[PATCH] OOM on bad input to new SshRsaPrivateKey(byte[])

Hi,

I was playing with public key authentication, and the following
code triggered an OOM in the JVM:

            PublicKeyAuthenticationClient keyAuthen = new PublicKeyAuthenticationClient();
            FileInputStream fis = new FileInputStream( new File( "/home/gc/.ssh/id_rsa" ) );
            SshPrivateKey key = new SshRsaPrivateKey( Format.inputStreamToBytes( fis ) );

(you'll easily guess what Format.inputStreamToBytes does).

I've tried that wrong API use because of the lack of javadoc in
the SshRsaPrivateKey class, before actually finding
examples/PublicKeyConnect.java. Anyway, a suggested easy way to
workaround this API misuse could be:

--- ./j2ssh/src/com/sshtools/j2ssh/io/ByteArrayReader.java	2007-04-28 21:02:54.000000000 +0200
+++ ./j2ssh/src/com/sshtools/j2ssh/io/ByteArrayReader.java	2008-01-21 09:14:50.000000000 +0100
@@ -160,6 +165,8 @@
      */
     public String readString() throws IOException {
         long len = readInt();
+        if (len > buf.length - pos)
+	    throw new IndexOutOfBoundsException();
         byte[] raw = new byte[(int) len];
         read(raw);

E.g. feeding wrong (or random) data would make the next line
potentially allocate a huge amount of memory. Fortunately, we
have a boundary here, let's use it :). OOM are usually a PIA
since there is not even a stacktrace in the exception: I had to
"printf" the source to track that, so I guess this kind of check
could not do much harm..

There are more similar places for such a check in
ByteArrayReader, I think, but for the moment that's just an
initial proposal.

-- 
Guillaume Cottenceau

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/