Launchpad has imported 5 comments from the remote bug at
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=39359.

If you reply to an imported comment from within Launchpad, your comment
will be sent to the remote bug automatically. Read more about
Launchpad's inter-bugtracker facilities at
https://documentation.ubuntu.com/launchpad/user/reference/bugs/multi-project-bugs/about-multi-project-bugs/#bugs-in-external-trackers.

------------------------------------------------------------------------
On 2009-03-04T12:47:31+00:00 E.Kellinis wrote:

=========================
Bug 1) Reliable Crash when using  java.awt.FileDialog and addNotify - Null 
pointer dereference !?
=========================

- Has been confirmed using both kaffe and jamvm

Code to replicate :
class test2 { public static void main(String[] args) { (new 
java.awt.FileDialog(new java.awt.Frame(),"test")).addNotify();}}

- Kaffe - 
EK@Lp:~/test$ kaffe test2
kaffe-bin: 
/build/buildd/kaffe-1.1.8/build-tree/kaffe-1.1.8/libraries/javalib/external/classpath/native/jni/classpath/native_state.c:176:
 cp_gtk_check_compat: Assertion `(*env)->IsAssignableFrom(env, objclazz, 
table->clazz)' failed.
Aborted (core dumped)

- JamVM - 
EK@Lp:~/test$ jamvm test2
Segmentation fault (core dumped)

(gdb) bt
#0  0x0805af1b in ?? ()
#1  0xad30ba86 in gtkpeer_get_widget (env=0x806baa0, peer=0x0) at gtkpeer.c:186
#2  0xad2fea1d in Java_gnu_java_awt_peer_gtk_GtkFileDialogPeer_create 
(env=0x806baa0, obj=0xafdfc850, parent=0x0, mode=0)
    at gnu_java_awt_peer_gtk_GtkFileDialogPeer.c:103
#3  0x08066805 in ?? ()
#4  0x08052b21 in callJNIWrapper ()
#5  0x080536fc in resolveNativeWrapper ()
#6  0x08056dcb in ?? ()
#7  0x080544bb in ?? ()
#8  0x080545c5 in ?? ()
#9  0x0804a835 in ?? ()
#10 0xb7dd6450 in __libc_start_main () from /lib/tls/i686/cmov/libc.so.6
#11 0x08049c71 in ?? ()

(gdb) up
#1  0xad30ba86 in gtkpeer_get_widget (env=0x806baa0, peer=0x0) at gtkpeer.c:186
186       obj = (*env)->GetObjectField(env, peer, widgetFID);
(gdb) print peer
$1 = (jobject) 0x0



=========================
Bug 2) Reliable crash caused by mishandling of java.lang.NullPointerException 
from within the java.awt.PopupMenu class  - Null pointer dereference 
=========================
- Has been confirmed using both kaffe and jamvm

Code to replicate :
class test3 { public static void main(String[] args)  
{ (new java.awt.PopupMenu()).show(new java.awt.Button("a"),1,1);}}

- kaffe - 
EK@Lp:~/test$ kaffe test3
kaffe-bin: 
/build/buildd/kaffe-1.1.8/build-tree/kaffe-1.1.8/libraries/javalib/external/classpath/native/jni/
classpath/native_state.c:176: cp_gtk_check_compat: Assertion 
`(*env)->IsAssignableFrom(env, objclazz, table->clazz)' failed.
Aborted (core dumped)

- JamVM - 
EK@Lp:~/test$ jamvm test2
Segmentation fault (core dumped)

(gdb) bt
#0  0x0805af1b in ?? ()
#1  0xad314a86 in gtkpeer_get_widget (env=0x806baa0, peer=0x0) at gtkpeer.c:186
#2  0xad30b352 in Java_gnu_java_awt_peer_gtk_GtkPopupMenuPeer_setupAccelGroup 
(env=0x806baa0, obj=0xafde4940, parent=0x0)
    at gnu_java_awt_peer_gtk_GtkPopupMenuPeer.c:94
#3  0x08066805 in ?? ()
#4  0x08052b21 in callJNIWrapper ()
#5  0x080536fc in resolveNativeWrapper ()
#6  0x08056dcb in ?? ()
#7  0x080544bb in ?? ()
#8  0x080545c5 in ?? ()
#9  0x0804a835 in ?? ()
#10 0xb7ddf450 in __libc_start_main () from /lib/tls/i686/cmov/libc.so.6
#11 0x08049c71 in ?? ()
(gdb) up
#1  0xad314a86 in gtkpeer_get_widget (env=0x806baa0, peer=0x0) at gtkpeer.c:186
186       obj = (*env)->GetObjectField(env, peer, widgetFID);
(gdb) print peer
$1 = (jobject) 0x0
(gdb) up
#2  0xad340352 in Java_gnu_java_awt_peer_gtk_GtkPopupMenuPeer_setupAccelGroup 
(env=0x806baa0, obj=0xafe19940, parent=0x0)
    at gnu_java_awt_peer_gtk_GtkPopupMenuPeer.c:94
94        ptr2 = gtkpeer_get_widget (env, parent);
(gdb) print parent
$1 = (jobject) 0x0

