Fix accepting illegal hex string when parsing

Author: patrickfav

CHANGELOG

@@ -3,6 +3,7 @@
 ## v0.4.5
 
 * add nullSafe wrapper
+* fix accepting illegal hex string when parsing
 
 ## v0.4.4
 

src/main/java/at/favre/lib/bytes/BinaryToTextEncoding.java

@@ -99,16 +99,24 @@ public byte[] decode(String hexString) {
             if (hexString.length() % 2 != 0)
                 throw new IllegalArgumentException("invalid hex string, must be mod 2 == 0");
 
+            int start;
             if (hexString.startsWith("0x")) {
-                hexString = hexString.substring(2, hexString.length());
+                start = 2;
+            } else {
+                start = 0;
             }
 
             int len = hexString.length();
-            byte[] data = new byte[len / 2];
-            for (int i = 0; i < len; i += 2) {
-                data[i / 2] = (byte)
-                        ((Character.digit(hexString.charAt(i), 16) << 4)
-                                + Character.digit(hexString.charAt(i + 1), 16));
+            byte[] data = new byte[(len - start) / 2];
+            for (int i = start; i < len; i += 2) {
+                int first4Bits = Character.digit(hexString.charAt(i), 16);
+                int second4Bits = Character.digit(hexString.charAt(i + 1), 16);
+
+                if (first4Bits == -1 || second4Bits == -1) {
+                    throw new IllegalArgumentException("'" + hexString.charAt(i) + hexString.charAt(i + 1) + "' at index " + i + " is not hex formatted");
+                }
+
+                data[(i - start) / 2] = (byte) ((first4Bits << 4) + second4Bits);
             }
             return data;
         }

src/test/java/at/favre/lib/bytes/BinaryToTextEncodingTest.java

@@ -36,6 +36,11 @@ public void encodeHex() throws Exception {
         assertNotEquals(new BinaryToTextEncoding.Hex(false).encode(new byte[]{1, 2, 3}, ByteOrder.LITTLE_ENDIAN), new BinaryToTextEncoding.Hex(false).encode(new byte[]{1, 2, 3}, ByteOrder.BIG_ENDIAN));
     }
 
+    @Test(expected = IllegalArgumentException.class)
+    public void decodeHexShouldFail() throws Exception {
+        new BinaryToTextEncoding.Hex(false).decode("AAI=");
+    }
+
     @Test
     public void encodeBaseRadix() throws Exception {
         assertEquals("100211", new BinaryToTextEncoding.BaseRadix(16).encode(new byte[]{16, 2, 17}, ByteOrder.BIG_ENDIAN));

src/test/java/at/favre/lib/bytes/BytesParseAndEncodingTest.java

@@ -38,9 +38,9 @@ public void setUp() throws Exception {
     @Test
     public void parseHex() throws Exception {
         byte[] defaultArray = new byte[]{(byte) 0xA0, (byte) 0xE1};
+        assertArrayEquals(defaultArray, Bytes.parseHex("0xA0E1").array());
         assertArrayEquals(defaultArray, Bytes.parseHex("A0E1").array());
         assertArrayEquals(defaultArray, Bytes.parseHex("a0e1").array());
-        assertArrayEquals(defaultArray, Bytes.parseHex("0xA0E1").array());
         assertArrayEquals(defaultArray, Bytes.parseHex(Bytes.parseHex("A0E1").encodeHex()).array());
     }