Skip to content

Validate JSON matrix dimensions#1744

Merged
kevinherron merged 2 commits into
eclipse-milo:mainfrom
kevinherron:codex/fix-json-matrix-dimensions-vulnerability
May 17, 2026
Merged

Validate JSON matrix dimensions#1744
kevinherron merged 2 commits into
eclipse-milo:mainfrom
kevinherron:codex/fix-json-matrix-dimensions-vulnerability

Conversation

@kevinherron
Copy link
Copy Markdown
Contributor

Motivation

  • The JSON decoder accepted attacker-controlled Dimensions arrays and constructed Matrix objects without validating dimensions, which could lead to uncontrolled allocations and an OutOfMemoryError (DoS).
  • The binary decoder performed per-dimension and total-length checks but the JSON decoder lacked equivalent validation for the flat Array + Dimensions representation introduced for compact JSON matrices.

Description

  • Add a new validateMatrixDimensions(Object flatArray, int[] dimensions) helper in OpcUaJsonDecoder that rejects missing Array/Dimensions, negative dimensions, per-dimension sizes exceeding EncodingLimits.getMaxMessageSize(), overflow/over-limit products, and mismatched product vs flat array length.
  • Call validateMatrixDimensions(...) in all JSON matrix construction paths: the Variant multi-dimensional array path, decodeMatrix(...), and decodeStructMatrix(...).
  • Add unit tests to OpcUaJsonDecoderTest that assert oversized, negative, and mismatched Dimensions are rejected for Variant, built-in Matrix, and structured Matrix decoding.

Codex Task

@kevinherron kevinherron reopened this May 17, 2026
@kevinherron kevinherron added this to the 1.1.4 milestone May 17, 2026
@kevinherron kevinherron merged commit b2abf4c into eclipse-milo:main May 17, 2026
4 of 5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant