alibaba / alibaba/fastjson2

[BUG]FastJSON2 Issue Report: StringIndexOutOfBoundsException When Serializing Objects with Large BigDecimal

Open
#3,514 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
4.4k
Forks
613
Avg merge
1d 22h
Merged PRs (30d)
6

Description

FastJSON2 Issue Report: StringIndexOutOfBoundsException When Serializing Objects with Large BigDecimal Maps

Summary

When using FastJSON2 (version 2.0.57) to serialize an object containing large Map and other BigDecimal variables with many entries (150+), a StringIndexOutOfBoundsException occurs in JSONWriterUTF8.writeDecimal() method. This happens even with JSONWriter.Feature.LargeObject applied both through annotations and
explicitly in the serialization method.

Environment

- FastJSON2 version: 2.0.57
- JDK/JRE: Java 21 Kotlin
- OS: Linux
- Application type: Kotlin financial data processing application

Issue Description

The application processes financial market data and serializes state objects to JSON for downstream systems. One particular object containing a map with approximately 150-200 entries of market index weights (represented as BigDecimal values) and other financial datas consistently fails with a StringIndexOutOfBoundsException
when serialized using FastJSON2.

The error indicates a buffer overflow in the JSONWriterUTF8.writeDecimal() method, specifically hitting the default 8KB buffer limit (8192 bytes). This happens despite both:
1. Adding JSONWriter.Feature.LargeObject to the class annotation
2. Explicitly adding JSONWriter.Feature.LargeObject when calling JSON.toJSONBytes()

Exception Details

java.lang.StringIndexOutOfBoundsException: Range [8187, 8187 + 6) out of bounds for length 8192
at java.base/jdk.internal.util.Preconditions$1.apply(Preconditions.java:55)
at java.base/jdk.internal.util.Preconditions$1.apply(Preconditions.java:52)
at java.base/jdk.internal.util.Preconditions$4.apply(Preconditions.java:213)
at java.base/jdk.internal.util.Preconditions$4.apply(Preconditions.java:210)
at java.base/jdk.internal.util.Preconditions.outOfBounds(Preconditions.java:98)
at java.base/jdk.internal.util.Preconditions.outOfBoundsCheckFromIndexSize(Preconditions.java:118)
at java.base/jdk.internal.util.Preconditions.checkFromIndexSize(Preconditions.java:397)
at java.base/java.lang.String.checkBoundsOffCount(String.java:4853)
at java.base/java.lang.String.getBytes(String.java:1765)
at com.alibaba.fastjson2.JSONWriterUTF8.writeDecimal(JSONWriterUTF8.java:2382)
at com.alibaba.fastjson2.writer.FieldWriterBigDecimalField.write(FieldWriterBigDecimalField.java:32)
at com.alibaba.fastjson2.writer.ObjectWriterAdapter.write(ObjectWriterAdapter.java:312)
at com.alibaba.fastjson2.JSON.toJSONBytes(JSON.java:3298)
at com.company.processor.EntityProcessor.createOutput(EntityProcessor.kt:211)

ExampleData:
[anonymized_data_sample.txt](https://github.com/user-attachments/files/19856134/anonymized_data_sample.txt)

Contributor guide

Open the contributing guide

Research direction

Start with JSONWriterUTF8.writeDecimal() at JSONWriterUTF8.java:2382 and follow the call from FieldWriterBigDecimalField.java. Reproduce the failure through EntityProcessor.kt:211 using the anonymized sample and the reported LargeObject options. Done means serializing the large BigDecimal map completes without StringIndexOutOfBoundsException.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, kotlin
Domain
backend-api-design
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.