[Bug 70162] New: Fix potential ArrayIndexOutOfBoundsException in JSONParser.generateParseException()

https://bz.apache.org/bugzilla/show_bug.cgi?id=3D70162

            Bug ID: 70162
           Summary: Fix potential ArrayIndexOutOfBoundsException in
                    JSONParser.generateParseException()
           Product: Tomcat 9
           Version: 9.0.x
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Util
          Assignee: [email protected]
          Reporter: [email protected]
  Target Milestone: -----

Created attachment 40203
  --> https://bz.apache.org/bugzilla/attachment.cgi?id=3D40203&action=3Dedit
Fix potential ArrayIndexOutOfBoundsException in JSONParser

The generateParseException() method in JSONParser.java contains a loop that
iterates over all 32 bits of an integer bitmask (jj_la1_0[i]) using `for (i=
nt j
=3D 0; j < 32; j++)`.=20

However, the `la1tokens` boolean array used to store the results is initial=
ized
with a size of 29 (the number of actual tokens in the grammar). If bits 29,=
 30,
or 31 are set in the bitmask, the code attempts to write to an index outside
the array bounds, causing an ArrayIndexOutOfBoundsException.

Since the grammar only defines 29 tokens, bits 29-31 should never represent
valid tokens. The loop boundary should match the actual token count to prev=
ent
the exception and ensure logical consistency with the subsequent read loop
(`for (int i =3D 0; i < 29; i++)`).

Proposed fix: Change the loop condition from `< 32` to `< 29`.

Found by Linux Verification Center (linuxtesting.org) with Svace.

--=20
You are receiving this mail because:
You are the assignee for the bug.=