Launchpad has imported 5 comments from the remote bug at https://gcc.gnu.org/bugzilla/show_bug.cgi?id=39359.
If you reply to an imported comment from within Launchpad, your comment will be sent to the remote bug automatically. Read more about Launchpad's inter-bugtracker facilities at https://documentation.ubuntu.com/launchpad/user/reference/bugs/multi-project-bugs/about-multi-project-bugs/#bugs-in-external-trackers. ------------------------------------------------------------------------ On 2009-03-04T12:47:31+00:00 E.Kellinis wrote: ========================= Bug 1) Reliable Crash when using java.awt.FileDialog and addNotify - Null pointer dereference !? ========================= - Has been confirmed using both kaffe and jamvm Code to replicate : class test2 { public static void main(String[] args) { (new java.awt.FileDialog(new java.awt.Frame(),"test")).addNotify();}} - Kaffe - EK@Lp:~/test$ kaffe test2 kaffe-bin: /build/buildd/kaffe-1.1.8/build-tree/kaffe-1.1.8/libraries/javalib/external/classpath/native/jni/classpath/native_state.c:176: cp_gtk_check_compat: Assertion `(*env)->IsAssignableFrom(env, objclazz, table->clazz)' failed. Aborted (core dumped) - JamVM - EK@Lp:~/test$ jamvm test2 Segmentation fault (core dumped) (gdb) bt #0 0x0805af1b in ?? () #1 0xad30ba86 in gtkpeer_get_widget (env=0x806baa0, peer=0x0) at gtkpeer.c:186 #2 0xad2fea1d in Java_gnu_java_awt_peer_gtk_GtkFileDialogPeer_create (env=0x806baa0, obj=0xafdfc850, parent=0x0, mode=0) at gnu_java_awt_peer_gtk_GtkFileDialogPeer.c:103 #3 0x08066805 in ?? () #4 0x08052b21 in callJNIWrapper () #5 0x080536fc in resolveNativeWrapper () #6 0x08056dcb in ?? () #7 0x080544bb in ?? () #8 0x080545c5 in ?? () #9 0x0804a835 in ?? () #10 0xb7dd6450 in __libc_start_main () from /lib/tls/i686/cmov/libc.so.6 #11 0x08049c71 in ?? () (gdb) up #1 0xad30ba86 in gtkpeer_get_widget (env=0x806baa0, peer=0x0) at gtkpeer.c:186 186 obj = (*env)->GetObjectField(env, peer, widgetFID); (gdb) print peer $1 = (jobject) 0x0 ========================= Bug 2) Reliable crash caused by mishandling of java.lang.NullPointerException from within the java.awt.PopupMenu class - Null pointer dereference ========================= - Has been confirmed using both kaffe and jamvm Code to replicate : class test3 { public static void main(String[] args) { (new java.awt.PopupMenu()).show(new java.awt.Button("a"),1,1);}} - kaffe - EK@Lp:~/test$ kaffe test3 kaffe-bin: /build/buildd/kaffe-1.1.8/build-tree/kaffe-1.1.8/libraries/javalib/external/classpath/native/jni/ classpath/native_state.c:176: cp_gtk_check_compat: Assertion `(*env)->IsAssignableFrom(env, objclazz, table->clazz)' failed. Aborted (core dumped) - JamVM - EK@Lp:~/test$ jamvm test2 Segmentation fault (core dumped) (gdb) bt #0 0x0805af1b in ?? () #1 0xad314a86 in gtkpeer_get_widget (env=0x806baa0, peer=0x0) at gtkpeer.c:186 #2 0xad30b352 in Java_gnu_java_awt_peer_gtk_GtkPopupMenuPeer_setupAccelGroup (env=0x806baa0, obj=0xafde4940, parent=0x0) at gnu_java_awt_peer_gtk_GtkPopupMenuPeer.c:94 #3 0x08066805 in ?? () #4 0x08052b21 in callJNIWrapper () #5 0x080536fc in resolveNativeWrapper () #6 0x08056dcb in ?? () #7 0x080544bb in ?? () #8 0x080545c5 in ?? () #9 0x0804a835 in ?? () #10 0xb7ddf450 in __libc_start_main () from /lib/tls/i686/cmov/libc.so.6 #11 0x08049c71 in ?? () (gdb) up #1 0xad314a86 in gtkpeer_get_widget (env=0x806baa0, peer=0x0) at gtkpeer.c:186 186 obj = (*env)->GetObjectField(env, peer, widgetFID); (gdb) print peer $1 = (jobject) 0x0 (gdb) up #2 0xad340352 in Java_gnu_java_awt_peer_gtk_GtkPopupMenuPeer_setupAccelGroup (env=0x806baa0, obj=0xafe19940, parent=0x0) at