Merge branch '2.20' into 2.21

Author: cowtowncoder

release-notes/CREDITS-2.x

@@ -488,6 +488,11 @@ Revanth Meesala (@revanthmeesala)
    case [GHSA-2c4j-63jj-9fqr]
   (2.18.10)
 
+@tinyb0y
+ * Contributed #1643: Enforce maxNameLength incrementally in ReaderBasedJsonParser
+   [GHSA-649p-m576-vr99]
+  (2.18.10)
+
 Yanming Zhou (@quaff)
  * Requested #633: Allow skipping `RS` CTRL-CHAR to support JSON Text Sequences
   (2.19.0)

release-notes/VERSION-2.x

@@ -156,6 +156,8 @@ No changes since 2.19.1
 #1642: Fix maxDocumentLength bypass in async parser single-feedInput() case
   [GHSA-2c4j-63jj-9fqr]
  (fix by Revanth M)
+#1643: Enforce maxNameLength incrementally in ReaderBasedJsonParser [GHSA-649p-m576-vr99]
+ (fix by @tinyb0y)
 
 2.18.9 (07-Jul-2026)
 

src/main/java/com/fasterxml/jackson/core/json/ReaderBasedJsonParser.java

@@ -1841,6 +1841,15 @@ private String _parseName2(int startPtr, int hash, int endChar) throws IOExcepti
          */
         char[] outBuf = _textBuffer.getCurrentSegment();
         int outPtr = _textBuffer.getCurrentSegmentSize();
+        // 28-Jul-2026, tinyb0y: [core#1643] Track total length accumulated so far so we
+        //   can validate against `maxNameLength` incrementally, same as byte-based
+        //   parsers already do via `ParserBase._growNameDecodeBuffer()`. Without this,
+        //   only the much larger `maxStringLength` bound (enforced inside
+        //   `TextBuffer.finishCurrentSegment()`) applies until the whole name has
+        //   already been buffered.
+        //   Note: only updated when segment gets full (at which point `outPtr` is
+        //   always exactly `outBuf.length`), to keep the per-character loop tight.
+        int totalLen = 0;
 
         while (true) {
             if (_inputPtr >= _inputEnd) {
@@ -1872,6 +1881,8 @@ private String _parseName2(int startPtr, int hash, int endChar) throws IOExcepti
 
             // Need more room?
             if (outPtr >= outBuf.length) {
+                totalLen += outBuf.length;
+                _streamReadConstraints.validateNameLength(totalLen);
                 outBuf = _textBuffer.finishCurrentSegment();
                 outPtr = 0;
             }
@@ -2102,6 +2113,9 @@ private String _handleOddName2(int startPtr, int hash, int[] codes) throws IOExc
         char[] outBuf = _textBuffer.getCurrentSegment();
         int outPtr = _textBuffer.getCurrentSegmentSize();
         final int maxCode = codes.length;
+        // 28-Jul-2026, tinyb0y: [core#1643] Same incremental `maxNameLength` check as
+        //   `_parseName2()` needs to apply to unquoted ("odd") names as well
+        int totalLen = 0;
 
         while (true) {
             if (_inputPtr >= _inputEnd) {
@@ -2125,6 +2139,8 @@ private String _handleOddName2(int startPtr, int hash, int[] codes) throws IOExc
 
             // Need more room?
             if (outPtr >= outBuf.length) {
+                totalLen += outBuf.length;
+                _streamReadConstraints.validateNameLength(totalLen);
                 outBuf = _textBuffer.finishCurrentSegment();
                 outPtr = 0;
             }

src/test/java/com/fasterxml/jackson/core/constraints/LargeNameReadTest.java

@@ -1,11 +1,14 @@
 package com.fasterxml.jackson.core.constraints;
 
 import java.io.IOException;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 import org.junit.jupiter.api.Test;
 
 import com.fasterxml.jackson.core.*;
 import com.fasterxml.jackson.core.exc.StreamConstraintsException;
+import com.fasterxml.jackson.core.json.JsonReadFeature;
 import com.fasterxml.jackson.core.json.async.NonBlockingJsonParser;
 
 import static org.junit.jupiter.api.Assertions.fail;
@@ -25,6 +28,13 @@ class LargeNameReadTest extends JUnit5TestBase
                 .maxNameLength(100).build());
     }
 
