Re: Bug Report: Stack buffer overflow in libparser/java.c

Hello,
I have confirmed the bug and will add it to the bug list and I will
definitely fix it.
Thank you!

Regards,
Shigio

On Wed, Oct 22, 2025 at 10:41=E2=80=AFAM Tim Becker <[email protected]> wr=
ote:
>
> In libparser/java.c, there is a fixed-size buffer which is filled with po=
tentially unbounded-length data due to multiple layers of nesting.
>
> Specifically, an out-of-bounds write to completename can occur due to unc=
hecked concatenation of nested class names and separators in the '{' handle=
r. At lines ~91=E2=80=93106, p points into completename and is advanced via=
 '*p++ =3D '.';' and 'while (*q) *p++ =3D *q++;' with no bounds checking. W=
ith enough nesting or long class names, p exceeds the 1024-byte buffer.
>
> Note: each name component is limited to 511 characters, but there is no l=
imit on the number of components.
>
> A fix to safely support arbitrary depths should switch to using a heap bu=
ffer which is reallocated as needed to fit the current name.
>
> Note: this bug was found by Theori's Xint Code analysis.
>
> Thanks,
> Tim Becker
> Theori



--=20
Shigio YAMAGUCHI <[email protected]>
PGP fingerprint:
26F6 31B4 3D62 4A92 7E6F  1C33 969C 3BE3 89DD A6EB