From 6a6a2bd34684bfb03b562654cf2d460273803f3d Mon Sep 17 00:00:00 2001
From: ATKasem <ATKasem@users.noreply.github.com>
Date: Mon, 13 Jul 2026 15:46:29 -0500
Subject: [PATCH] Throw JsonSyntaxException for null map keys in array form

When deserializing array-encoded map entries, a JSON null key was passed
through to LinkedTreeMap and surfaced as an unchecked NullPointerException.
Reject null keys at the adapter boundary so malformed input stays within
Gson's JsonParseException contract.

Fixes #3037
---
 .../google/gson/internal/bind/MapTypeAdapterFactory.java | 6 ++++++
 .../gson/functional/MapAsArrayTypeAdapterTest.java       | 9 +++++++++
 2 files changed, 15 insertions(+)

diff --git a/gson/src/main/java/com/google/gson/internal/bind/MapTypeAdapterFactory.java b/gson/src/main/java/com/google/gson/internal/bind/MapTypeAdapterFactory.java
index a72bb48cc1..3f7b46b4b5 100644
--- a/gson/src/main/java/com/google/gson/internal/bind/MapTypeAdapterFactory.java
+++ b/gson/src/main/java/com/google/gson/internal/bind/MapTypeAdapterFactory.java
@@ -187,6 +187,9 @@ public Map<K, V> read(JsonReader in) throws IOException {
         while (in.hasNext()) {
           in.beginArray(); // entry array
           K key = keyTypeAdapter.read(in);
+          if (key == null) {
+            throw new JsonSyntaxException("Map key is null");
+          }
           V value = valueTypeAdapter.read(in);
           if (map.containsKey(key)) {
             throw new JsonSyntaxException("duplicate key: " + key);
@@ -200,6 +203,9 @@ public Map<K, V> read(JsonReader in) throws IOException {
         while (in.hasNext()) {
           JsonReaderInternalAccess.INSTANCE.promoteNameToValue(in);
           K key = keyTypeAdapter.read(in);
+          if (key == null) {
+            throw new JsonSyntaxException("Map key is null");
+          }
           V value = valueTypeAdapter.read(in);
           if (map.containsKey(key)) {
             throw new JsonSyntaxException("duplicate key: " + key);
diff --git a/gson/src/test/java/com/google/gson/functional/MapAsArrayTypeAdapterTest.java b/gson/src/test/java/com/google/gson/functional/MapAsArrayTypeAdapterTest.java
index 75f4dd5020..f6d21f0928 100644
--- a/gson/src/test/java/com/google/gson/functional/MapAsArrayTypeAdapterTest.java
+++ b/gson/src/test/java/com/google/gson/functional/MapAsArrayTypeAdapterTest.java
@@ -90,6 +90,15 @@ public void testDuplicateKeyWithNullFirstValueArrayForm() {
     assertThat(e).hasMessageThat().isEqualTo("duplicate key: a");
   }
 
+  @Test
+  public void testNullKeyArrayForm() {
+    Gson gson = new Gson();
+    Type type = new TypeToken<Map<String, Object>>() {}.getType();
+    JsonSyntaxException e =
+        assertThrows(JsonSyntaxException.class, () -> gson.fromJson("[[null,1]]", type));
+    assertThat(e).hasMessageThat().isEqualTo("Map key is null");
+  }
+
   @Test
   public void testMultipleEnableComplexKeyRegistrationHasNoEffect() {
     Type type = new TypeToken<Map<Point, String>>() {}.getType();