firebase / firebase/firebase-admin-java
OutOfMemoryError occurred when calling Utilities.splitIntoFramesg function
- Vorherrschende Sprache
- Java
- Sterne
- 620
- Forks
- 305
- Ø Merge
- 3 Std. 23 Min.
- Gemergte PRs (30 T.)
- 1
Beschreibung
# OutOfMemoryError occurred when calling Utilities.splitIntoFramesg function
## Description
An OutOfMemoryError vulnerability exists in the Utilities.splitIntoFrames method in firebase-admin 9.2.0.
## Error Log
```
java.lang.OutOfMemoryError: Java heap space
at java.base/java.lang.StringLatin1.newString(StringLatin1.java:715)
at java.base/java.lang.String.substring(String.java:1879)
at com.google.firebase.database.utilities.Utilities.splitIntoFrames(Utilities.java:131)
at PoC.firebas_admin.UtilitiesFuzzerSplitIntoFrames.splitIntoFramesFuzzerTest(UtilitiesFuzzerSplitIntoFrames.java:9)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:59)
at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:56)
at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
at org.junit.runners.ParentRunner$3.evaluate(ParentRunner.java:306)
at org.junit.runners.BlockJUnit4ClassRunner$1.evaluate(BlockJUnit4ClassRunner.java:100)
at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:366)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:103)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:63)
at org.junit.runners.ParentRunner$4.run(ParentRunner.java:331)
at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:79)
at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:329)
at org.junit.runners.ParentRunner.access$100(ParentRunner.java:66)
at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:293)
at org.junit.runners.ParentRunner$3.evaluate(ParentRunner.java:306)
at org.junit.runners.ParentRunner.run(ParentRunner.java:413)
at org.junit.runner.JUnitCore.run(JUnitCore.java:137)
at com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:69)
at com.intellij.rt.junit.IdeaTestRunner$Repeater$1.execute(IdeaTestRunner.java:38)
at com.intellij.rt.execution.junit.TestsRepeater.repeat(TestsRepeater.java:11)
at com.intellij.rt.junit.IdeaTestRunner$Repeater.startRunnerWithArgs(IdeaTestRunner.java:35)
at com.intellij.rt.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:235)
at com.intellij.rt.junit.JUnitStarter.main(JUnitStarter.java:54)
```
## PoC
```xml
com.google.firebase
firebase-admin
9.2.0
```
```java
import org.junit.Test;
import com.google.firebase.database.utilities.*;
public class UtilitiesFuzzerSplitIntoFrames {
@Test
public void splitIntoFramesFuzzerTest() {
try {
String[] result = Utilities.splitIntoFrames("9.", 0);
} catch (Exception e) {
}
}
}
```
Beitragsleitfaden
Rechercherichtung
Beginne mit com.google.firebase.database.utilities.Utilities.splitIntoFrames in Utilities.java:131 und reproduziere den Bericht mithilfe des UtilitiesFuzzerSplitIntoFrames PoC mit der Eingabe "9." und der Frame-Größe 0. Bestimme das erwartete Verhalten für diese Eingabe und überprüfe, dass das resultierende Verhalten nicht mehr zur Erschöpfung des Java-Heaps führt.
Vom Indexierungsmodell aus dem Issue-Text verfasst.
Bewertung
- Tech-Stack
- java
- Bereich
- databases
- Issue-Typ
- Bug
- Schwierigkeit
- 4/5
- Geschätzter Aufwand
- 3-5 Tage
- Aktivitätsstatus
- Veraltet
- Klarheit
- Größtenteils klar
- Anfängerfreundlichkeit
- 35/100