undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.

test/hotspot/jtreg/runtime/memory/LargePages/TestLargePagesFlags.java

@@ -0,0 +1,194 @@
+/*
+ * Copyright (c) 2013, 2023, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test TestLargePagesFlags
+ * @summary Tests how large pages are chosen depending on the given large pages flag combinations.
+ * @requires vm.gc != "Z"
+ * @requires os.family == "linux"
+ * @requires vm.flagless
+ * @library /test/lib
+ * @modules java.base/jdk.internal.misc
+ *          java.management
+ * @run driver TestLargePagesFlags
+ */
+
+import jdk.test.lib.process.OutputAnalyzer;
+import jdk.test.lib.Platform;
+import jdk.test.lib.process.ProcessTools;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+
+public class TestLargePagesFlags {
+
+  public static void main(String [] args) throws Exception {
+    testUseTransparentHugePages();
+  }
+
+  public static void testUseTransparentHugePages() throws Exception {
+    if (!canUse(UseTransparentHugePages(true))) {
+      System.out.println("Skipping testUseTransparentHugePages");
+      return;
+    }
+
+    // -XX:-UseLargePages overrides all other flags.
+    new FlagTester()
+      .use(UseLargePages(false),
+           UseTransparentHugePages(true))
+      .expect(
+           UseLargePages(false),
+           UseTransparentHugePages(false));
+
+    // Explicitly turn on UseTransparentHugePages.
+    new FlagTester()
+      .use(UseTransparentHugePages(true))
+      .expect(
+           UseLargePages(true),
+           UseTransparentHugePages(true));
+
+    new FlagTester()
+      .use(UseLargePages(true),
+           UseTransparentHugePages(true))
+      .expect(
+           UseLargePages(true),
+           UseTransparentHugePages(true));
+
+    // Setting a specific large pages flag will turn
+    // off heuristics to choose large pages type.
+    new FlagTester()
+      .use(UseLargePages(true),
+           UseTransparentHugePages(false))
+      .expect(
+           UseLargePages(false),
+           UseTransparentHugePages(false));
+
+    // Don't turn on UseTransparentHugePages
+    // unless the user explicitly asks for them.
+    new FlagTester()
+      .use(UseLargePages(true))
+      .expect(
+           UseTransparentHugePages(false));
+  }
+
+  private static class FlagTester {
+    private Flag [] useFlags;
+
+    public FlagTester use(Flag... useFlags) {
+      this.useFlags = useFlags;
+      return this;
+    }
+
+    public void expect(Flag... expectedFlags) throws Exception {
+      if (useFlags == null) {
+        throw new IllegalStateException("Must run use() before expect()");
+      }
+
+      System.out.println("Using: " + Arrays.toString(useFlags));
+      System.out.println("Expecting: " + Arrays.toString(expectedFlags));
+
+      OutputAnalyzer output = executeNewJVM(useFlags);
+      output.reportDiagnosticSummary();
+
+      for (Flag flag : expectedFlags) {
+        System.out.println("Looking for: " + flag.flagString());
+        String strValue = output.firstMatch(".* " + flag.name() +  " .* :?= (\\S+).*", 1);
+
+        if (strValue == null) {
+          throw new RuntimeException("Flag " + flag.name() + " couldn't be found");
+        }
+
+        if (!flag.value().equals(strValue)) {
+          throw new RuntimeException("Wrong value for: " + flag.name()
+                                     + " expected: " + flag.value()
+                                     + " got: " + strValue);
+        }
+      }
+
+      output.shouldHaveExitValue(0);
+    }
+  }
+
+  private static OutputAnalyzer executeNewJVM(Flag... flags) throws Exception {
+    ArrayList<String> args = new ArrayList<>();
+    for (Flag flag : flags) {
+      args.add(flag.flagString());
+    }
+    args.add("-Xlog:pagesize");
+    args.add("-version");
+
+    ProcessBuilder pb = ProcessTools.createLimitedTestJavaProcessBuilder(args);
+    OutputAnalyzer output = new OutputAnalyzer(pb.start());
+    output.shouldHaveExitValue(0);
+
+    return output;
+  }
+
+  private static boolean canUse(Flag flag) {
+    try {
+      new FlagTester().use(flag).expect(flag);
+    } catch (Exception e) {
+      return false;
+    }
+
+    return true;
+  }
+
+  private static Flag UseLargePages(boolean value) {
+    return new BooleanFlag("UseLargePages", value);
+  }
+
+  private static Flag UseTransparentHugePages(boolean value) {
+    return new BooleanFlag("UseTransparentHugePages", value);
+  }
+
+  private static class BooleanFlag implements Flag {
+    private String name;
+    private boolean value;
+
+    BooleanFlag(String name, boolean value) {
+      this.name = name;
+      this.value = value;
+    }
+
+    public String flagString() {
+      return "-XX:" + (value ? "+" : "-") + name;
+    }
+
+    public String name() {
+      return name;
+    }
+
+    public String value() {
+      return Boolean.toString(value);
+    }
+
+    @Override
+    public String toString() { return flagString(); }
+  }
+
+  private static interface Flag {
+    public String flagString();
+    public String name();
+    public String value();
+  }
+}

