Merge branch '3.1' into 3.2

Author: cowtowncoder

release-notes/CREDITS

@@ -45,6 +45,12 @@ Rob Spoor (@robtimus)
  * Reported #1561: Javadoc for 3.1.0 doesn't work (build with JDK 21)
   (3.1.2)
 
+
+Revanth Meesala (@revanthmeesala)
+ * Contributed #1642: Fix maxDocumentLength bypass in async parser single-feedInput()
+   case [GHSA-2c4j-63jj-9fqr]
+  (3.1.6)
+
 seonwoojung (@seonwooj0810)
  * Contributed #707: Add `JsonReadFeature.ALLOW_HEXADECIMAL_NUMBERS`
    for JSON5-style hexadecimal integer literals

release-notes/CREDITS-2.x

@@ -530,3 +530,8 @@ Patrick Strawderman (@kilink)
  * Contributed #1622: `UTF8JsonGenerator.writeBinary()` should allocate buffer
   based on supplied length
   (2.23.0)
+
+Revanth Meesala (@revanthmeesala)
+ * Contributed #1642: Fix maxDocumentLength bypass in async parser single-feedInput()
+   case [GHSA-2c4j-63jj-9fqr]
+  (2.18.10)

release-notes/VERSION

@@ -19,6 +19,16 @@ JSON library.
 
 No changes since 3.2
 
+3.2.2 (not yet released)
+
+#1630: `UTF8StreamJsonParser.nextName()` ignores
+  `JsonReadFeature.ALLOW_LEADING_DECIMAL_POINT_FOR_NUMBERS`
+ (reported by @jng260)
+ (fix by @cowtowncoder, w/ Claude code)
+#1642: Fix maxDocumentLength bypass in async parser single-feedInput() case
+  [GHSA-2c4j-63jj-9fqr]
+ (fix by Revanth M)
+
 3.2.1 (10-Jul-2026)
 
 No changes since 3.2.0
@@ -53,6 +63,9 @@ No changes since 3.2.0
   `JsonReadFeature.ALLOW_LEADING_DECIMAL_POINT_FOR_NUMBERS`
  (reported by @jng260)
  (fix by @cowtowncoder, w/ Claude code)
+#1642: Fix maxDocumentLength bypass in async parser single-feedInput() case
+  [GHSA-2c4j-63jj-9fqr]
+ (fix by Revanth M)
 
 3.1.5 (07-Jul-2025)
 

release-notes/VERSION-2.x

@@ -157,6 +157,12 @@ No changes since 2.19.1
  (requested by Ilenia S)
  (fixed by @pjfanning)
 
+2.18.10 (not yet released)
+
+#1642: Fix maxDocumentLength bypass in async parser single-feedInput() case
+  [GHSA-2c4j-63jj-9fqr]
+ (fix by Revanth M)
+
 2.18.9 (07-Jul-2026)
 
 No changes since 2.18.8

src/main/java/tools/jackson/core/json/async/NonBlockingByteArrayJsonParser.java

@@ -34,23 +34,28 @@ public ByteArrayFeeder nonBlockingInputFeeder() {
     @Override
     public void feedInput(final byte[] buf, final int start, final int end) throws JacksonException
     {
-        // Must not have remaining input
-        if (_inputPtr < _inputEnd) {
-            _reportError("Still have %d undecoded bytes, should not call 'feedInput'", _inputEnd - _inputPtr);
-        }
         if (end < start) {
             _reportError("Input end (%d) may not be before start (%d)", end, start);
         }
         // and shouldn't have been marked as end-of-input
         if (_endOfInput) {
             _reportError("Already closed, cannot feed more input");
         }
+        // Must not have remaining input
+        if (_inputPtr < _inputEnd) {
+            _reportError("Still have %d undecoded bytes, should not call 'feedInput'", _inputEnd - _inputPtr);
+        }
+        // 06-Sep-2023, tatu: [core#1046] Enforce max doc length limit
+        // 17-Jul-2026, revanthm: [core#1642] Must include buffer being fed, not just
+        //    previously fed ones, so that a single feedInput() call carrying the
+        //    whole document is checked against its real length. Also: validate
+        //    before updating any state, to leave parser untouched if this throws
+        _streamReadConstraints.validateDocumentLength(
+                _currInputProcessed + _origBufferLen + (end - start));
+
         // Time to update pointers first
         _currInputProcessed += _origBufferLen;
 
