0037135: OOM parsing corrupted JSON - Openbravo Issue Tracking System

Openbravo Issue Tracking System - Openbravo ERP

View Issue Details

Project

Category

View Status

Date Submitted

Last Update

0037135

Openbravo ERP

A. Platform

public

2017-10-20 13:54

2018-01-03 12:38

Reporter

alostale

Assigned To

alostale

Priority

urgent

Severity

major

Reproducibility

have not tried

Status

closed

Resolution

fixed

Platform

OS Version

Product Version

Target Version

Fixed in Version

3.0PR18Q1

Merge Request Status

Review Assigned To

caristu

OBNetwork customer

Web browser

Modules

Core

Support ticket

Regression level

Regression date

Regression introduced in release

Regression introduced by commit

Triggers an Emergency Pack

Summary

0037135: OOM parsing corrupted JSON

Description

When a corrupted JSON string is parsed to instantiate a JSONObject, an OOM Exception can be thrown.

Even it is very unlikely this to happen because the string must be corrupted in a very particular manner, it can occur when data is sent from client to server.

This is an issue in current version (1.3) of jettison library that is fixed in newer versions [1].

---
[1] https://github.com/jettison-json/jettison/commit/334f9ba080784b65da5 [^]

Steps To Reproduce

Cannot reproduce consistently in real life as a JSON string representation must be corrupted in a specific way.

Execute:

    String corruptedJSON = "{\"data\":[{},";
    new JSONObject(corruptedJSON);

You get:

java.lang.OutOfMemoryError: Java heap space
    at java.util.Arrays.copyOf(Arrays.java:3210)
    at java.util.Arrays.copyOf(Arrays.java:3181)
    at java.util.ArrayList.grow(ArrayList.java:261)
    at java.util.ArrayList.ensureExplicitCapacity(ArrayList.java:235)
    at java.util.ArrayList.ensureCapacityInternal(ArrayList.java:227)
    at java.util.ArrayList.add(ArrayList.java:458)
    at org.codehaus.jettison.json.JSONArray.<init>(JSONArray.java:107)
    at org.codehaus.jettison.json.JSONTokener.nextValue(JSONTokener.java:313)
    at org.codehaus.jettison.json.JSONObject.<init>(JSONObject.java:195)
    at org.codehaus.jettison.json.JSONObject.<init>(JSONObject.java:266)
    at LoadJson.main(LoadJson.java:17)

Proposed Solution

Upgrade to latest jettison version.

Review following changesets [1] that might affect behavior.

---
[1] https://docs.google.com/spreadsheets/d/1ldZ2IL3s5f-BSHlqVSGxG1ecTSJK20jIxaQudgZIlX8/edit#gid=0 [^]

Additional Information

Tags

No tags attached.

Relationships

related to	design defect	0037151	acknowledged	Triage Platform Base	upgrade/replace JSON library
related to	defect	0037335	closed	caristu	The DBSourceManager test classpath references the old jettison library
blocks	defect	0052255	closed	kousalya_r	Request to provide valid version for jettison-1.3-patched.jar