Menu

#154 Improper handling of stream ending with malformed attribute

1.9.15
closed-fixed
None
5
2014-02-13
2014-01-09
Steve McKay
No

Tested version is 1.9.19, not 1.9.15.

A stream ending with an incomplete attribute can result in ArrayIndexOutOfBoundsException. This occurs when the last character in the stream is \r. The problem seems to be in HTMLScanner lines 2989 through 2997, where the return value of fCurrentEntity.read() isn't checked for -1.

<a href="\r (hex: 3C 61 20 68 72 65 66 3D 22 0D) will reproduce the issue.

Discussion

  • Marc Guillemot

    Marc Guillemot - 2014-02-13
    • status: open --> closed-fixed
    • assigned_to: Marc Guillemot
     
  • Marc Guillemot

    Marc Guillemot - 2014-02-13

    Now fixed in SVN. Thanks for the tiny example.

     

Log in to post a comment.

MongoDB Logo MongoDB