-        // 06-Sep-2023, tatu: [core#1046] Enforce max doc length limit
-        _streamReadConstraints.validateDocumentLength(_currInputProcessed);
-
         // Also need to adjust row start, to work as if it extended into the past wrt new buffer
         _currInputRowStart = start - (_inputEnd - _currInputRowStart);
 

src/main/java/tools/jackson/core/json/async/NonBlockingByteBufferJsonParser.java

@@ -37,12 +37,8 @@ public NonBlockingInputFeeder nonBlockingInputFeeder() {
     }
 
     @Override
-    public void feedInput(final ByteBuffer byteBuffer) throws JacksonException {
-        // Must not have remaining input
-        if (_inputPtr < _inputEnd) {
-            _reportError("Still have %d undecoded bytes, should not call 'feedInput'", _inputEnd - _inputPtr);
-        }
-
+    public void feedInput(final ByteBuffer byteBuffer) throws JacksonException
+    {
         final int start = byteBuffer.position();
         final int end = byteBuffer.limit();
 
@@ -53,12 +49,21 @@ public void feedInput(final ByteBuffer byteBuffer) throws JacksonException {
         if (_endOfInput) {
             _reportError("Already closed, cannot feed more input");
         }
+        // Must not have remaining input
+        if (_inputPtr < _inputEnd) {
+            _reportError("Still have %d undecoded bytes, should not call 'feedInput'", _inputEnd - _inputPtr);
+        }
+        // 06-Sep-2023, tatu: [core#1046] Enforce max doc length limit
+        // 17-Jul-2026, revanthm: [core#1642] Must include buffer being fed, not just
+        //    previously fed ones, so that a single feedInput() call carrying the
+        //    whole document is checked against its real length. Also: validate
+        //    before updating any state, to leave parser untouched if this throws
+        _streamReadConstraints.validateDocumentLength(
+                _currInputProcessed + _origBufferLen + (end - start));
+
         // Time to update pointers first
         _currInputProcessed += _origBufferLen;
 
-        // 06-Sep-2023, tatu: [core#1046] Enforce max doc length limit
-        _streamReadConstraints.validateDocumentLength(_currInputProcessed);
-
         // Also need to adjust row start, to work as if it extended into the past wrt new buffer
         _currInputRowStart = start - (_inputEnd - _currInputRowStart);
 

src/test/java/tools/jackson/core/unittest/constraints/LargeDocReadTest.java

@@ -1,12 +1,17 @@
 package tools.jackson.core.unittest.constraints;
 
 import java.io.IOException;
+import java.nio.ByteBuffer;
+import java.util.Arrays;
 
 import org.junit.jupiter.api.Test;
 
 import tools.jackson.core.JsonParser;
+import tools.jackson.core.JsonToken;
 import tools.jackson.core.ObjectReadContext;
 import tools.jackson.core.StreamReadConstraints;
+import tools.jackson.core.async.ByteArrayFeeder;
+import tools.jackson.core.async.ByteBufferFeeder;
 import tools.jackson.core.exc.StreamConstraintsException;
 import tools.jackson.core.json.JsonFactory;
 import tools.jackson.core.unittest.async.AsyncTestBase;
@@ -108,6 +113,140 @@ void largeNameWithSmallLimitAsync() throws Exception
         }
     }
 
