Skip to content

Commit ba96d53

Browse files
authored
Fix missing bounds checks for JsonTreeReader.getPath() (#2001)
There are situations where the stack of JsonTreeReader contains a JsonArray or JsonObject without a subsequent Iterator, for example after calling peek() or nextName(). When JsonTreeReader.getPath() is called afterwards it therefore must not assume that a JsonArray or JsonObject is always followed by an Iterator. The only reason why this never caused an ArrayIndexOutOfBoundsException in the past is because the stack has an even default size (32) so it would just have read the next `null`. However, if the stack had for example the default size 31, a user created a JsonTreeReader for 16 JSON arrays nested inside each other, then called 15 times beginArray(), followed by peek() and getPath() the exception would occur.
1 parent ca1df7f commit ba96d53

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

gson/src/main/java/com/google/gson/internal/bind/JsonTreeReader.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -308,11 +308,11 @@ private void push(Object newTop) {
308308
StringBuilder result = new StringBuilder().append('$');
309309
for (int i = 0; i < stackSize; i++) {
310310
if (stack[i] instanceof JsonArray) {
311-
if (stack[++i] instanceof Iterator) {
311+
if (++i < stackSize && stack[i] instanceof Iterator) {
312312
result.append('[').append(pathIndices[i]).append(']');
313313
}
314314
} else if (stack[i] instanceof JsonObject) {
315-
if (stack[++i] instanceof Iterator) {
315+
if (++i < stackSize && stack[i] instanceof Iterator) {
316316
result.append('.');
317317
if (pathNames[i] != null) {
318318
result.append(pathNames[i]);

0 commit comments

Comments
 (0)