Fix #540

Author: cowtowncoder

release-notes/CREDITS-2.x

@@ -163,3 +163,8 @@ Alexander Eyers-Taylor (aeyerstaylor@github)
 Henrik Gustafsson (gsson@github)
   * Reported #516: _inputPtr off-by-one in UTF8StreamJsonParser._parseNumber2()
   (2.9.9)
+
+Alex Rebert (alpire@github)
+  * Reported #540, suggested fix: UTF8StreamJsonParser: fix byte to int conversion for
+    malformed escapes
+  (2.9.10)

release-notes/VERSION-2.x

@@ -14,6 +14,11 @@ JSON library.
 === Releases ===
 ------------------------------------------------------------------------
 
+2.9.10 (not yet released)
+
+#540: UTF8StreamJsonParser: fix byte to int conversion for malformed escapes
+ (Alex R)
+
 2.9.9 (16-May-2019)
 
 #516: _inputPtr off-by-one in UTF8StreamJsonParser._parseNumber2()

src/main/java/com/fasterxml/jackson/core/json/UTF8StreamJsonParser.java

@@ -3257,7 +3257,7 @@ protected char _decodeEscaped() throws IOException
                     _reportInvalidEOF(" in character escape sequence", JsonToken.VALUE_STRING);
                 }
             }
-            int ch = (int) _inputBuffer[_inputPtr++];
+            int ch = _inputBuffer[_inputPtr++] & 0xFF;
             int digit = CharTypes.charToHex(ch);
             if (digit < 0) {
                 _reportUnexpectedChar(ch, "expected a hex-digit for character escape sequence");

src/test/java/com/fasterxml/jackson/core/json/TestCharEscaping.java

@@ -38,6 +38,8 @@ public SerializableString getEscapeSequence(int ch) {
     /**********************************************************
       */
 
+    private final static JsonFactory JSON_F = new JsonFactory();
+
     public void testMissingEscaping()
         throws Exception
     {
@@ -150,15 +152,28 @@ public void testWriteLongCustomEscapes() throws Exception
         jgen.close();
     }
 
-    // [Issue#116]
+    // [core#116]
     public void testEscapesForCharArrays() throws Exception {
-        JsonFactory jf = new JsonFactory();
         StringWriter writer = new StringWriter();
-        JsonGenerator jgen = jf.createGenerator(writer);
+        JsonGenerator jgen = JSON_F.createGenerator(writer);
         // must call #writeString(char[],int,int) and not #writeString(String)
         jgen.writeString(new char[] { '\0' }, 0, 1);
         jgen.close();
         assertEquals("\"\\u0000\"", writer.toString());
     }
+
+    // [core#540]
+    public void testInvalidEscape() throws Exception {
+        JsonParser p = JSON_F.createParser(quote("\\u\u0080...").getBytes("UTF-8"));
+        assertToken(JsonToken.VALUE_STRING, p.nextToken());
+        // this is where we should get proper exception
+        try {
+            p.getText();
+            fail("Should not pass");
+        } catch (JsonParseException e) {
+            verifyException(e, "Unexpected character");
+        }
+        p.close();
+    }
 }