(hbase) branch branch-2.5 updated: HBASE-30304 Prevent Bytes.toBytesBinary from throwing on truncated \x escape (#8508)

[junegunn]

This is an automated email from the ASF dual-hosted git repository.

junegunn pushed a commit to branch branch-2.5
in repository https://gitbox.apache.org/repos/asf/hbase.git


The following commit(s) were added to refs/heads/branch-2.5 by this push:
     new 9f3f459d548 HBASE-30304 Prevent Bytes.toBytesBinary from throwing on 
truncated \x escape (#8508)
9f3f459d548 is described below

commit 9f3f459d548c8ac0eedf80a686392448a8adae6f
Author: Junegunn Choi <juneg...@apache.org>
AuthorDate: Thu Jul 30 09:40:12 2026 +0900

    HBASE-30304 Prevent Bytes.toBytesBinary from throwing on truncated \x 
escape (#8508)
    
    The \xNN parser guards only that the 'x' after a backslash exists, then
    reads the two hex digits at i+2 and i+3 unconditionally. A string ending
    in "\x" or "\x0" throws.
    
    Widen the guard to require both hex digits in bounds. A truncated tail
    escape now falls through to the existing bogus-escape path and emits the
    backslash literally.
    
    HBASE-6518 fixed the trailing bare-backslash case with the same guard but
    did not extend it to the hex digits.
    
    Signed-off-by: Xiao Liu <liuxia...@apache.org>
---
 hbase-common/src/main/java/org/apache/hadoop/hbase/util/Bytes.java    | 2 +-
 .../src/test/java/org/apache/hadoop/hbase/util/BytesTestBase.java     | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/hbase-common/src/main/java/org/apache/hadoop/hbase/util/Bytes.java 
b/hbase-common/src/main/java/org/apache/hadoop/hbase/util/Bytes.java
index 1c5da4ed034..916072f008b 100644
--- a/hbase-common/src/main/java/org/apache/hadoop/hbase/util/Bytes.java
+++ b/hbase-common/src/main/java/org/apache/hadoop/hbase/util/Bytes.java
@@ -646,7 +646,7 @@ public class Bytes implements Comparable<Bytes> {
     int size = 0;
     for (int i = 0; i < in.length(); ++i) {
       char ch = in.charAt(i);
-      if (ch == '\\' && in.length() > i + 1 && in.charAt(i + 1) == 'x') {
+      if (ch == '\\' && in.length() > i + 3 && in.charAt(i + 1) == 'x') {
         // ok, take next 2 hex digits.
         char hd1 = in.charAt(i + 2);
         char hd2 = in.charAt(i + 3);
diff --git 
a/hbase-common/src/test/java/org/apache/hadoop/hbase/util/BytesTestBase.java 
b/hbase-common/src/test/java/org/apache/hadoop/hbase/util/BytesTestBase.java
index 96df8bc3939..31a74d938f4 100644
--- a/hbase-common/src/test/java/org/apache/hadoop/hbase/util/BytesTestBase.java
+++ b/hbase-common/src/test/java/org/apache/hadoop/hbase/util/BytesTestBase.java
@@ -423,9 +423,11 @@ public class BytesTestBase {
   }
 
   @Test
-  public void testToBytesBinaryTrailingBackslashes() {
+  public void testToBytesBinaryTruncatedHexDigit() {
     try {
       Bytes.toBytesBinary("abc\\x00\\x01\\");
+      Bytes.toBytesBinary("abc\\x00\\x01\\x");
+      Bytes.toBytesBinary("abc\\x00\\x01\\x0");
     } catch (StringIndexOutOfBoundsException ex) {
       fail("Illegal string access: " + ex.getMessage());
     }