> In `vframeStreamCommon::skip_prefixed_method_and_wrappers()`, `prefix_len` is > a `size_t` computed as `prefixed_name_len - name_len`, so the `prefix_len <= > 0` guard only ever catches `prefix_len == 0`. When the next method on the > stack has a longer name than the prefixed native method, the subtraction > underflows, the guard passes, and `strcmp` reads at `prefixed_name + > prefix_len`, which has wrapped to a pointer before the string. The walk is > only reached when a JVMTI agent has registered a native method prefix with > `SetNativeMethodPrefix`, which several profilers do. > > The fix checks the lengths before subtracting. `name_len >= > prefixed_name_len` covers the `prefix_len == 0` case the old guard was meant > to catch, so nothing changes for inputs that were already handled correctly, > and `prefix_len` is now in `[1, prefixed_name_len)` for the comparisons that > follow. > > The test registers `wrapped_` as a prefix and declares a native > `wrapped_go()` next to a non-native `go()` with the same signature, so > resolving `wrapped_go()` strips the prefix and binds it to `go()`'s entry > point as a prefixed native. The native code then calls `RegisterNatives` with > no methods on a boot loader class, since that asks the VM for the calling > class at depth 1 and walks over the native frame, its wrapper and the > longer-named caller below. > > Note that the test does not fail on an unfixed VM: `strcmp` stops at the > first mismatching byte, so the over-read is a single byte inside the > resource-area chunk the string came from, which no sanitizer will flag. It > covers a path nothing else covers and locks in the guard. I confirmed the > underflow is reached by temporarily printing the lengths from the VM. > > Testing: > > - [x] `test/hotspot/jtreg:tier1`, linux-x86_64 fastdebug: 3583 passed, 7 > failed. The failures are `gc/TestTransparentHugePagesHeap.java` and > `runtime/os/TestTracePageSizes.java`, which fail on this machine because of > its transparent huge page settings and are unrelated to the change. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai).
David CARLIER has updated the pull request incrementally with one additional commit since the last revision: Apply feedback: fix stale method names in the test comment, drop the unused JNINativeMethod array ------------- Changes: - all: https://git.openjdk.org/jdk/pull/32180/files - new: https://git.openjdk.org/jdk/pull/32180/files/d075266e..5ef96a31 Webrevs: - full: https://webrevs.openjdk.org/?repo=jdk&pr=32180&range=02 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=32180&range=01-02 Stats: 7 lines in 2 files changed: 0 ins; 1 del; 6 mod Patch: https://git.openjdk.org/jdk/pull/32180.diff Fetch: git fetch https://git.openjdk.org/jdk.git pull/32180/head:pull/32180 PR: https://git.openjdk.org/jdk/pull/32180
