From 1851864c489411b9ef995380a79e15e5c2766d17 Mon Sep 17 00:00:00 2001 From: dxbjavid Date: Wed, 3 Jun 2026 11:24:01 +0530 Subject: [PATCH 1/6] validate direction number degree in SobolSequenceGenerator stream parser --- .../commons/math4/legacy/random/SobolSequenceGenerator.java | 3 +++ 1 file changed, 3 insertions(+) diff --git a/commons-math-legacy/src/main/java/org/apache/commons/math4/legacy/random/SobolSequenceGenerator.java b/commons-math-legacy/src/main/java/org/apache/commons/math4/legacy/random/SobolSequenceGenerator.java index bf4a2a9acf..58d1d0d222 100644 --- a/commons-math-legacy/src/main/java/org/apache/commons/math4/legacy/random/SobolSequenceGenerator.java +++ b/commons-math-legacy/src/main/java/org/apache/commons/math4/legacy/random/SobolSequenceGenerator.java @@ -205,6 +205,9 @@ private int initFromStream(final InputStream is) throws IOException { dim = Integer.parseInt(st.nextToken()); if (dim >= 2 && dim <= dimension) { // we have found the right dimension final int s = Integer.parseInt(st.nextToken()); + if (s < 1 || s > BITS) { + throw new MathParseException(line, lineNumber); + } final int a = Integer.parseInt(st.nextToken()); final int[] m = new int[s + 1]; for (int i = 1; i <= s; i++) { From 20ad9fe6e63a9b3f1673d6b34ac8b6058a297541 Mon Sep 17 00:00:00 2001 From: dxbjavid Date: Wed, 3 Jun 2026 14:41:08 +0530 Subject: [PATCH 2/6] Add test for out-of-range direction number degree in SobolSequenceGenerator --- .../random/SobolSequenceGeneratorTest.java | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java b/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java index 39f1f4029b..be14c9fb10 100644 --- a/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java +++ b/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java @@ -18,8 +18,11 @@ import org.junit.Assert; +import java.io.ByteArrayInputStream; import java.io.InputStream; +import java.nio.charset.StandardCharsets; +import org.apache.commons.math4.legacy.exception.MathParseException; import org.apache.commons.math4.legacy.exception.OutOfRangeException; import org.junit.Before; import org.junit.Test; @@ -91,6 +94,24 @@ public void testConstructor2() throws Exception{ } } + @Test + public void testConstructorDegreeTooLarge() { + // direction number degree s = 60 exceeds the BITS (52) entries available + // per dimension; without range validation this indexes past direction[d] + // and throws ArrayIndexOutOfBoundsException instead of MathParseException. + final StringBuilder sb = new StringBuilder("d s a m_i\n2 60 0"); + for (int i = 0; i < 60; i++) { + sb.append(" 1"); + } + final InputStream is = new ByteArrayInputStream(sb.toString().getBytes(StandardCharsets.UTF_8)); + try { + new SobolSequenceGenerator(2, is); + Assert.fail("an exception should have been thrown"); + } catch (MathParseException e) { + // expected + } + } + @Test public void testSkip() { double[] result = generator.skipTo(5); From c6cdc7f957718f3724dc5f08c159565388ee3a59 Mon Sep 17 00:00:00 2001 From: dxbjavid Date: Thu, 18 Jun 2026 23:16:59 +0530 Subject: [PATCH 3/6] declare throws Exception on testConstructorDegreeTooLarge --- .../commons/math4/legacy/random/SobolSequenceGeneratorTest.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java b/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java index be14c9fb10..016cddac0b 100644 --- a/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java +++ b/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java @@ -95,7 +95,7 @@ public void testConstructor2() throws Exception{ } @Test - public void testConstructorDegreeTooLarge() { + public void testConstructorDegreeTooLarge() throws Exception { // direction number degree s = 60 exceeds the BITS (52) entries available // per dimension; without range validation this indexes past direction[d] // and throws ArrayIndexOutOfBoundsException instead of MathParseException. From 206e5aac2d848d1f21f6694c1cc4f7fff1f85c02 Mon Sep 17 00:00:00 2001 From: Alex Herbert Date: Mon, 24 Aug 2026 08:28:09 +0100 Subject: [PATCH 4/6] Update SobolSequenceGeneratorTest.java --- .../commons/math4/legacy/random/SobolSequenceGeneratorTest.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java b/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java index 016cddac0b..b47ad5705e 100644 --- a/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java +++ b/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java @@ -95,7 +95,7 @@ public void testConstructor2() throws Exception{ } @Test - public void testConstructorDegreeTooLarge() throws Exception { + public void testConstructorDegreeTooLarge() throws IOException { // direction number degree s = 60 exceeds the BITS (52) entries available // per dimension; without range validation this indexes past direction[d] // and throws ArrayIndexOutOfBoundsException instead of MathParseException. From 9f37eca729e468a03ffaa64a2a92c12ebda99a90 Mon Sep 17 00:00:00 2001 From: Alex Herbert Date: Mon, 24 Aug 2026 08:32:31 +0100 Subject: [PATCH 5/6] Update SobolSequenceGeneratorTest.java --- .../math4/legacy/random/SobolSequenceGeneratorTest.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java b/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java index b47ad5705e..3843136f53 100644 --- a/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java +++ b/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java @@ -20,6 +20,7 @@ import java.io.ByteArrayInputStream; import java.io.InputStream; +import java.io.IOException; import java.nio.charset.StandardCharsets; import org.apache.commons.math4.legacy.exception.MathParseException; @@ -77,7 +78,7 @@ public void testConstructor() { } @Test - public void testConstructor2() throws Exception{ + public void testConstructor2() throws IOException { try { final InputStream is = getClass().getResourceAsStream(RESOURCE_NAME); new SobolSequenceGenerator(21202, is); From 47b797d4adeb8476af0912fea24dd2e1bf22dd3d Mon Sep 17 00:00:00 2001 From: Alex Herbert Date: Mon, 24 Aug 2026 08:33:57 +0100 Subject: [PATCH 6/6] Update SobolSequenceGeneratorTest.java --- .../legacy/random/SobolSequenceGeneratorTest.java | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java b/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java index 3843136f53..2145a030d3 100644 --- a/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java +++ b/commons-math-legacy/src/test/java/org/apache/commons/math4/legacy/random/SobolSequenceGeneratorTest.java @@ -113,6 +113,21 @@ public void testConstructorDegreeTooLarge() throws IOException { } } + @Test + public void testConstructorDegreeTooSmall() throws IOException { + // direction number degree s = 60 exceeds the BITS (52) entries available + // per dimension; without range validation this indexes past direction[d] + // and throws ArrayIndexOutOfBoundsException instead of MathParseException. + final StringBuilder sb = new StringBuilder("d s a m_i\n2 0 0"); + final InputStream is = new ByteArrayInputStream(sb.toString().getBytes(StandardCharsets.UTF_8)); + try { + new SobolSequenceGenerator(2, is); + Assert.fail("an exception should have been thrown"); + } catch (MathParseException e) { + // expected + } + } + @Test public void testSkip() { double[] result = generator.skipTo(5);