Improved error handling of broken databases.

Previously we Java was throwing IllegalArgumentExceptions when we
tried to use an invalid pointer. Also added size checks for booleans,
floats, and doubles.

Author: oschwald

src/main/java/com/maxmind/maxminddb/Decoder.java

@@ -81,6 +81,11 @@ void setOffset(int offset) {
 
     Result decode(int offset) throws IOException {
         ByteBuffer buffer = this.threadBuffer.get();
+        if (offset >= buffer.capacity()) {
+            throw new InvalidDatabaseException(
+                    "The MaxMind DB file's data section contains bad data: "
+                            + "pointer larger than the database.");
+        }
 
         buffer.position(offset);
         int ctrlByte = 0xFF & buffer.get();
@@ -142,9 +147,9 @@ private Result decodeByType(Type type, int offset, int size)
                 TextNode s = new TextNode(this.decodeString(size));
                 return new Result(s, newOffset);
             case DOUBLE:
-                return new Result(this.decodeDouble(), newOffset);
+                return new Result(this.decodeDouble(size), newOffset);
             case FLOAT:
-                return new Result(this.decodeFloat(), newOffset);
+                return new Result(this.decodeFloat(size), newOffset);
             case BYTES:
                 BinaryNode b = new BinaryNode(this.getByteArray(size));
                 return new Result(b, newOffset);
@@ -231,16 +236,36 @@ private BigIntegerNode decodeBigInteger(int size) {
         return new BigIntegerNode(new BigInteger(1, bytes));
     }
 
-    private DoubleNode decodeDouble() {
+    private DoubleNode decodeDouble(int size) throws InvalidDatabaseException {
+        if (size != 8) {
+            throw new InvalidDatabaseException(
+                    "The MaxMind DB file's data section contains bad data: "
+                            + "invalid size of double.");
+        }
         return new DoubleNode(this.threadBuffer.get().getDouble());
     }
 
-    private FloatNode decodeFloat() {
+    private FloatNode decodeFloat(int size) throws InvalidDatabaseException {
+        if (size != 4) {
+            throw new InvalidDatabaseException(
+                    "The MaxMind DB file's data section contains bad data: "
+                            + "invalid size of float.");
+        }
         return new FloatNode(this.threadBuffer.get().getFloat());
     }
 
-    private static BooleanNode decodeBoolean(int size) {
-        return size == 0 ? BooleanNode.FALSE : BooleanNode.TRUE;
+    private static BooleanNode decodeBoolean(int size)
+            throws InvalidDatabaseException {
+        switch (size) {
+            case 0:
+                return BooleanNode.FALSE;
+            case 1:
+                return BooleanNode.TRUE;
+            default:
+                throw new InvalidDatabaseException(
+                        "The MaxMind DB file's data section contains bad data: "
+                                + "invalid size of boolean.");
+        }
     }
 
     private Result decodeArray(int size, int offset) throws IOException {

src/main/java/com/maxmind/maxminddb/MaxMindDbReader.java

@@ -176,6 +176,12 @@ private JsonNode resolveDataPointer(int pointer) throws IOException {
         int resolved = (pointer - this.metadata.nodeCount)
                 + this.metadata.searchTreeSize;
 
+        if (resolved >= this.threadBuffer.get().capacity()) {
+            throw new InvalidDatabaseException(
+                    "The MaxMind DB file's search tree is corrupt: "
+                            + "contains pointer larger than the database.");
+        }
+
         // We only want the data from the decoder, not the offset where it was
         // found.
         return this.decoder.decode(resolved).getNode();

src/test/java/com/maxmind/maxminddb/ReaderTest.java

@@ -1,5 +1,6 @@
 package com.maxmind.maxminddb;
 
+import static org.hamcrest.CoreMatchers.containsString;
 import static org.junit.Assert.assertArrayEquals;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNull;
@@ -11,10 +12,13 @@
 import java.net.InetAddress;
 import java.net.URI;
 import java.net.URISyntaxException;
+import java.net.UnknownHostException;
 import java.util.HashMap;
 import java.util.Map;
 
+import org.junit.Rule;
 import org.junit.Test;
+import org.junit.rules.ExpectedException;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -138,6 +142,59 @@ public void testZeros() throws URISyntaxException, IOException {
         assertEquals(BigInteger.ZERO, record.get("uint128").bigIntegerValue());
     }
 
+    @Rule
+    public ExpectedException thrown = ExpectedException.none();
+
+    @Test
+    public void testBrokenDatabase() throws URISyntaxException, IOException {
+        URI file = ReaderTest.class
+                .getResource(
+                        "/maxmind-db/test-data/GeoIP2-City-Test-Broken-Double-Format.mmdb")
+                .toURI();
+
+        MaxMindDbReader reader = new MaxMindDbReader(new File(file));
+
+        this.thrown.expect(InvalidDatabaseException.class);
+        this.thrown
+                .expectMessage(containsString("The MaxMind DB file's data section contains bad data"));
+
+        reader.get(InetAddress.getByName("2001:220::"));
+    }
+
+    @Test
+    public void testBrokenSearchTreePointer() throws URISyntaxException,
+            IOException {
+        URI file = ReaderTest.class
+                .getResource(
+                        "/maxmind-db/test-data/MaxMind-DB-test-broken-pointers-24.mmdb")
+                .toURI();
+
+        MaxMindDbReader reader = new MaxMindDbReader(new File(file));
+
+        this.thrown.expect(InvalidDatabaseException.class);
+        this.thrown
+                .expectMessage(containsString("The MaxMind DB file's search tree is corrupt"));
+
+        reader.get(InetAddress.getByName("1.1.1.32"));
+    }
+
+    @Test
+    public void testBrokenDataPointer() throws UnknownHostException,
+            IOException, URISyntaxException {
+        URI file = ReaderTest.class
+                .getResource(
+                        "/maxmind-db/test-data/MaxMind-DB-test-broken-pointers-24.mmdb")
+                .toURI();
+
+        MaxMindDbReader reader = new MaxMindDbReader(new File(file));
+
+        this.thrown.expect(InvalidDatabaseException.class);
+        this.thrown
+                .expectMessage(containsString("The MaxMind DB file's data section contains bad data"));
+
+        reader.get(InetAddress.getByName("1.1.1.16"));
+    }
+
     private void testMetadata(MaxMindDbReader reader, int ipVersion,
             long recordSize) {