Reply at:
https://bugs.launchpad.net/ubuntu/+source/jamvm/+bug/340201/comments/0

------------------------------------------------------------------------
On 2009-03-05T10:46:54+00:00 E.Kellinis wrote:

-- A bit more analysis on how I think this bug works --

If we inspect the core dumps , gtkpeer_get_widget returns a widget of
null since the peer passed is null

(gdb) down
#1  0xad286a86 in gtkpeer_get_widget (env=0x806baa0, peer=0x0) at gtkpeer.c:186
186       obj = (*env)->GetObjectField(env, peer, widgetFID);
(gdb) down
#0  0x0805af1b in ?? ()
(gdb) up
#1  0xad286a86 in gtkpeer_get_widget (env=0x806baa0, peer=0x0) at gtkpeer.c:186
186       obj = (*env)->GetObjectField(env, peer, widgetFID);
(gdb) list
181     {
182       jobject obj;
183       void *widget;
184     
185       /* Fetch the widget field from the peer object. */
186       obj = (*env)->GetObjectField(env, peer, widgetFID);
187     
188       /* Fetch actual widget pointer. */
189     #if SIZEOF_VOID_P == 8
190       widget = (void*) (*env)->GetLongField(env, obj, pointerDataFID);
191     #else
192       widget = (void*) (*env)->GetIntField(env, obj, pointerDataFID);
193     #endif
194       return widget;
195     }
196     
197     
198     /**
199      * Stores the global JNI reference of a peer inside the peer.
200      *
(gdb) print widget
$1 = (GtkWidget *) 0x0


if we go up, it seems that the pointer returned by the function is returned to 
parentp (line 103) which is the dereferenced by GTK_WINDOW

(gdb) up
#2  0xad279a1d in Java_gnu_java_awt_peer_gtk_GtkFileDialogPeer_create 
(env=0x806baa0, obj=0xafd77850, parent=0x0, mode=0)
    at gnu_java_awt_peer_gtk_GtkFileDialogPeer.c:103
103       parentp = gtkpeer_get_widget(env, parent);
(gdb) list
98        gdk_threads_enter ();
99        
100       /* Create global reference and save it for future use */
101       gtkpeer_set_global_ref (env, obj);
102     
103       parentp = gtkpeer_get_widget(env, parent);
104     
105       if (mode == AWT_FILEDIALOG_LOAD)
106         widget = gtk_file_chooser_dialog_new
107           ("Open File",


Reply at:
https://bugs.launchpad.net/ubuntu/+source/jamvm/+bug/340201/comments/1

------------------------------------------------------------------------
On 2009-03-06T08:18:52+00:00 E.Kellinis wrote:

excuse the order, the dereference happens in gtkpeer line 186 and not in 
GTK_WINDOW (just noticed my explanation moved the wrong way in the second 
message)
 

Reply at:
https://bugs.launchpad.net/ubuntu/+source/jamvm/+bug/340201/comments/2

------------------------------------------------------------------------
On 2009-03-07T08:13:39+00:00 E.Kellinis wrote:

btw the dereference doesnt happen in gtkpeer line 186, but it happens
because of it's returning null...



Reply at: https://bugs.launchpad.net/ubuntu/+source/jamvm/+bug/340201/comments/3

------------------------------------------------------------------------
On 2009-03-08T14:51:07+00:00 E.Kellinis wrote:

ok cool, after some more investigation, both these bugs belong to jni.c within
JamVM and therefore I'll move them to JamVM's bug tracking.

Though since both kaffe and jamvm either fail an assertion or segfault
(respectively), it seems that there is an issue within classpath on
handling (or passing) on time java.lang.NullPointerException since both
these crashes happen when calling the instance method of a null object.


Reply at:
https://bugs.launchpad.net/ubuntu/+source/jamvm/+bug/340201/comments/4

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/340201

Title:
  Null pointer dereference vulnerabilities in JamVM

To manage notifications about this bug go to:
https://bugs.launchpad.net/gcc/+bug/340201/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to