firebase / firebase/firebase-admin-java

OutOfMemoryError occurred when calling Utilities.splitIntoFramesg function

未關閉
#883 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
needs-triage
主要語言
Java
星號
620
分支
305
平均合併
3 小時 23 分鐘
30 天內合併 PR
1

描述

# OutOfMemoryError occurred when calling Utilities.splitIntoFramesg function

## Description

An OutOfMemoryError vulnerability exists in the Utilities.splitIntoFrames method in firebase-admin 9.2.0.

## Error Log

```
java.lang.OutOfMemoryError: Java heap space

at java.base/java.lang.StringLatin1.newString(StringLatin1.java:715)
at java.base/java.lang.String.substring(String.java:1879)
at com.google.firebase.database.utilities.Utilities.splitIntoFrames(Utilities.java:131)
at PoC.firebas_admin.UtilitiesFuzzerSplitIntoFrames.splitIntoFramesFuzzerTest(UtilitiesFuzzerSplitIntoFrames.java:9)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:59)
at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:56)
at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
at org.junit.runners.ParentRunner$3.evaluate(ParentRunner.java:306)
at org.junit.runners.BlockJUnit4ClassRunner$1.evaluate(BlockJUnit4ClassRunner.java:100)
at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:366)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:103)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:63)
at org.junit.runners.ParentRunner$4.run(ParentRunner.java:331)
at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:79)
at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:329)
at org.junit.runners.ParentRunner.access$100(ParentRunner.java:66)
at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:293)
at org.junit.runners.ParentRunner$3.evaluate(ParentRunner.java:306)
at org.junit.runners.ParentRunner.run(ParentRunner.java:413)
at org.junit.runner.JUnitCore.run(JUnitCore.java:137)
at com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:69)
at com.intellij.rt.junit.IdeaTestRunner$Repeater$1.execute(IdeaTestRunner.java:38)
at com.intellij.rt.execution.junit.TestsRepeater.repeat(TestsRepeater.java:11)
at com.intellij.rt.junit.IdeaTestRunner$Repeater.startRunnerWithArgs(IdeaTestRunner.java:35)
at com.intellij.rt.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:235)
at com.intellij.rt.junit.JUnitStarter.main(JUnitStarter.java:54)
```

## PoC
```xml

com.google.firebase
firebase-admin
9.2.0

```

```java
import org.junit.Test;
import com.google.firebase.database.utilities.*;
public class UtilitiesFuzzerSplitIntoFrames {
@Test
public void splitIntoFramesFuzzerTest() {
try {
String[] result = Utilities.splitIntoFrames("9.", 0);
} catch (Exception e) {
}
}
}
```

貢獻指南

開啟貢獻指南

研究方向

Start with com.google.firebase.database.utilities.Utilities.splitIntoFrames at Utilities.java:131 and reproduce the report using the UtilitiesFuzzerSplitIntoFrames PoC with the input "9." and frame size 0. Determine the expected handling for this input and verify that the resulting behavior no longer causes Java heap exhaustion.

由索引模型根據 Issue 內容生成。

評估

技術堆疊
java
領域
databases
Issue 類型
缺陷
難度
4/5
預估耗時
3-5 天
活躍度
停滯
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。