Merge pull request #5 from myronkscott/fix_array_parsing

TDB-19029: avoid for loop that is unbounded based on input

Author: Clifford W. Johnson

src/main/java/com/tc/object/management/SerializationHelper.java

@@ -47,9 +47,8 @@ protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, Clas
           if (cname.startsWith("[")) {
             // An array
             Class<?> component;
-            int dcount;
-            for (dcount = 1; cname.charAt(dcount) == '['; dcount++) ;
-            if (cname.charAt(dcount) == 'L') {
+            int dcount = cname.lastIndexOf('[') + 1;
+            if (dcount < cname.length() && cname.charAt(dcount) == 'L') {
               component = lookupClass(cname.substring(dcount + 1, cname.length() - 1));
             } else {
               // primitive array

src/test/java/com/tc/object/management/SerializationHelperTest.java

@@ -0,0 +1,80 @@
+/*
+ * Copyright 2003-2008 Terracotta, Inc.
+ * Copyright Super iPaaS Integration LLC, an IBM Company 2024
+ */
+
+package com.tc.object.management;
+
+import com.tc.util.Assert;
+import java.io.ByteArrayOutputStream;
+import java.io.ObjectOutputStream;
+import org.junit.After;
+import org.junit.AfterClass;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+/**
+ *
+ */
+public class SerializationHelperTest {
+  
+  public SerializationHelperTest() {
+  }
+  
+  @BeforeClass
+  public static void setUpClass() {
+  }
+  
+  @AfterClass
+  public static void tearDownClass() {
+  }
+  
+  @Before
+  public void setUp() {
+  }
+  
+  @After
+  public void tearDown() {
+  }
+
+   @Test
+   public void testArrayClassResolve() throws Exception {
+      byte[] raw;
+      String[] sa = new String[] {"foo", "bar", "baz"};
+     
+      try (ByteArrayOutputStream out = new ByteArrayOutputStream();
+        ObjectOutputStream oo = new ObjectOutputStream(out)) {
+        oo.writeObject(sa);
+        oo.flush();
+        raw = out.toByteArray();
+      }
+     
+      Object check = SerializationHelper.deserialize(raw, getClass().getClassLoader());
+      Assert.assertTrue(check, check.getClass().isArray());
+      Assert.assertTrue(check, check.getClass().getComponentType().isAssignableFrom(String.class));
+      String[] look = (String[])check;
+      Assert.assertEquals(sa.length, look.length);
+      for (int x=0;x<sa.length;x++) {
+        Assert.assertEquals(sa[x], look[x]);
+      }
+   }
+   
+
+   @Test
+   public void testMultiArrayResolve() throws Exception {
+      byte[] raw;
+      String[][] sa = new String[][] {{"foo"}, {"bar"}, {"baz"}};
+     
+      try (ByteArrayOutputStream out = new ByteArrayOutputStream();
+        ObjectOutputStream oo = new ObjectOutputStream(out)) {
+        oo.writeObject(sa);
+        oo.flush();
+        raw = out.toByteArray();
+      }
+     
+      Object check = SerializationHelper.deserialize(raw, getClass().getClassLoader());
+      Assert.assertTrue(check, check.getClass().isArray());
+      Assert.assertTrue(check, check.getClass().getComponentType().isArray());
+   }
+}