test/hotspot/jtreg/runtime/memory/MultiAllocateNullCheck.java

@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test MultiAllocateNullCheck
+ * @bug 6726963
+ * @summary multi_allocate() call does not CHECK_NULL and causes crash in fastdebug bits
+ * @run main/othervm -Xmx128m MultiAllocateNullCheck
+ */
+
+import java.lang.reflect.Array;
+
+public class MultiAllocateNullCheck {
+      public static void main(String[] args) throws Exception {
+        Object x = null;
+        try
+        {
+            x = Array.newInstance(String.class, new int[]
+                {Integer.MAX_VALUE, Integer.MAX_VALUE});
+            System.out.println("Array was created");
+        } catch (OutOfMemoryError e) {
+            System.out.println("Out of memory occured, which is OK in this case");
+        }
+    }
+}

test/hotspot/jtreg/runtime/memory/ReadFromNoaccessArea.java

@@ -0,0 +1,84 @@
+/*
+ * Copyright (c) 2013, 2023, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @summary Test that touching noaccess area in class ReservedHeapSpace results in SIGSEGV/ACCESS_VIOLATION
+ * @library /test/lib
+ * @requires vm.bits == 64
+ * @requires vm.flagless
+ * @modules java.base/jdk.internal.misc
+ *          java.management
+ * @build jdk.test.whitebox.WhiteBox
+ * @run driver jdk.test.lib.helpers.ClassFileInstaller jdk.test.whitebox.WhiteBox
+ * @run driver ReadFromNoaccessArea
+ */
+
+import jdk.test.lib.Platform;
+import jdk.test.lib.process.ProcessTools;
+import jdk.test.lib.process.OutputAnalyzer;
+import jdk.test.whitebox.WhiteBox;
+import jtreg.SkippedException;
+
+public class ReadFromNoaccessArea {
+
+  public static void main(String args[]) throws Exception {
+
+    ProcessBuilder pb = ProcessTools.createLimitedTestJavaProcessBuilder(
+          "-Xbootclasspath/a:.",
+          "-XX:+UnlockDiagnosticVMOptions",
+          "-XX:+WhiteBoxAPI",
+          "-XX:+UseCompressedOops",
+          "-XX:HeapBaseMinAddress=33G",
+          "-XX:-CreateCoredumpOnCrash",
+          "-Xmx128m",
+          DummyClassWithMainTryingToReadFromNoaccessArea.class.getName());
+
+    OutputAnalyzer output = new OutputAnalyzer(pb.start());
+    System.out.println("******* Printing stdout for analysis in case of failure *******");
+    System.out.println(output.getStdout());
+    System.out.println("******* Printing stderr for analysis in case of failure *******");
+    System.out.println(output.getStderr());
+    System.out.println("***************************************************************");
+    if (output.getStdout() != null && output.getStdout().contains("WB_ReadFromNoaccessArea method is useless")) {
+      throw new SkippedException("There is no protected page in ReservedHeapSpace in these circumstance");
+    }
+    output.shouldNotHaveExitValue(0);
+    if (Platform.isWindows()) {
+      output.shouldContain("EXCEPTION_ACCESS_VIOLATION");
+    } else if (Platform.isOSX()) {
+      output.shouldContain("SIGBUS");
+    } else {
+      output.shouldContain("SIGSEGV");
+    }
+  }
+
+  public static class DummyClassWithMainTryingToReadFromNoaccessArea {
+
+    // This method calls whitebox method reading from noaccess area
+    public static void main(String args[]) throws Exception {
+      WhiteBox.getWhiteBox().readFromNoaccessArea();
+    }
+  }
+
+}

