Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-08 Thread Andrew Hughes
- Original Message - > On 08/08/2012 01:33, David Holmes wrote: > > On 8/08/2012 2:40 AM, Xueming Shen wrote: > >> > >> Andrew, > >> > >> Since we are here:-) are we also supposed to "free" the old_temp > >> at #250 > >> and old_temp and old_ev at the end? > > > > No. They are aliases for t

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-08 Thread Alan Bateman
On 08/08/2012 01:33, David Holmes wrote: On 8/08/2012 2:40 AM, Xueming Shen wrote: Andrew, Since we are here:-) are we also supposed to "free" the old_temp at #250 and old_temp and old_ev at the end? No. They are aliases for temp and encoding_variant, which are freed at the end. There are o

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-07 Thread Xueming Shen
On 8/7/12 5:33 PM, David Holmes wrote: On 8/08/2012 2:40 AM, Xueming Shen wrote: Andrew, Since we are here:-) are we also supposed to "free" the old_temp at #250 and old_temp and old_ev at the end? No. They are aliases for temp and encoding_variant, which are freed at the end. There are onl

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-07 Thread David Holmes
On 8/08/2012 2:40 AM, Xueming Shen wrote: Andrew, Since we are here:-) are we also supposed to "free" the old_temp at #250 and old_temp and old_ev at the end? No. They are aliases for temp and encoding_variant, which are freed at the end. There are only ever at most two things to free. And

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-07 Thread Xueming Shen
Andrew, Since we are here:-) are we also supposed to "free" the old_temp at #250 and old_temp and old_ev at the end? -Sherman On 08/07/2012 04:49 AM, Andrew Hughes wrote: - Original Message - Thanks Andrew. 7189533 created for this. Thanks. Ok to push then? :-) David - On

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-07 Thread Andrew Hughes
- Original Message - > Thanks Andrew. 7189533 created for this. > Thanks. Ok to push then? :-) > David > - > > On 3/08/2012 8:03 AM, Andrew Hughes wrote: > > > > > > - Original Message - > >> Hi Andrew, > >> > >> On 2/08/2012 7:35 PM, Andrew Hughes wrote: > >>> - Origin

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-06 Thread David Holmes
Thanks Andrew. 7189533 created for this. David - On 3/08/2012 8:03 AM, Andrew Hughes wrote: - Original Message - Hi Andrew, On 2/08/2012 7:35 PM, Andrew Hughes wrote: - Original Message - Andrew et al, AFAICS here: 220 encoding_variant = malloc(strlen(te

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-03 Thread Andrew Hughes
- Original Message - > On 02/08/2012 03:14, David Holmes wrote: > > Andrew et al, > > > > AFAICS here: > > > > 220 encoding_variant = malloc(strlen(temp)+1); > > 221 if (encoding_variant == NULL) { > > 222 JNU_ThrowOutOfMemoryError(env, NULL); > > 223

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-03 Thread Alan Bateman
On 02/08/2012 03:14, David Holmes wrote: Andrew et al, AFAICS here: 220 encoding_variant = malloc(strlen(temp)+1); 221 if (encoding_variant == NULL) { 222 JNU_ThrowOutOfMemoryError(env, NULL); 223 return 0; 224 } we also need to do free

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-02 Thread Andrew Hughes
- Original Message - > Hi Andrew, > > On 2/08/2012 7:35 PM, Andrew Hughes wrote: > > - Original Message - > >> Andrew et al, > >> > >> AFAICS here: > >> > >> 220 encoding_variant = malloc(strlen(temp)+1); > >> 221 if (encoding_variant == NULL) { > >>

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-02 Thread David Holmes
Hi Andrew, On 2/08/2012 7:35 PM, Andrew Hughes wrote: - Original Message - Andrew et al, AFAICS here: 220 encoding_variant = malloc(strlen(temp)+1); 221 if (encoding_variant == NULL) { 222 JNU_ThrowOutOfMemoryError(env, NULL); 223

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-02 Thread Andrew Hughes
- Original Message - > Andrew et al, > > AFAICS here: > >220 encoding_variant = malloc(strlen(temp)+1); >221 if (encoding_variant == NULL) { >222 JNU_ThrowOutOfMemoryError(env, NULL); >223 return 0; >224 } > > we also ne

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-01 Thread David Holmes
Andrew et al, AFAICS here: 220 encoding_variant = malloc(strlen(temp)+1); 221 if (encoding_variant == NULL) { 222 JNU_ThrowOutOfMemoryError(env, NULL); 223 return 0; 224 } we also need to do free(temp). Similarly later where we return wi

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-01 Thread Andrew Hughes
- Original Message - > On 08/01/2012 09:52 AM, Andrew Hughes wrote: > > I have no idea what happened with Omair's > > extended version. It's not in IcedTea. > > > > I didn't commit it to icedtea since I assumed I would be committing > it > to OpenJDK7/8 anyway (and icedtea would get it

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-01 Thread Andrew Hughes
- Original Message - > On 01/08/2012 14:52, Andrew Hughes wrote: > > : > > > > > > In any case, there is a Sun bug open for this: > > > > 6844255: Potential stack corruption in GetJavaProperties > > > > Can I take it that I can just get on and push Omair's extended > > version now then, >

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-01 Thread Alan Bateman
On 01/08/2012 14:52, Andrew Hughes wrote: : In any case, there is a Sun bug open for this: 6844255: Potential stack corruption in GetJavaProperties Can I take it that I can just get on and push Omair's extended version now then, with that bug ID? Yes, go ahead, I should have said that in my

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-01 Thread Omair Majid
On 08/01/2012 09:52 AM, Andrew Hughes wrote: > I have no idea what happened with Omair's > extended version. It's not in IcedTea. > I didn't commit it to icedtea since I assumed I would be committing it to OpenJDK7/8 anyway (and icedtea would get it on the next sync). And I didn't commit it to O

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-01 Thread Andrew Hughes
- Original Message - > Hi Andrew, > > No, I'm NOT against to fix this "potential" risk at all. Just tried > to > point out that this > might not be an "immediate" breach. > Oh, I know. Just might be nice to get the patch in after four years :-) > It was a mistake to drop the list. >

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-01 Thread Xueming Shen
Hi Andrew, No, I'm NOT against to fix this "potential" risk at all. Just tried to point out that this might not be an "immediate" breach. It was a mistake to drop the list. -Sherman On 08/01/2012 01:11 PM, Andrew Hughes wrote: - Original Message - On 08/01/2012 06:52 AM, Andrew Hug

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-01 Thread Andrew Hughes
- Original Message - > On 01/08/2012 12:40, Andrew Hughes wrote: > > java_props_md.c allocates a 64 byte buffer for the return value of > > setlocale > > on the stack. However, there appears to be no set limit on the > > return value: > > > > http://pubs.opengroup.org/onlinepubs/00960449

Re: [PATCH FOR REVIEW] Potential Buffer Overflow in java_props_md.c

2012-08-01 Thread Alan Bateman
On 01/08/2012 12:40, Andrew Hughes wrote: java_props_md.c allocates a 64 byte buffer for the return value of setlocale on the stack. However, there appears to be no set limit on the return value: http://pubs.opengroup.org/onlinepubs/009604499/functions/setlocale.html and no check in the code t