Report custom readObject calls directly instead of through finalize

1 files changed, 10 insertions, 0 deletions

diff --git a/sanitizers/src/main/java/jaz/Zer.java b/sanitizers/src/main/java/jaz/Zer.java
index 05e8d608..0b27609c 100644
--- a/sanitizers/src/main/java/jaz/Zer.java
+++ b/sanitizers/src/main/java/jaz/Zer.java
@@ -14,8 +14,11 @@
 
 package jaz;
 
+import com.code_intelligence.jazzer.api.FuzzerSecurityIssueHigh;
 import com.code_intelligence.jazzer.api.FuzzerSecurityIssueMedium;
 import com.code_intelligence.jazzer.api.Jazzer;
+import java.io.IOException;
+import java.io.ObjectInputStream;
 
 /**
  * A honeypot class that reports an appropriate finding on any interaction with one of its methods
@@ -94,4 +97,11 @@ public class Zer implements java.io.Serializable {
     Jazzer.reportFindingFromHook(staticInitializerCause);
     super.finalize();
   }
+
+  private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
+    Jazzer.reportFindingFromHook(new FuzzerSecurityIssueHigh("Remote Code Execution\n"
+        + "  Deserialization of arbitrary classes with custom readObject may allow remote\n"
+        + "  code execution depending on the classpath."));
+    in.defaultReadObject();
+  }
 }