Added some more corrupt inputs - relates to github #1888

bcgit · Jan 11, 2025 · e404498 · e404498
1 parent 4c40f99
commit e404498
Show file tree

Hide file tree

Showing 2 changed files with 43 additions and 1 deletion.
diff --git a/pg/src/main/java/org/bouncycastle/gpg/SExpression.java b/pg/src/main/java/org/bouncycastle/gpg/SExpression.java
@@ -148,6 +148,11 @@ private static SExpression parseExpression(InputStream src, SExpression expr, By
 
                 if (accumulator.size() > 0)
                 {
+                    if (expr == null)
+                    {
+                        throw new IOException("invalid input stream");
+                    }
+
                     expr.addValue(Strings.fromByteArray(accumulator.toByteArray()));
                 }
 
@@ -168,11 +173,19 @@ private static SExpression parseExpression(InputStream src, SExpression expr, By
                 }
                 else if (c == '#')
                 {
+                    if (expr == null)
+                    {
+                        throw new IOException("invalid input stream at '#'");
+                    }
                     consumeUntilSkipWhiteSpace(src, accumulator, '#');
                     expr.addValue(Hex.decode(accumulator.toByteArray()));
                 }
                 else if (c == '"')
                 {
+                    if (expr == null)
+                    {
+                        throw new IOException("invalid input stream at '\"'");
+                    }
                     consumeUntilSkipCRorLF(src, accumulator, '"');
                     expr.addValue(new SExpression.QuotedString(Strings.fromByteArray(accumulator.toByteArray())));
                 }

diff --git a/pg/src/test/java/org/bouncycastle/openpgp/test/SExprTest.java b/pg/src/test/java/org/bouncycastle/openpgp/test/SExprTest.java
@@ -143,8 +143,17 @@ public String getName()
     }
 
     private void corruptStreamTest()
-        throws Exception
     {
+        try
+        {
+            SExpression.parse(new ByteArrayInputStream(Strings.toByteArray("12")), 2);
+            fail("no exception");
+        }
+        catch (IOException e)
+        {
+            isEquals("invalid input stream", e.getMessage());
+        }
+
         try
         {
             SExpression.parse(new ByteArrayInputStream(Strings.toByteArray("2:3abc")), 2);
@@ -154,6 +163,26 @@ private void corruptStreamTest()
         {
             isEquals("invalid input stream at ':'", e.getMessage());
         }
+
+        try
+        {
+            SExpression.parse(new ByteArrayInputStream(Strings.toByteArray("#3abc")), 2);
+            fail("no exception");
+        }
+        catch (IOException e)
+        {
+            isEquals(e.getMessage(), "invalid input stream at '#'", e.getMessage());
+        }
+
+        try
+        {
+            SExpression.parse(new ByteArrayInputStream(Strings.toByteArray("\"3abc")), 2);
+            fail("no exception");
+        }
+        catch (IOException e)
+        {
+            isEquals(e.getMessage(), "invalid input stream at '\"'", e.getMessage());
+        }
     }
 
     public void performTest()