fastjson JSONLexerBase中scanHex()方法有bug。当反序列化二进制数组,字符串为 bytes:"x''",会抛出异常

h43kikqp  于 22天前  发布在  其他
关注(0)|答案(1)|浏览(22)

fastjison原始代码

public final void scanHex() {
        if (ch != 'x') {
            throw new JSONException("illegal state. " + ch);
        }
        next();
        if (ch != '\'') {
            throw new JSONException("illegal state. " + ch);
        }
        np = bp;
        next(); //TODO 此处需要修复
        for (int i = 0;;++i) {
            char ch = next();
            if ((ch >= '0' && ch <= '9') || (ch >= 'A' && ch <= 'F')) {
                sp++;
                continue;
            } else if (ch == '\'') {
                sp++;
                next();
                break;
            } else {
                throw new JSONException("illegal state. " + ch);
            }
        }
        token = JSONToken.HEX;
    }

测试代码

public class Foo {
	public byte[] bytes;

        public static void main(String[] args) throws Exception {
              	Foo foo = new Foo();
		foo.bytes = new byte[0];
		String str = JSON.toJSONString(foo,SerializerFeature.WriteClassName);
		System.out.println(str);
		ParserConfig config = new ParserConfig();
		config.setAutoTypeSupport(true);
		foo = JSON.parseObject(str, Object.class,config);
		System.out.println(foo);
       }
}

结果如下

{"@type":"com.xxx.Foo","bytes":x''}
Exception in thread "main" com.alibaba.fastjson.JSONException: illegal state. }
	at com.alibaba.fastjson.parser.JSONLexerBase.scanHex(JSONLexerBase.java:4905)
	at com.alibaba.fastjson.parser.JSONLexerBase.nextToken(JSONLexerBase.java:203)
	at com.alibaba.fastjson.parser.JSONLexerBase.matchField(JSONLexerBase.java:1183)
	at com.alibaba.fastjson.parser.deserializer.FastjsonASMDeserializer_1_Foo.deserialze(Unknown Source)
	at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.deserialze(JavaBeanDeserializer.java:267)
	at com.alibaba.fastjson.parser.DefaultJSONParser.parseObject(DefaultJSONParser.java:384)
	at com.alibaba.fastjson.parser.DefaultJSONParser.parse(DefaultJSONParser.java:1356)
	at com.alibaba.fastjson.parser.deserializer.JavaObjectDeserializer.deserialze(JavaObjectDeserializer.java:45)
	at com.alibaba.fastjson.parser.DefaultJSONParser.parseObject(DefaultJSONParser.java:661)
	at com.alibaba.fastjson.JSON.parseObject(JSON.java:365)
	at com.alibaba.fastjson.JSON.parseObject(JSON.java:328)
	at com.xxx.Test.main(Test.java:67)

相关问题