Wrap possible NullPointerException (#125)

eclipse-collections/src/main/java/com/fasterxml/jackson/datatype/eclipsecollections/deser/map/PrimitiveKVHandler.java

@@ -70,6 +70,11 @@ public char key(DeserializationContext ctx, String key) throws JsonMappingExcept
 
         public char value(DeserializationContext ctx, JsonParser parser) throws IOException {
             String valueAsString = parser.getValueAsString();
+            if (valueAsString == null) {
+                ctx.reportInputMismatch(char.class,
+                        "Cannot convert a JSON Null into a char element of map");
+            }
+
             if (valueAsString.length() != 1) {
                 ctx.reportInputMismatch(char.class,
                                         "Cannot convert a JSON String of length %d into a char element of map",

eclipse-collections/src/test/java/com/fasterxml/jackson/datatype/eclipsecollections/Fuzz124_64629Test.java

@@ -0,0 +1,33 @@
+package com.fasterxml.jackson.datatype.eclipsecollections;
+
+import static org.junit.Assert.assertTrue;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+import org.eclipse.collections.api.map.primitive.MutableCharCharMap;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.exc.MismatchedInputException;
+
+/**
+ * Unit tests for verifying the fixes for OSS-Fuzz issues
+ * work as expected
+ * (see [datatypes-collections#124]).
+ */
+public class Fuzz124_64629Test extends ModuleTestBase
+{
+    private final ObjectMapper MAPPER = mapperWithModule();
+
+    @Test
+    public void testOSSFuzzIssue64629() throws Exception
+    {
+        // Invalid token {"x?":[x?]: where ? is not ascii characters
+        final char[] invalid = {123, 34, 824, 34, 58, 91, 120, 7, 93};
+
+        MismatchedInputException e = Assert.assertThrows(
+            MismatchedInputException.class,
+            () -> MAPPER.readValue(new String(invalid), MutableCharCharMap.class));
+        assertTrue(e.getMessage().contains("Cannot convert a JSON Null into a char element of map"));
+    }
+}

guava/src/main/java/com/fasterxml/jackson/datatype/guava/deser/GuavaImmutableCollectionDeserializer.java

@@ -64,11 +64,16 @@ protected T _deserializeContents(JsonParser p, DeserializationContext ctxt)
                     continue;
                 }
                 value = _resolveNullToValue(ctxt);
+                if (value == null) {
+                    ctxt.reportInputMismatch(valueDes,
+                            "Guava `ImmutableCollection`s cannot contain `null`s");
+                }
             } else if (typeDeser == null) {
                 value = valueDes.deserialize(p, ctxt);
             } else {
                 value = valueDes.deserializeWithType(p, ctxt, typeDeser);
             }
+
             builder.add(value);
         }
         // No class outside of the package will be able to subclass us,

guava/src/main/java/com/fasterxml/jackson/datatype/guava/deser/GuavaImmutableMapDeserializer.java

@@ -45,7 +45,7 @@ protected T _deserializeEntries(JsonParser p, DeserializationContext ctxt)
         ImmutableMap.Builder<Object, Object> builder = createBuilder();
         for (; p.getCurrentToken() == JsonToken.FIELD_NAME; p.nextToken()) {
             // Must point to field name now
-            String fieldName = p.getCurrentName();
+            String fieldName = p.currentName();
             Object key = (keyDes == null) ? fieldName : keyDes.deserializeKey(fieldName, ctxt);
             // And then the value...
             JsonToken t = p.nextToken();

guava/src/test/java/com/fasterxml/jackson/datatype/guava/fuzz/Fuzz124_64610Test.java

@@ -0,0 +1,32 @@
+package com.fasterxml.jackson.datatype.guava.fuzz;
+
+import static org.junit.Assert.assertTrue;
+
+import org.junit.Assert;
+
+import com.fasterxml.jackson.core.type.TypeReference;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.exc.MismatchedInputException;
+import com.fasterxml.jackson.datatype.guava.ModuleTestBase;
+
+import com.google.common.collect.ImmutableSortedMultiset;
+
+/**
+ * Unit tests for verifying the fixes for OSS-Fuzz issues
+ * work as expected
+ * (see [datatypes-collections#124]).
+ */
+public class Fuzz124_64610Test extends ModuleTestBase
+{
+    private final ObjectMapper MAPPER = mapperWithModule();
+
+    public void testOSSFuzzIssue64610() throws Exception
+    {
+        final TypeReference<?> ref = new TypeReference<ImmutableSortedMultiset<String>>() {};
+        MismatchedInputException e = Assert.assertThrows(
+                MismatchedInputException.class,
+            () ->  MAPPER.readValue("[null]", ref));
+        assertTrue(e.getMessage().contains("Guava `ImmutableCollection`s cannot contain `null`s"));
+    }
+}

release-notes/CREDITS-2.x

@@ -114,6 +114,11 @@ Ethan McCue (@bowbahdoe)
   * Reported #122: PCollections module info (`module-info.class`) incorrect
    (2.15.4)
 
-Wolff Bock von Wülfingen (wlfbck@github)
+Wolff Bock von Wülfingen (@wlfbck)
   * Reported #90: Cache Serialization serializes empty contents
    (2.16.0)
+
+Arthur Chan (@arthurscchan)
+  * Contributed #124: Some deserializers throw unexpected `NullPointerException`
+    when handling invalid input
+   (2.17.0)

release-notes/VERSION-2.x

@@ -18,7 +18,9 @@ Active Maintainers:
 
 2.17.0 (not yet released)
 
--
+#124: Some deserializers throw unexpected `NullPointerException` when
+  handling invalid input
+ (contibuted by Arthur C)
 
 2.16.0 (15-Nov-2023)