test/hotspot/jtreg/runtime/memory/ReadVMPageSize.java

@@ -0,0 +1,46 @@
+/*
+ * Copyright (c) 2014, 2022, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @summary Using WhiteBox to get VM page size
+ * @modules java.base/jdk.internal.misc
+ * @library /test/lib
+ * @build jdk.test.whitebox.WhiteBox
+ * @run driver jdk.test.lib.helpers.ClassFileInstaller jdk.test.whitebox.WhiteBox
+ * @run main/othervm  -Xbootclasspath/a:. -XX:+UnlockDiagnosticVMOptions -XX:+WhiteBoxAPI  ReadVMPageSize
+ */
+
+import jdk.test.whitebox.WhiteBox;
+
+public class ReadVMPageSize {
+  public static void main(String args[]) throws Exception {
+    WhiteBox wb = WhiteBox.getWhiteBox();
+    int pageSize = wb.getVMPageSize();
+    if (pageSize < 0) {
+      throw new Exception("pageSize < 0");
+    } else {
+      System.out.println("Page size = " + pageSize);
+    }
+  }
+}

test/hotspot/jtreg/runtime/memory/ReserveMemory.java

@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2013, 2023, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+// Aix commits on touch, so this test won't work.
+/*
+ * @test
+ * @bug 8012015
+ * @requires !(os.family == "aix")
+ * @requires vm.flagless
+ * @summary Make sure reserved (but uncommitted) memory is not accessible
+ * @library /test/lib
+ * @modules java.base/jdk.internal.misc
+ *          java.management
+ * @build jdk.test.whitebox.WhiteBox
+ * @run driver jdk.test.lib.helpers.ClassFileInstaller jdk.test.whitebox.WhiteBox
+ * @run driver ReserveMemory
+ */
+
+import jdk.test.lib.process.ProcessTools;
+import jdk.test.lib.process.OutputAnalyzer;
+import jdk.test.lib.Platform;
+
+import jdk.test.whitebox.WhiteBox;
+
+public class ReserveMemory {
+  public static void main(String args[]) throws Exception {
+    if (args.length > 0) {
+      // expected to crash
+      WhiteBox.getWhiteBox().readReservedMemory();
+    } else {
+      ProcessBuilder pb = ProcessTools.createLimitedTestJavaProcessBuilder(
+            "-Xbootclasspath/a:.",
+            "-XX:+UnlockDiagnosticVMOptions",
+            "-XX:+WhiteBoxAPI",
+            "-XX:-CreateCoredumpOnCrash",
+            "-Xmx128m",
+            "ReserveMemory",
+            "test");
+
+      OutputAnalyzer output = new OutputAnalyzer(pb.start());
+      output.shouldNotHaveExitValue(0);
+      if (Platform.isWindows()) {
+        output.shouldContain("EXCEPTION_ACCESS_VIOLATION");
+      } else if (Platform.isOSX()) {
+        output.shouldContain("SIGBUS");
+      } else {
+        output.shouldContain("SIGSEGV");
+      }
+    }
+  }
+}

test/hotspot/jtreg/runtime/memory/StressVirtualSpaceResize.java

@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) 2013, 2022, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @summary Stress test that expands/shrinks VirtualSpace
+ * @modules java.base/jdk.internal.misc
+ * @library /test/lib
+ * @build jdk.test.whitebox.WhiteBox
+ * @run driver jdk.test.lib.helpers.ClassFileInstaller jdk.test.whitebox.WhiteBox
+ * @run main/othervm -Xbootclasspath/a:. -XX:+UnlockDiagnosticVMOptions -XX:+WhiteBoxAPI StressVirtualSpaceResize
+ */
+
+import jdk.test.whitebox.WhiteBox;
+
+public class StressVirtualSpaceResize {
+
+  public static void main(String args[]) throws Exception {
+    if (WhiteBox.getWhiteBox().stressVirtualSpaceResize(1000, 0xffffL, 0xffffL) != 0)
+      throw new RuntimeException("Whitebox method stressVirtualSpaceResize returned non zero exit code");
+  }
+}