OutOfMemoryError occurred when calling Utilities.splitIntoFramesg function

Comienza con com.google.firebase.database.utilities.Utilities.splitIntoFrames en Utilities.java:131 y reproduce el informe usando el PoC UtilitiesFuzzerSplitIntoFrames con la entrada "9." y un tamaño de frame de 0. Determina el comportamiento esperado para esta entrada y verifica que el comportamiento resultante ya no provoque el agotamiento del heap de Java.

OutOfMemoryError occurred when calling Utilities.splitIntoFramesg function

Description

An OutOfMemoryError vulnerability exists in the Utilities.splitIntoFrames method in firebase-admin 9.2.0.

Error Log

java.lang.OutOfMemoryError: Java heap space

	at java.base/java.lang.StringLatin1.newString(StringLatin1.java:715)
	at java.base/java.lang.String.substring(String.java:1879)
	at com.google.firebase.database.utilities.Utilities.splitIntoFrames(Utilities.java:131)
	at PoC.firebas_admin.UtilitiesFuzzerSplitIntoFrames.splitIntoFramesFuzzerTest(UtilitiesFuzzerSplitIntoFrames.java:9)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:59)
	at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
	at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:56)
	at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
	at org.junit.runners.ParentRunner$3.evaluate(ParentRunner.java:306)
	at org.junit.runners.BlockJUnit4ClassRunner$1.evaluate(BlockJUnit4ClassRunner.java:100)
	at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:366)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:103)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:63)
	at org.junit.runners.ParentRunner$4.run(ParentRunner.java:331)
	at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:79)
	at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:329)
	at org.junit.runners.ParentRunner.access$100(ParentRunner.java:66)
	at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:293)
	at org.junit.runners.ParentRunner$3.evaluate(ParentRunner.java:306)
	at org.junit.runners.ParentRunner.run(ParentRunner.java:413)
	at org.junit.runner.JUnitCore.run(JUnitCore.java:137)
	at com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:69)
	at com.intellij.rt.junit.IdeaTestRunner$Repeater$1.execute(IdeaTestRunner.java:38)
	at com.intellij.rt.execution.junit.TestsRepeater.repeat(TestsRepeater.java:11)
	at com.intellij.rt.junit.IdeaTestRunner$Repeater.startRunnerWithArgs(IdeaTestRunner.java:35)
	at com.intellij.rt.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:235)
	at com.intellij.rt.junit.JUnitStarter.main(JUnitStarter.java:54)

PoC

        <dependency>
            <groupId>com.google.firebase</groupId>
            <artifactId>firebase-admin</artifactId>
            <version>9.2.0</version>
        </dependency>

import org.junit.Test;
import com.google.firebase.database.utilities.*;
public class UtilitiesFuzzerSplitIntoFrames {
    @Test
    public void splitIntoFramesFuzzerTest() {
        try {
            String[] result = Utilities.splitIntoFrames("9.", 0);
        } catch (Exception e) {
        }
    }
}