Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CODEC-311: Fix possible ArrayIndexOutOfBoundException thrown by RefinedSoundex.getMappingCode() #219

Merged

Conversation

arthurscchan
Copy link
Contributor

@arthurscchan arthurscchan commented Nov 22, 2023

This fixes a possible ArrayIndexOutOfBoundException in src/main/java/org/apache/commons/codec/language/RefinedSoundex.java thrown by RefinedSoundex.getMappingCode() method when handling out of range letters.

This PR adds a conditional checking to ensure the index is never out of bounds from the configured soundexMapping array. If the calculated index goes out of bounds, it will simply return 0, just like the original logic when Character.isLetter() returns false.

We found this bug using fuzzing by way of OSS-Fuzz. It is reported at https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64353.

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
@garydgregory
Copy link
Member

Hello @arthurscchan
You'll need a unit test to prove this change works.

@arthurscchan
Copy link
Contributor Author

@garydgregory Thanks for the comment. I have added a unit test.

@codecov-commenter
Copy link

codecov-commenter commented Nov 22, 2023

Codecov Report

Attention: 1 lines in your changes are missing coverage. Please review.

Comparison is base (44e4c4d) 92.27% compared to head (a9c487e) 92.22%.
Report is 8 commits behind head on master.

Files Patch % Lines
.../apache/commons/codec/language/RefinedSoundex.java 75.00% 0 Missing and 1 partial ⚠️
Additional details and impacted files
@@             Coverage Diff              @@
##             master     #219      +/-   ##
============================================
- Coverage     92.27%   92.22%   -0.05%     
- Complexity     1742     1747       +5     
============================================
  Files            67       67              
  Lines          4584     4594      +10     
  Branches        709      714       +5     
============================================
+ Hits           4230     4237       +7     
- Misses          242      243       +1     
- Partials        112      114       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@arthurscchan arthurscchan force-pushed the CODEC-311-ArrayIndexOutOfBound branch 2 times, most recently from 9abdfbb to e1fa662 Compare November 22, 2023 20:06
@garydgregory
Copy link
Member

@arthurscchan
Please use a better description in PRs and JIRA: Specify the class and method where the exception occurs.

@arthurscchan arthurscchan changed the title CODEC-311: Fix possible ArrayIndexOutOfBoundException CODEC-311: Fix possible ArrayIndexOutOfBoundException thrown from RefinedSoundex.getMappingCode() Nov 24, 2023
@arthurscchan arthurscchan changed the title CODEC-311: Fix possible ArrayIndexOutOfBoundException thrown from RefinedSoundex.getMappingCode() CODEC-311: Fix possible ArrayIndexOutOfBoundException thrown by RefinedSoundex.getMappingCode() Nov 24, 2023
Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
@garydgregory garydgregory merged commit 29012d7 into apache:master Nov 25, 2023
8 checks passed
garydgregory added a commit that referenced this pull request Nov 25, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
3 participants