. I guess one might want two reason messages in those cases though.

      The other alternative would be to special-case an array size of 1, and take it as meaning the block of size one (equivalent to "1.2.3.4/32" or "1:2::/128" as appropriate). I'm not sure that's what I'd expect an IPRange parser to return, though, and my preference would be to go with the first option.

        Attachments

          Activity

            People

            Assignee:
            tzeller@shibboleth.net Tom Zeller
            Reporter:
            ian@iay.org.uk Ian Young
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:

                Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 15 minutes
                15m