OutOfMemoryError occurred when calling Utilities.splitIntoFramesg function

Commencez par com.google.firebase.database.utilities.Utilities.splitIntoFrames dans Utilities.java:131 et reproduisez le rapport à l’aide du PoC UtilitiesFuzzerSplitIntoFrames avec l’entrée "9." et une taille de frame de 0. Déterminez le comportement attendu pour cette entrée et vérifiez que le comportement obtenu ne provoque plus l’épuisement du tas Java.

OutOfMemoryError occurred when calling Utilities.splitIntoFramesg function

Description

An OutOfMemoryError vulnerability exists in the Utilities.splitIntoFrames method in firebase-admin 9.2.0.

Error Log

java.lang.OutOfMemoryError: Java heap space

	at java.base/java.lang.StringLatin1.newString(StringLatin1.java:715)
	at java.base/java.lang.String.substring(String.java:1879)
	at com.google.firebase.database.utilities.Utilities.splitIntoFrames(Utilities.java:131)
	at PoC.firebas_admin.UtilitiesFuzzerSplitIntoFrames.splitIntoFramesFuzzerTest(UtilitiesFuzzerSplitIntoFrames.java:9)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:59)
	at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
	at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:56)
	at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
	at org.junit.runners.ParentRunner$3.evaluate(ParentRunner.java:306)
	at org.junit.runners.BlockJUnit4ClassRunner$1.evaluate(BlockJUnit4ClassRunner.java:100)
	at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:366)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:103)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:63)
	at org.junit.runners.ParentRunner$4.run(ParentRunner.java:331)
	at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:79)
	at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:329)
	at org.junit.runners.ParentRunner.access$100(ParentRunner.java:66)
	at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:293)
	at org.junit.runners.ParentRunner$3.evaluate(ParentRunner.java:306)
	at org.junit.runners.ParentRunner.run(ParentRunner.java:413)
	at org.junit.runner.JUnitCore.run(JUnitCore.java:137)
	at com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:69)
	at com.intellij.rt.junit.IdeaTestRunner$Repeater$1.execute(IdeaTestRunner.java:38)
	at com.intellij.rt.execution.junit.TestsRepeater.repeat(TestsRepeater.java:11)
	at com.intellij.rt.junit.IdeaTestRunner$Repeater.startRunnerWithArgs(IdeaTestRunner.java:35)
	at com.intellij.rt.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:235)
	at com.intellij.rt.junit.JUnitStarter.main(JUnitStarter.java:54)

PoC

        <dependency>
            <groupId>com.google.firebase</groupId>
            <artifactId>firebase-admin</artifactId>
            <version>9.2.0</version>
        </dependency>

import org.junit.Test;
import com.google.firebase.database.utilities.*;
public class UtilitiesFuzzerSplitIntoFrames {
    @Test
    public void splitIntoFramesFuzzerTest() {
        try {
            String[] result = Utilities.splitIntoFrames("9.", 0);
        } catch (Exception e) {
        }
    }
}