reject oversized received array in pdf417 ErrorCorrection.decode (#2097)

2 files changed, 21 insertions, 0 deletions

diff --git a/core/src/main/java/com/google/zxing/pdf417/decoder/ec/ErrorCorrection.java b/core/src/main/java/com/google/zxing/pdf417/decoder/ec/ErrorCorrection.java
index 06bd06d82..a0b0a22a5 100644
--- a/core/src/main/java/com/google/zxing/pdf417/decoder/ec/ErrorCorrection.java
+++ b/core/src/main/java/com/google/zxing/pdf417/decoder/ec/ErrorCorrection.java
@@ -46,6 +46,12 @@ public final class ErrorCorrection {
                     int numECCodewords,
                     int[] erasures) throws ChecksumException {
 
+    if (received.length > field.getSize()) {
+      // A codeword cannot be longer than the field; otherwise erasure and error positions
+      // index past the exponent table in exp()/log().
+      throw ChecksumException.getChecksumInstance();
+    }
+
     ModulusPoly poly = new ModulusPoly(field, received);
     int[] S = new int[numECCodewords];
     boolean error = false;
diff --git a/core/src/test/java/com/google/zxing/pdf417/decoder/ec/ErrorCorrectionTestCase.java b/core/src/test/java/com/google/zxing/pdf417/decoder/ec/ErrorCorrectionTestCase.java
index 7af2ae815..cad628a4c 100644
--- a/core/src/test/java/com/google/zxing/pdf417/decoder/ec/ErrorCorrectionTestCase.java
+++ b/core/src/test/java/com/google/zxing/pdf417/decoder/ec/ErrorCorrectionTestCase.java
@@ -84,6 +84,21 @@ public final class ErrorCorrectionTestCase extends AbstractErrorCorrectionTestCa
     }
   }
 
+  @Test
+  public void testOversizedReceived() {
+    // A received array longer than the field would index past the exponent table
+    // during erasure handling; it must be rejected instead of throwing AIOOBE.
+    int[] received = new int[ModulusGF.PDF417_GF.getSize() + 1];
+    System.arraycopy(PDF417_TEST_WITH_EC, 0, received, 0, PDF417_TEST_WITH_EC.length);
+    received[10] = (received[10] + 1) % ModulusGF.PDF417_GF.getSize(); // force a non-zero syndrome
+    try {
+      ec.decode(received, ECC_BYTES, new int[] {0});
+      fail("Should not have decoded");
+    } catch (ChecksumException ce) {
+      // good
+    }
+  }
+
   private void checkDecode(int[] received) throws ChecksumException {
     checkDecode(received, new int[0]);
   }