AIOOBE in OpenSSHKeyFile.initPubKey
- Dominant language
- Java
- Stars
- 2.7k
- Forks
- 620
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 11
Description
We've got a few bug-reports from a user who obviously tried to use an unsupported private key file and hence got following exception (our application runs without assertions enabled):
```
java.lang.ArrayIndexOutOfBoundsException
at net.schmizz.sshj.userauth.keyprovider.OpenSSHKeyFile.initPubKey(OpenSSHKeyFile.java:97)
at net.schmizz.sshj.userauth.keyprovider.OpenSSHKeyFile.init(OpenSSHKeyFile.java:67)
at net.schmizz.sshj.userauth.keyprovider.BaseFileKeyProvider.init(BaseFileKeyProvider.java:55)
at net.schmizz.sshj.SSHClient.loadKeys(SSHClient.java:569)
at net.schmizz.sshj.SSHClient.loadKeys(SSHClient.java:538)
at net.schmizz.sshj.SSHClient.loadKeys(SSHClient.java:587)
```
The code reads:
```
private void initPubKey(Reader publicKey) {
try {
final BufferedReader br = new BufferedReader(publicKey);
try {
final String keydata = br.readLine();
if (keydata != null) {
String[] parts = keydata.trim().split(" ");
assert parts.length >= 2;
type = KeyType.fromString(parts[0]);
pubKey = new Buffer.PlainBuffer(Base64.decode(parts[1])).readPublicKey(); // << here AIOOBE
}
} finally {
br.close();
}
} catch (IOException e) {
// let super provide both public & private key
log.warn("Error reading public key: {}", e.toString());
}
}
```
IMHO the method needs to handle invalid user data in a different way than indicating a bug.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.