+    // [core#1642] maxDocumentLength must also be enforced when the caller feeds
+    // the whole document via a single feedInput() call (e.g. pre-buffered input),
+    // not just when input arrives split across multiple feedInput() calls.
+    @Test
+    void largeNameWithSmallLimitAsyncSingleFeed() throws Exception
+    {
+        final byte[] doc = utf8Bytes(generateJSON(12_000));
+
+        // first with byte[] backend: bytesPerRead >= doc.length so the whole
+        // document goes through in exactly one feedInput() call
+        try (AsyncReaderWrapper p = asyncForBytes(JSON_F_DOC_10K, doc.length, doc, 1)) {
+            consumeAsync(p);
+            fail("expected StreamConstraintsException");
+        } catch (StreamConstraintsException e) {
+            verifyMaxDocLen(JSON_F_DOC_10K, e);
+        }
+
+        // then with byte buffer backend, same single-call condition
+        try (AsyncReaderWrapper p = asyncForByteBuffer(JSON_F_DOC_10K, doc.length, doc, 1)) {
+            consumeAsync(p);
+            fail("expected StreamConstraintsException");
+        } catch (StreamConstraintsException e) {
+            verifyMaxDocLen(JSON_F_DOC_10K, e);
+        }
+    }
+
+    // [core#1642] Boundary check: a single feedInput() call carrying EXACTLY
+    // maxDocumentLength bytes must still parse successfully -- validateDocumentLength()
+    // rejects only len > maxDocumentLength, so the limit itself is inclusive.
+    // This pins down "bytes fed, not consumed" semantics and guards against a
+    // future off-by-one in the single-feed fix.
+    @Test
+    void largeNameWithSmallLimitAsyncSingleFeedAtBoundary() throws Exception
+    {
+        final long limit = JSON_F_DOC_10K.streamReadConstraints().getMaxDocumentLength();
+        final byte[] doc = utf8Bytes(generateExactLengthJSON((int) limit));
+        assertEquals(limit, doc.length);
+
+        // first with byte[] backend: bytesPerRead >= doc.length so the whole
+        // document goes through in exactly one feedInput() call
+        try (AsyncReaderWrapper p = asyncForBytes(JSON_F_DOC_10K, doc.length, doc, 1)) {
+            consumeAsync(p);
+        }
+
+        // then with byte buffer backend, same single-call condition
+        try (AsyncReaderWrapper p = asyncForByteBuffer(JSON_F_DOC_10K, doc.length, doc, 1)) {
+            consumeAsync(p);
+        }
+    }
+
+    // [core#1642] Same boundary, but reached across MANY feedInput() calls: bytes
+    // fed must accumulate to exactly maxDocumentLength and still parse, verifying
+    // the single-feed fix did not start double-counting incrementally fed buffers.
+    @Test
+    void largeNameWithSmallLimitAsyncMultiFeedAtBoundary() throws Exception
+    {
+        final long limit = JSON_F_DOC_10K.streamReadConstraints().getMaxDocumentLength();
+        final byte[] doc = utf8Bytes(generateExactLengthJSON((int) limit));
+        assertEquals(limit, doc.length);
+
+        // 1000 bytes per call, so exactly 10 feedInput() calls totalling the limit
+        try (AsyncReaderWrapper p = asyncForBytes(JSON_F_DOC_10K, 1000, doc, 1)) {
+            consumeAsync(p);
+        }
+        try (AsyncReaderWrapper p = asyncForByteBuffer(JSON_F_DOC_10K, 1000, doc, 1)) {
+            consumeAsync(p);
+        }
+    }
+
+    // [core#1642] A rejected feedInput() must not corrupt the running byte count:
+    // validation happens BEFORE any state is updated, so a caller that catches the
+    // StreamConstraintsException and keeps feeding still gets an accurate total
+    // (the rejected call's predecessor must not be counted twice).
+    @Test
+    void docLengthCountIntactAfterRejectedFeedBytes() throws Exception
+    {
+        try (JsonParser p = JSON_F_DOC_10K.createNonBlockingByteArrayParser(ObjectReadContext.empty())) {
