Merge branch '2.17'

eclipse-collections/src/test/java/tools/jackson/datatype/eclipsecollections/Fuzz124_64629Test.java

@@ -0,0 +1,33 @@
+package tools.jackson.datatype.eclipsecollections;
+
+import static org.junit.Assert.assertTrue;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+import org.eclipse.collections.api.map.primitive.MutableCharCharMap;
+
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.exc.MismatchedInputException;
+
+/**
+ * Unit tests for verifying the fixes for OSS-Fuzz issues
+ * work as expected
+ * (see [datatypes-collections#124]).
+ */
+public class Fuzz124_64629Test extends ModuleTestBase
+{
+    private final ObjectMapper MAPPER = mapperWithModule();
+
+    @Test
+    public void testOSSFuzzIssue64629() throws Exception
+    {
+        // Invalid token {"x?":[x?]: where ? is not ascii characters
+        final char[] invalid = {123, 34, 824, 34, 58, 91, 120, 7, 93};
+
+        MismatchedInputException e = Assert.assertThrows(
+            MismatchedInputException.class,
+            () -> MAPPER.readValue(new String(invalid), MutableCharCharMap.class));
+        assertTrue(e.getMessage().contains("Cannot convert a JSON Null into a char element of map"));
+    }
+}

guava/src/main/java/tools/jackson/datatype/guava/deser/GuavaImmutableCollectionDeserializer.java

@@ -61,11 +61,16 @@ protected T _deserializeContents(JsonParser p, DeserializationContext ctxt)
                     continue;
                 }
                 value = _resolveNullToValue(ctxt);
+                if (value == null) {
+                    ctxt.reportInputMismatch(valueDes,
+                            "Guava `ImmutableCollection`s cannot contain `null`s");
+                }
             } else if (typeDeser == null) {
                 value = valueDes.deserialize(p, ctxt);
             } else {
                 value = valueDes.deserializeWithType(p, ctxt, typeDeser);
             }
+
             builder.add(value);
         }
         // No class outside of the package will be able to subclass us,

guava/src/test/java/tools/jackson/datatype/guava/fuzz/Fuzz124_64610Test.java

@@ -0,0 +1,30 @@
+package tools.jackson.datatype.guava.fuzz;
+
+import org.junit.Assert;
+
+import tools.jackson.core.type.TypeReference;
+
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.exc.MismatchedInputException;
+import tools.jackson.datatype.guava.ModuleTestBase;
+
+import com.google.common.collect.ImmutableSortedMultiset;
+
+/**
+ * Unit tests for verifying the fixes for OSS-Fuzz issues
+ * work as expected
+ * (see [datatypes-collections#124]).
+ */
+public class Fuzz124_64610Test extends ModuleTestBase
+{
+    private final ObjectMapper MAPPER = mapperWithModule();
+
+    public void testOSSFuzzIssue64610() throws Exception
+    {
+        final TypeReference<?> ref = new TypeReference<ImmutableSortedMultiset<String>>() {};
+        MismatchedInputException e = Assert.assertThrows(
+                MismatchedInputException.class,
+            () ->  MAPPER.readValue("[null]", ref));
+        assertTrue(e.getMessage().contains("Guava `ImmutableCollection`s cannot contain `null`s"));
+    }
+}

primitive-collections-base/src/main/java/tools/jackson/datatype/primitive_collections_base/deser/map/PrimitiveKVHandler.java

@@ -72,6 +72,11 @@ public char key(DeserializationContext ctx, String key)
 
         public char value(DeserializationContext ctx, JsonParser parser) throws JacksonException {
             String valueAsString = parser.getValueAsString();
+            if (valueAsString == null) {
+                ctx.reportInputMismatch(char.class,
+                        "Cannot convert a JSON Null into a char element of map");
+            }
+
             if (valueAsString.length() != 1) {
                 ctx.reportInputMismatch(char.class,
                                         "Cannot convert a JSON String of length %d into a char element of map",

release-notes/CREDITS-2.x

@@ -114,6 +114,11 @@ Ethan McCue (@bowbahdoe)
   * Reported #122: PCollections module info (`module-info.class`) incorrect
    (2.15.4)
 
-Wolff Bock von Wülfingen (wlfbck@github)
+Wolff Bock von Wülfingen (@wlfbck)
   * Reported #90: Cache Serialization serializes empty contents
    (2.16.0)
+
+Arthur Chan (@arthurscchan)
+  * Contributed #124: Some deserializers throw unexpected `NullPointerException`
+    when handling invalid input
+   (2.17.0)

release-notes/VERSION-2.x

@@ -18,7 +18,9 @@ Active Maintainers:
 
 2.17.0 (not yet released)
 
--
+#124: Some deserializers throw unexpected `NullPointerException` when
+  handling invalid input
+ (contibuted by Arthur C)
 
 2.16.0 (15-Nov-2023)