Mantis - Resin
Viewing Issue Advanced Details
1614 crash always 02-13-07 18:20 06-04-07 16:06
closed 3.0.20  
none 3.1.2  
0001614: Java Hessian deserializer crashes when trying to unmarshal interface array
The hessian java code for deserialization (as of 3.0.20 latest and greatest version) appears to have a bug.

In java, it's possible to create the following object:

                        Serializable serial[] = new Serializable[2];
                        serial[0] = new String("hello");
                        serial[1] = new Long(2);

Both types implement serializable interface.

If I feed this object to the writeObject using:


the following gets written to the fileoutputstream (control chars removed for clarity):

Vt [ S helloS byez

Essentially I get a list (V) of Serializable interfaces which are marked as strings (S).

When I deserialize this file, the hessian code uses:

  public Object readList(AbstractHessianInput in, int length)

located in

The following gets invoked because the code assumes that the component type (Serializable) is known from the parsing of the data:

      if (_componentType != null) {
        for (int i = 0; i < data.length; i++)
          data[i] = in.readObject(_componentType);

causing the following to be invoked:
      reader = _serializerFactory.getObjectDeserializer(type);

Getting a deserializer on an interface throws an exception as the instantiate method later on calls the constructor for the object type (null for an interface.)

Of course, this problem happens with any based interface type that is stored in an Array or a List and de/serialized as above.

Suggestion for fixing this issue:

When an interface is given in an list/array, don't specify the type.

in public Object readList(AbstractHessianInput in, int length) located in class ArrayDeserializer

in the array case, replace:

        for (int i = 0; i < data.length; i++)
          data[i] = in.readObject(_componentType);


        for (int i = 0; i < data.length; i++)
          data[i] = in.readObject(_componentType.isInterface()?Object.class:_componentType);

in the list case, replace:

        while (! in.isEnd())


        while (! in.isEnd())

Substituting the type when an interface to the object type, will not instantiate this type, as the code defaults to the generic readObject without any type specified.

06-04-07 16:06