Fix UtilCheckerFuzzer: Security exception Update I18nFormatUtil.java

checker-util/src/main/java/org/checkerframework/checker/i18nformatter/util/I18nFormatUtil.java

@@ -48,28 +48,39 @@ public static void tryFormatSatisfiability(String format) throws IllegalFormatEx
    */
   public static I18nConversionCategory[] formatParameterCategories(String format)
       throws IllegalFormatException {
+
     tryFormatSatisfiability(format);
-    I18nConversion[] cs = MessageFormatParser.parse(format);
+
+    I18nConversion[] cs;
+    try {
+      cs = MessageFormatParser.parse(format);
+    } catch (Exception e) {
+      // Defensive programming: fail gracefully on parse errors
+      throw new IllegalFormatException("Invalid format string: " + format);
+    }
 
     int maxIndex = -1;
     Map<Integer, I18nConversionCategory> conv = new HashMap<>(cs.length);
 
     for (I18nConversion c : cs) {
       int index = c.index;
+      if (index < 0 || index > 1000) { // Arbitrary upper bound to prevent abuse
+        throw new IllegalFormatException("Format string contains illegal argument index: " + index);
+      }
+
       Integer indexKey = index;
-      conv.put(
-          indexKey,
-          I18nConversionCategory.intersect(
-              c.category,
-              conv.containsKey(indexKey) ? conv.get(indexKey) : I18nConversionCategory.UNUSED));
+      I18nConversionCategory existing = conv.getOrDefault(indexKey, I18nConversionCategory.UNUSED);
+      I18nConversionCategory merged = I18nConversionCategory.intersect(c.category, existing);
+
+      conv.put(indexKey, merged);
       maxIndex = Math.max(maxIndex, index);
     }
 
     I18nConversionCategory[] res = new I18nConversionCategory[maxIndex + 1];
     for (int i = 0; i <= maxIndex; i++) {
-      Integer indexKey = i;
-      res[i] = conv.containsKey(indexKey) ? conv.get(indexKey) : I18nConversionCategory.UNUSED;
+      res[i] = conv.getOrDefault(i, I18nConversionCategory.UNUSED);
     }
+
     return res;
   }