+            final ByteArrayFeeder feeder = (ByteArrayFeeder) p.nonBlockingInputFeeder();
+
+            // 5000 fed, well under the 10000 limit
+            feeder.feedInput(whitespace(5000), 0, 5000);
+            assertToken(JsonToken.NOT_AVAILABLE, p.nextToken());
+
+            // would reach 11000: rejected, and must leave the count at 5000
+            try {
+                feeder.feedInput(whitespace(6000), 0, 6000);
+                fail("expected StreamConstraintsException");
+            } catch (StreamConstraintsException e) {
+                verifyMaxDocLen(JSON_F_DOC_10K, e);
+            }
+
+            // 5000 more == 10000 total: at the limit, so must still be accepted
+            feeder.feedInput(whitespace(5000), 0, 5000);
+            assertToken(JsonToken.NOT_AVAILABLE, p.nextToken());
+
+            // and one byte past it must report the true total, not an inflated one
+            try {
+                feeder.feedInput(whitespace(1), 0, 1);
+                fail("expected StreamConstraintsException");
+            } catch (StreamConstraintsException e) {
+                verifyException(e, "Document length (10001)");
+            }
+        }
+    }
+
+    // [core#1642] as above, for the ByteBuffer-backed parser
+    @Test
+    void docLengthCountIntactAfterRejectedFeedByteBuffer() throws Exception
+    {
+        try (JsonParser p = JSON_F_DOC_10K.createNonBlockingByteBufferParser(ObjectReadContext.empty())) {
+            final ByteBufferFeeder feeder = (ByteBufferFeeder) p.nonBlockingInputFeeder();
+
+            feeder.feedInput(ByteBuffer.wrap(whitespace(5000)));
+            assertToken(JsonToken.NOT_AVAILABLE, p.nextToken());
+
+            try {
+                feeder.feedInput(ByteBuffer.wrap(whitespace(6000)));
+                fail("expected StreamConstraintsException");
+            } catch (StreamConstraintsException e) {
+                verifyMaxDocLen(JSON_F_DOC_10K, e);
+            }
+
+            feeder.feedInput(ByteBuffer.wrap(whitespace(5000)));
+            assertToken(JsonToken.NOT_AVAILABLE, p.nextToken());
+
+            try {
+                feeder.feedInput(ByteBuffer.wrap(whitespace(1)));
+                fail("expected StreamConstraintsException");
+            } catch (StreamConstraintsException e) {
+                verifyException(e, "Document length (10001)");
+            }
+        }
+    }
+
     // [core#1575] DataInput with maxDocumentLength should enforce the limit
     @Test
     void dataInputWithDocLengthLimitEnforced() throws Exception
@@ -157,6 +296,31 @@ private void consumeAsync(AsyncReaderWrapper w) throws IOException {
         }
     }
 
+    // Builds a valid JSON array whose UTF-8 byte length is exactly {@code exactLen},
+    // using trailing whitespace padding before the closing bracket (all-ASCII content,
+    // so char length == byte length).
+    private String generateExactLengthJSON(final int exactLen) {
+        final StringBuilder sb = new StringBuilder();
+        sb.append('[');
+        while (sb.length() < exactLen - 10) {
+            sb.append("1,");
+        }
+        sb.append('1');
+        while (sb.length() < exactLen - 1) {
+            sb.append(' ');
+        }
+        sb.append(']');
+        return sb.toString();
+    }
+
+    // Content that is valid-but-tokenless, so buffers can be fed and fully consumed
+    // without producing tokens: lets tests exercise feedInput() accounting directly.
+    private byte[] whitespace(final int len) {
+        final byte[] b = new byte[len];
+        Arrays.fill(b, (byte) ' ');
+        return b;
+    }
+
     private String generateJSON(final int docLen) {
         final StringBuilder sb = new StringBuilder();
         sb.append("[");