CLJ-2839 Infinite seq class hashCode() is infinite loop

clojure · Mar 7, 2024 · 777456f · 777456f
1 parent ce55092
commit 777456f
Show file tree

Hide file tree

Showing 6 changed files with 50 additions and 2 deletions.
diff --git a/src/clj/clojure/core.clj b/src/clj/clojure/core.clj
@@ -3028,7 +3028,8 @@
   [n x] (take n (repeat x)))
 
 (defn iterate
-  "Returns a lazy sequence of x, (f x), (f (f x)) etc. f must be free of side-effects"
+  "Returns a lazy (infinite!) sequence of x, (f x), (f (f x)) etc.
+  f must be free of side-effects"
   {:added "1.0"
    :static true}
   [f x] (clojure.lang.Iterate/create f x) )

diff --git a/src/jvm/clojure/lang/Cycle.java b/src/jvm/clojure/lang/Cycle.java
@@ -93,4 +93,13 @@ public Object reduce(IFn f, Object start){
             s = all;
     }
 }
+
+public int hashCode(){
+    throw new UnsupportedOperationException();
+}
+
+public int hasheq(){
+    throw new UnsupportedOperationException();
+}
+
 }
diff --git a/src/jvm/clojure/lang/Iterate.java b/src/jvm/clojure/lang/Iterate.java
@@ -84,4 +84,12 @@ public Object reduce(IFn rf, Object start){
         v = f.invoke(v);
     }
 }
+
+public int hashCode(){
+    throw new UnsupportedOperationException();
+}
+
+public int hasheq(){
+    throw new UnsupportedOperationException();
+}
 }
diff --git a/src/jvm/clojure/lang/Repeat.java b/src/jvm/clojure/lang/Repeat.java
@@ -97,4 +97,17 @@ public Object reduce(IFn f, Object start){
     }
 }
 
+public int hashCode(){
+    if(count <= 0)
+        throw new UnsupportedOperationException();
+    else
+        return super.hashCode();
+}
+
+public int hasheq(){
+    if(count <= 0)
+        throw new UnsupportedOperationException();
+    else
+        return super.hasheq();
+}
 }
diff --git a/test/clojure/test_clojure/sequences.clj b/test/clojure/test_clojure/sequences.clj
@@ -1458,6 +1458,16 @@
                            :kf #(some-> % :k #{0 1 2})
                            :vf :item))))))
 
+(deftest infinite-seq-hash
+  (are [e] (thrown? Exception (.hashCode ^Object e))
+    (iterate identity nil)
+    (cycle [1])
+    (repeat 1))
+  (are [e] (thrown? Exception (.hasheq ^clojure.lang.IHashEq e))
+    (iterate identity nil)
+    (cycle [1])
+    (repeat 1)))
+
 (defspec iteration-seq-equals-reduce 1000
   (prop/for-all [initk gen/int
                  seed gen/int]

diff --git a/test/clojure/test_clojure/serialization.clj b/test/clojure/test_clojure/serialization.clj
@@ -183,4 +183,11 @@
 
     ;; stateful seqs
     (enumeration-seq (java.util.Collections/enumeration (range 50)))
-    (iterator-seq (.iterator (range 50)))))
+    (iterator-seq (.iterator (range 50)))))
+
+;; necessary for CVE-2024-22871
+(deftest CLJ-2839
+  (are [e] (thrown? Exception (.hashCode ^Object (-> e serialize deserialize)))
+    (repeat 1)
+    (iterate identity nil)
+    (cycle [1])))