Re: Request for approval: Bug 100057 - Potential stack corruption in GetJavaProperties

2011-05-18 Thread Alan Bateman
Omair Majid wrote: : It looks like this patch still has not been applied to OpenJDK7. I have prepared a webrev that updates this patch so it applies cleanly: http://cr.openjdk.java.net/~omajid/webrevs/stack-overflow-ParserLocale/01/ I would appreciate it if someone could take a quick look. I

Re: Request for approval: Bug 100057 - Potential stack corruption in GetJavaProperties

2011-05-18 Thread Omair Majid
On 05/18/2011 09:56 AM, Alan Bateman wrote: Omair Majid wrote: : It looks like this patch still has not been applied to OpenJDK7. I have prepared a webrev that updates this patch so it applies cleanly: http://cr.openjdk.java.net/~omajid/webrevs/stack-overflow-ParserLocale/01/ I would

Re: Request for approval: Bug 100057 - Potential stack corruption in GetJavaProperties

2009-05-25 Thread Xueming Shen
Andrew Haley wrote: Xueming Shen wrote: Andrew Haley wrote: } if (mapLookup(locale_aliases, temp, p)) { -strcpy(temp, p); +temp = realloc(temp, strlen(p)+1); +if (temp == NULL) { +

Re: Request for approval: Bug 100057 - Potential stack corruption in GetJavaProperties

2009-05-23 Thread Andrew Haley
Xueming Shen wrote: Andrew Haley wrote: } if (mapLookup(locale_aliases, temp, p)) { -strcpy(temp, p); +temp = realloc(temp, strlen(p)+1); +if (temp == NULL) { +JNU_ThrowOutOfMemoryError(env,

Re: Request for approval: Bug 100057 - Potential stack corruption in GetJavaProperties

2009-05-23 Thread Alan Bateman
Andrew Haley wrote: Xueming Shen wrote: Andrew Haley wrote: } if (mapLookup(locale_aliases, temp, p)) { -strcpy(temp, p); +temp = realloc(temp, strlen(p)+1); +if (temp == NULL) { +

Request for approval: Bug 100057 - Potential stack corruption in GetJavaProperties

2009-05-22 Thread Andrew Haley
https://bugs.openjdk.java.net/show_bug.cgi?id=100057 GetJavaProperties has a stack-allocated fixed size buffer for holding a copy of a string returned by setlocale(3). However, there is no guarantee that the string will fit into this buffer. This one is probably due to Solaris code being reused

Re: Request for approval: Bug 100057 - Potential stack corruption in GetJavaProperties

2009-05-22 Thread David Holmes - Sun Microsystems
Hi Andrew, If you use malloc then you have to check for a NULL return and deal with the error possibility. Alternatively use strncpy to make sure it's safe and continue to assume that it will be big enough. Cheers, David Holmes Andrew Haley said the following on 05/22/09 21:10:

Re: Request for approval: Bug 100057 - Potential stack corruption in GetJavaProperties

2009-05-22 Thread Alan Bateman
Andrew Haley wrote: https://bugs.openjdk.java.net/show_bug.cgi?id=100057 GetJavaProperties has a stack-allocated fixed size buffer for holding a copy of a string returned by setlocale(3). However, there is no guarantee that the string will fit into this buffer. This one is probably due to

Re: Request for approval: Bug 100057 - Potential stack corruption in GetJavaProperties

2009-05-22 Thread Andrew Haley
David Holmes - Sun Microsystems wrote: If you use malloc then you have to check for a NULL return and deal with the error possibility. Alternatively use strncpy to make sure it's safe and continue to assume that it will be big enough. It's just following the style used throughout that

Re: Request for approval: Bug 100057 - Potential stack corruption in GetJavaProperties

2009-05-22 Thread David Holmes - Sun Microsystems
Andrew Haley said the following on 05/22/09 21:45: David Holmes - Sun Microsystems wrote: If you use malloc then you have to check for a NULL return and deal with the error possibility. Alternatively use strncpy to make sure it's safe and continue to assume that it will be big enough. It's

Re: Request for approval: Bug 100057 - Potential stack corruption in GetJavaProperties

2009-05-22 Thread Alan Bateman
Andrew Haley wrote: : OK. I'll check for the NULL, then. If I have to change the patch that's been in IcedTea for ages then I'll use strdup instead of malloc. But what is one supposed to do if the allocation fails? Simply emit an error message to stderr and call abort() ?

Re: Request for approval: Bug 100057 - Potential stack corruption in GetJavaProperties

2009-05-22 Thread Andrew Haley
David Holmes - Sun Microsystems wrote: If you use malloc then you have to check for a NULL return and deal with the error possibility. Alternatively use strncpy to make sure it's safe and continue to assume that it will be big enough. I'm working on fixing this properly, but I just came

Re: Request for approval: Bug 100057 - Potential stack corruption in GetJavaProperties

2009-05-22 Thread Andrew Haley
Alan Bateman wrote: Andrew Haley wrote: https://bugs.openjdk.java.net/show_bug.cgi?id=100057 GetJavaProperties has a stack-allocated fixed size buffer for holding a copy of a string returned by setlocale(3). However, there is no guarantee that the string will fit into this buffer. This

Re: Request for approval: Bug 100057 - Potential stack corruption in GetJavaProperties

2009-05-22 Thread Alan Bateman
Andrew Haley wrote: : I've reworked the patch. I tried to refactor the code to make it cleaner and easier to follow, but I ended up touching so many places that it bacame a major change, and there's no way I could possibly test it all, especially the special cases for Solaris. So, I backed off

Re: Request for approval: Bug 100057 - Potential stack corruption in GetJavaProperties

2009-05-22 Thread Andrew Haley
Alan Bateman wrote: Andrew Haley wrote: : I've reworked the patch. I tried to refactor the code to make it cleaner and easier to follow, but I ended up touching so many places that it bacame a major change, and there's no way I could possibly test it all, especially the special cases for

Re: Request for approval: Bug 100057 - Potential stack corruption in GetJavaProperties

2009-05-22 Thread Alan Bateman
Andrew Haley wrote: : Yes, you're right. :-( I reworked this silly patch so many times that I couldn't see it any more. As you say, encoding_variant needs to be at least the size of temp. Thanks for perseveringly with it. The latest patch looks good to me. -Alan.