cater for array size marked with -1

Signed-off-by: Ceki Gulcu <ceki@qos.ch>
qos-ch · Nov 27, 2023 · 14a71d0 · 14a71d0
1 parent b8eac23
commit 14a71d0
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/logback-classic/src/main/java/ch/qos/logback/classic/spi/LoggingEventVO.java b/logback-classic/src/main/java/ch/qos/logback/classic/spi/LoggingEventVO.java
@@ -208,7 +208,7 @@ private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundE
         int argArrayLen = in.readInt();
 
         // Prevent DOS attacks via large or negative arrays
-        if (argArrayLen < 0 || argArrayLen > ARGUMENT_ARRAY_DESERIALIZATION_LIMIT) {
+        if (argArrayLen < NULL_ARGUMENT_ARRAY || argArrayLen > ARGUMENT_ARRAY_DESERIALIZATION_LIMIT) {
             throw new InvalidObjectException("Argument array length is invalid: " + argArrayLen);
         }