[jira] [Commented] (LOG4J2-3535) Certain strings passed into StrSubstitutor can cause "infinite loop in property interpolation"

["Volkan Yazici (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/LOG4J2-3535?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17553312#comment-17553312 ] 

Volkan Yazici commented on LOG4J2-3535:
---------------------------------------

Thanks so much for reaching out to us [~PsclKmn]! Would you mind sharing the _sources_ (not binary!) of either a JUnit test or a single-class Java application, please?

> Certain strings passed into StrSubstitutor can cause "infinite loop in property interpolation"
> ----------------------------------------------------------------------------------------------
>
>                 Key: LOG4J2-3535
>                 URL: https://issues.apache.org/jira/browse/LOG4J2-3535
>             Project: Log4j 2
>          Issue Type: Bug
>          Components: Core
>    Affects Versions: 2.17.2
>            Reporter: Pascal Koeiman
>            Priority: Minor
>         Attachments: Crash_e4372c5ba2ed2cdbd5d87cfd541a5bcae60fb274.java, crash-e4372c5ba2ed2cdbd5d87cfd541a5bcae60fb274, hhsJazzer.jar, log4j2.xml
>
>
> I believe this is a similar issue to what's listed here, although there it is deemed fixed in 2.17.0: https://issues.apache.org/jira/browse/LOG4J2-3230
> Using Code Intelligence's fuzz testing tool ([Jazzer|https://github.com/CodeIntelligenceTesting/jazzer]), the exception was found by having the tool pass in generated strings to the *replace* method of the *StrSubstitutor* class. See also the message below:
> {{== Java Exception: java.lang.IllegalStateException: Infinite loop in property interpolation of $\{k:{-}$}ߤ{$\{$k:{-}${$k}߀��$}����:$����$}����-: $k
>         at org.apache.logging.log4j.core.lookup.StrSubstitutor.checkCyclicSubstitution(StrSubstitutor.java:1087)
>         at org.apache.logging.log4j.core.lookup.StrSubstitutor.substitute(StrSubstitutor.java:1034)
>         at org.apache.logging.log4j.core.lookup.StrSubstitutor.substitute(StrSubstitutor.java:1047)
>         at org.apache.logging.log4j.core.lookup.StrSubstitutor.substitute(StrSubstitutor.java:912)
>         at org.apache.logging.log4j.core.lookup.StrSubstitutor.replace(StrSubstitutor.java:467)
>         at org.apache.logging.log4j.core.lookup.StrSubstitutor.replace(StrSubstitutor.java:451)
>         at Log4jFuzzer.fuzzerTestOneInput(Log4jFuzzer.java:16)}}
>  
> In the attachments I included some files that can be used to try and reproduce the issue. The lowercase crash file contains the input that the fuzzing tool passed into the method.



--
This message was sent by Atlassian Jira
(v8.20.7#820007)