gnu_java_awt_peer_gtk_GtkPopupMenuPeer.c:94 94 ptr2 = gtkpeer_get_widget (env, parent); (gdb) print parent $1 = (jobject) 0x0 Reply at: https://bugs.launchpad.net/ubuntu/+source/jamvm/+bug/340201/comments/0 ------------------------------------------------------------------------ On 2009-03-05T10:46:54+00:00 E.Kellinis wrote: -- A bit more analysis on how I think this bug works -- If we inspect the core dumps , gtkpeer_get_widget returns a widget of null since the peer passed is null (gdb) down #1 0xad286a86 in gtkpeer_get_widget (env=0x806baa0, peer=0x0) at gtkpeer.c:186 186 obj = (*env)->GetObjectField(env, peer, widgetFID); (gdb) down #0 0x0805af1b in ?? () (gdb) up #1 0xad286a86 in gtkpeer_get_widget (env=0x806baa0, peer=0x0) at gtkpeer.c:186 186 obj = (*env)->GetObjectField(env, peer, widgetFID); (gdb) list 181 { 182 jobject obj; 183 void *widget; 184 185 /* Fetch the widget field from the peer object. */ 186 obj = (*env)->GetObjectField(env, peer, widgetFID); 187 188 /* Fetch actual widget pointer. */ 189 #if SIZEOF_VOID_P == 8 190 widget = (void*) (*env)->GetLongField(env, obj, pointerDataFID); 191 #else 192 widget = (void*) (*env)->GetIntField(env, obj, pointerDataFID); 193 #endif 194 return widget; 195 } 196 197 198 /** 199 * Stores the global JNI reference of a peer inside the peer. 200 * (gdb) print widget $1 = (GtkWidget *) 0x0 if we go up, it seems that the pointer returned by the function is returned to parentp (line 103) which is the dereferenced by GTK_WINDOW (gdb) up #2 0xad279a1d in Java_gnu_java_awt_peer_gtk_GtkFileDialogPeer_create (env=0x806baa0, obj=0xafd77850, parent=0x0, mode=0) at gnu_java_awt_peer_gtk_GtkFileDialogPeer.c:103 103 parentp = gtkpeer_get_widget(env, parent); (gdb) list 98 gdk_threads_enter (); 99 100 /* Create global reference and save it for future use */ 101 gtkpeer_set_global_ref (env, obj); 102 103 parentp = gtkpeer_get_widget(env, parent); 104 105 if (mode == AWT_FILEDIALOG_LOAD) 106 widget = gtk_file_chooser_dialog_new 107 ("Open File", Reply at: https://bugs.launchpad.net/ubuntu/+source/jamvm/+bug/340201/comments/1 ------------------------------------------------------------------------ On 2009-03-06T08:18:52+00:00 E.Kellinis wrote: excuse the order, the dereference happens in gtkpeer line 186 and not in GTK_WINDOW (just noticed my explanation moved the wrong way in the second message) Reply at: https://bugs.launchpad.net/ubuntu/+source/jamvm/+bug/340201/comments/2 ------------------------------------------------------------------------ On 2009-03-07T08:13:39+00:00 E.Kellinis wrote: btw the dereference doesnt happen in gtkpeer line 186, but it happens because of it's returning null... Reply at: https://bugs.launchpad.net/ubuntu/+source/jamvm/+bug/340201/comments/3 ------------------------------------------------------------------------ On 2009-03-08T14:51:07+00:00 E.Kellinis wrote: ok cool, after some more investigation, both these bugs belong to jni.c within JamVM and therefore I'll move them to JamVM's bug tracking. Though since both kaffe and jamvm either fail an assertion or segfault (respectively), it seems that there is an issue within classpath on handling (or passing) on time java.lang.NullPointerException since both these crashes happen when calling the instance method of a null object. Reply at: https://bugs.launchpad.net/ubuntu/+source/jamvm/+bug/340201/comments/4 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/340201 Title: Null pointer dereference vulnerabilities in JamVM To manage notifications about this bug go to: https://bugs.launchpad.net/gcc/+bug/340201/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
