engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undefect. CWE-407 — 63 sites patched across 27 ecosystems

Browse source 
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

170
test/langtools/tools/javap/BadAttributeLength.java Normal file
View file

@ -0,0 +1,170 @@
/*
* Copyright (c) 2014, 2016, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8047072
* @summary javap OOM on fuzzed classfile
* @modules jdk.jdeps/com.sun.tools.javap
* @run main BadAttributeLength
*/
import java.io.*;
public class BadAttributeLength {
public static String source = "public class Test {\n" +
" public static void main(String[] args) {}\n" +
"}";
public static void main(String[] args) throws Exception {
final File sourceFile = new File("Test.java");
if (sourceFile.exists()) {
if (!sourceFile.delete()) {
throw new IOException("Can't override the Test.java file. " +
"Check permissions.");
}
}
try (FileWriter fw = new FileWriter(sourceFile)) {
fw.write(source);
}
final String[] javacOpts = {"Test.java"};
if (com.sun.tools.javac.Main.compile(javacOpts) != 0) {
throw new Exception("Can't compile embedded test.");
}
RandomAccessFile raf = new RandomAccessFile("Test.class", "rw");
long attPos = getFirstAttributePos(raf);
if (attPos < 0) {
throw new Exception("The class file contains no attributes at all.");
}
raf.seek(attPos + 2); // Jump to the attribute length
raf.writeInt(Integer.MAX_VALUE - 1);
raf.close();
String[] opts = { "-v", "Test.class" };
StringWriter sw = new StringWriter();
PrintWriter pout = new PrintWriter(sw);
com.sun.tools.javap.Main.run(opts, pout);
pout.flush();
if (sw.getBuffer().indexOf("OutOfMemoryError") != -1) {
throw new Exception("javap exited with OutOfMemoryError " +
"instead of giving the proper error message.");
}
}
private static long getFirstAttributePos(RandomAccessFile cfile) throws Exception {
cfile.seek(0);
int v1, v2;
v1 = cfile.readInt();
// System.out.println("Magic: " + String.format("%X", v1));
v1 = cfile.readUnsignedShort();
v2 = cfile.readUnsignedShort();
// System.out.println("Version: " + String.format("%d.%d", v1, v2));
v1 = cfile.readUnsignedShort();
// System.out.println("CPool size: " + v1);
// Exhaust the constant pool
for (; v1 > 1; v1--) {
// System.out.print(".");
byte tag = cfile.readByte();
switch (tag) {
case 7 : // Class
case 8 : // String
// Data is 2 bytes long
cfile.skipBytes(2);
break;
case 3 : // Integer
case 4 : // Float
case 9 : // FieldRef
case 10 : // MethodRef
case 11 : // InterfaceMethodRef
case 12 : // Name and Type
// Data is 4 bytes long
cfile.skipBytes(4);
break;
case 5 : // Long
case 6 : // Double
// Data is 8 bytes long
cfile.skipBytes(8);
break;
case 1 : // Utf8
v2 = cfile.readUnsignedShort(); // Read buffer size
cfile.skipBytes(v2); // Skip buffer
break;
default :
throw new Exception("Unexpected tag in CPool: [" + tag + "] at "
+ Long.toHexString(cfile.getFilePointer()));
}
}
// System.out.println();
cfile.skipBytes(6); // Access flags, this_class and super_class
v1 = cfile.readUnsignedShort(); // Number of interfaces
// System.out.println("Interfaces: " + v1);
cfile.skipBytes(3 * v1); // Each interface_info record is 3 bytes long
v1 = cfile.readUnsignedShort(); // Number of fields
// System.out.println("Fields: " + v1);
// Exhaust the fields table
for (; v1 > 0; v1--) {
// System.out.print(".");
cfile.skipBytes(6); // Skip access_flags, name_index and descriptor_index
v2 = cfile.readUnsignedShort(); // Field attributes count
if (v2 > 0) {
// This field has some attributes - suits our needs
// System.out.println();
return cfile.getFilePointer();
}
}
// System.out.println();
v1 = cfile.readUnsignedShort(); // Number of methods
// System.out.println("Methods: " + v1);
// Exhaust the methods table
for (; v1 > 0; v1--) {
// System.out.print(".");
cfile.skipBytes(6); // Skip access_flags, name_index and descriptor_index
v2 = cfile.readUnsignedShort(); // Method attributes count
if (v2 > 0) {
// This method got attributes - Ok with us,
// return position of the first one
// System.out.println();
return cfile.getFilePointer();
}
}
// System.out.println();
// Class attributes section
v1 = cfile.readUnsignedShort(); // Counts of attributes in class
if (v1 > 0) {
// Class has some attributes, return position of the first one
return cfile.getFilePointer();
}
// Bummer! No attributes in the entire class file. Not fair!
return -1L;
}
}