+    // Factory that also allows non-standard name flavors ("apostrophe" and unquoted)
+    private final JsonFactory JSON_F_NAME_100_ODD = JsonFactory.builder()
+            .streamReadConstraints(StreamReadConstraints.builder().maxNameLength(100).build())
+            .configure(JsonReadFeature.ALLOW_SINGLE_QUOTES, true)
+            .configure(JsonReadFeature.ALLOW_UNQUOTED_FIELD_NAMES, true)
+            .build();
+
     // Test name that is below default max name
     @Test
     void largeNameBytes() throws Exception {
@@ -76,6 +86,56 @@ private void _testLargeNameWithSmallLimitChars(JsonFactory jf) throws Exception
         }
     }
 
+    // [core#1643]: Reader-backed parser must reject an over-limit name promptly, the
+    // same way byte-based input already does -- not only once the entire (possibly
+    // huge) name has already been buffered.
+    // (note: `String` / `char[]` input is not affected the same way, since the whole
+    // document is already in memory and gets scanned in-place, without buffering)
+    @Test
+    void largeNameWithSmallLimitCharsFailsFast() throws Exception {
+        // Name much larger than the configured limit: without incremental checking
+        // the whole name gets buffered (bounded only by much bigger `maxStringLength`)
+        // before failing, whereas the fix must reject within a segment fill or two.
+        _testLargeNameFailsFast(JSON_F_NAME_100, "\"");
+        _testLargeNameFailsFast(JSON_F_NAME_100_B, "\"");
+    }
+
+    // [core#1643]: ... and same goes for the non-standard name flavors, which are
+    // decoded by different code paths ("apostrophe" and unquoted names)
+    @Test
+    void largeOddNameWithSmallLimitCharsFailsFast() throws Exception {
+        _testLargeNameFailsFast(JSON_F_NAME_100_ODD, "'");
+        _testLargeNameFailsFast(JSON_F_NAME_100_ODD, "");
+    }
+
+    private void _testLargeNameFailsFast(JsonFactory jf, String nameQuote) throws Exception
+    {
+        final int nameLen = 1_000_000;
+        final String doc = generateJSON(nameLen, nameQuote);
+        try (JsonParser p = createParserUsingReader(jf, doc)) {
+            consumeTokens(p);
+            fail("expected StreamConstraintsException");
+        } catch (StreamConstraintsException e) {
+            verifyException(e, "Name length");
+            // Length the exception reports tells us how much had been accumulated
+            // before the check fired: needs to be small fraction of the whole name
+            final int reportedLen = _reportedNameLength(e);
+            final int maxExpected = nameLen >> 4;
+            if (reportedLen > maxExpected) {
+                fail("Should have failed before buffering "+maxExpected
+                        +" chars (limit is 100), but reported length was: "+reportedLen);
+            }
+        }
+    }
+
+    private int _reportedNameLength(StreamConstraintsException e) {
+        Matcher m = Pattern.compile("Name length \\((\\d+)\\)").matcher(e.getMessage());
+        if (!m.find()) {
+            fail("Could not find reported name length from message: "+e.getMessage());
+        }
+        return Integer.parseInt(m.group(1));
+    }
+
     @Test
     void largeNameWithSmallLimitAsync() throws Exception
     {
@@ -115,12 +175,17 @@ private void consumeTokens(JsonParser p) throws IOException {
     }
 
     private String generateJSON(final int nameLen) {
+        return generateJSON(nameLen, "\"");
+    }
+
+    // @param nameQuote Quote character to use around name; empty String for unquoted name
+    private String generateJSON(final int nameLen, final String nameQuote) {
         final StringBuilder sb = new StringBuilder();
-        sb.append("{\"");
+        sb.append("{").append(nameQuote);
         for (int i = 0; i < nameLen; i++) {
             sb.append("a");
         }
-        sb.append("\":\"value\"}");
+        sb.append(nameQuote).append(":\"value\"}");
         return sb.toString();
     }
 }