--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/test/langtools/tools/javap/BadAttributeLength.java Tue Sep 12 19:03:39 2017 +0200
@@ -0,0 +1,170 @@
+/*
+ * Copyright (c) 2014, 2016, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8047072
+ * @summary javap OOM on fuzzed classfile
+ * @modules jdk.jdeps/com.sun.tools.javap
+ * @run main BadAttributeLength
+ */
+
+
+import java.io.*;
+
+public class BadAttributeLength {
+
+ public static String source = "public class Test {\n" +
+ " public static void main(String[] args) {}\n" +
+ "}";
+
+ public static void main(String[] args) throws Exception {
+ final File sourceFile = new File("Test.java");
+ if (sourceFile.exists()) {
+ if (!sourceFile.delete()) {
+ throw new IOException("Can't override the Test.java file. " +
+ "Check permissions.");
+ }
+ }
+ try (FileWriter fw = new FileWriter(sourceFile)) {
+ fw.write(source);
+ }
+
+ final String[] javacOpts = {"Test.java"};
+
+ if (com.sun.tools.javac.Main.compile(javacOpts) != 0) {
+ throw new Exception("Can't compile embedded test.");
+ }
+
+ RandomAccessFile raf = new RandomAccessFile("Test.class", "rw");
+ long attPos = getFirstAttributePos(raf);
+ if (attPos < 0) {
+ throw new Exception("The class file contains no attributes at all.");
+ }
+ raf.seek(attPos + 2); // Jump to the attribute length
+ raf.writeInt(Integer.MAX_VALUE - 1);
+ raf.close();
+
+ String[] opts = { "-v", "Test.class" };
+ StringWriter sw = new StringWriter();
+ PrintWriter pout = new PrintWriter(sw);
+
+ com.sun.tools.javap.Main.run(opts, pout);
+ pout.flush();
+
+ if (sw.getBuffer().indexOf("OutOfMemoryError") != -1) {
+ throw new Exception("javap exited with OutOfMemoryError " +
+ "instead of giving the proper error message.");
+ }
+ }
+
+ private static long getFirstAttributePos(RandomAccessFile cfile) throws Exception {
+ cfile.seek(0);
+ int v1, v2;
+ v1 = cfile.readInt();
+ // System.out.println("Magic: " + String.format("%X", v1));
+
+ v1 = cfile.readUnsignedShort();
+ v2 = cfile.readUnsignedShort();
+ // System.out.println("Version: " + String.format("%d.%d", v1, v2));
+
+ v1 = cfile.readUnsignedShort();
+ // System.out.println("CPool size: " + v1);
+ // Exhaust the constant pool
+ for (; v1 > 1; v1--) {
+ // System.out.print(".");
+ byte tag = cfile.readByte();
+ switch (tag) {
+ case 7 : // Class
+ case 8 : // String
+ // Data is 2 bytes long
+ cfile.skipBytes(2);
+ break;
+ case 3 : // Integer
+ case 4 : // Float
+ case 9 : // FieldRef
+ case 10 : // MethodRef
+ case 11 : // InterfaceMethodRef
+ case 12 : // Name and Type
+ // Data is 4 bytes long
+ cfile.skipBytes(4);
+ break;
+ case 5 : // Long
+ case 6 : // Double
+ // Data is 8 bytes long
+ cfile.skipBytes(8);
+ break;
+ case 1 : // Utf8
+ v2 = cfile.readUnsignedShort(); // Read buffer size
+ cfile.skipBytes(v2); // Skip buffer
+ break;
+ default :
+ throw new Exception("Unexpected tag in CPool: [" + tag + "] at "
+ + Long.toHexString(cfile.getFilePointer()));
+ }
+ }
+ // System.out.println();
+
+ cfile.skipBytes(6); // Access flags, this_class and super_class
+ v1 = cfile.readUnsignedShort(); // Number of interfaces
+ // System.out.println("Interfaces: " + v1);
+ cfile.skipBytes(3 * v1); // Each interface_info record is 3 bytes long
+ v1 = cfile.readUnsignedShort(); // Number of fields
+ // System.out.println("Fields: " + v1);
+ // Exhaust the fields table
+ for (; v1 > 0; v1--) {
+ // System.out.print(".");
+ cfile.skipBytes(6); // Skip access_flags, name_index and descriptor_index
+ v2 = cfile.readUnsignedShort(); // Field attributes count
+ if (v2 > 0) {
+ // This field has some attributes - suits our needs
+ // System.out.println();
+ return cfile.getFilePointer();
+ }
+ }
+ // System.out.println();
+ v1 = cfile.readUnsignedShort(); // Number of methods
+ // System.out.println("Methods: " + v1);
+ // Exhaust the methods table
+ for (; v1 > 0; v1--) {
+ // System.out.print(".");
+ cfile.skipBytes(6); // Skip access_flags, name_index and descriptor_index
+ v2 = cfile.readUnsignedShort(); // Method attributes count
+ if (v2 > 0) {
+ // This method got attributes - Ok with us,
+ // return position of the first one
+ // System.out.println();
+ return cfile.getFilePointer();
+ }
+ }
+ // System.out.println();
+ // Class attributes section
+ v1 = cfile.readUnsignedShort(); // Counts of attributes in class
+ if (v1 > 0) {
+ // Class has some attributes, return position of the first one
+ return cfile.getFilePointer();
+ }
+ // Bummer! No attributes in the entire class file. Not fair!
+ return -1L;
+ }
+}