From 0082b67a7f2c0a1abca07e6f746360568a57a768 Mon Sep 17 00:00:00 2001
From: Jesse Glick <jglick@cloudbees.com>
Date: Tue, 19 Mar 2019 11:18:46 -0400
Subject: [PATCH] [JENKINS-45661] ConsoleNote.readFrom could throw
 NegativeArraySizeException and block annotation of the rest of the log.

---
 core/src/main/java/hudson/console/ConsoleNote.java | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/core/src/main/java/hudson/console/ConsoleNote.java b/core/src/main/java/hudson/console/ConsoleNote.java
index 99ec3896d4..39977a590e 100644
--- a/core/src/main/java/hudson/console/ConsoleNote.java
+++ b/core/src/main/java/hudson/console/ConsoleNote.java
@@ -239,6 +239,9 @@ public abstract class ConsoleNote<T> implements Serializable, Describable<Consol
                 mac = new byte[macSz];
                 decoded.readFully(mac);
                 sz = decoded.readInt();
+                if (sz < 0) {
+                    throw new IOException("Corrupt stream");
+                }
             } else {
                 mac = null;
                 sz = - macSz;
-- 
GitLab