8211826: StringIndexOutOfBoundsException happens via GetStringUTFRegion()
authoritakiguchi
Wed, 08 May 2019 22:59:20 -0700
changeset 54875 bcfedddcf4ce
parent 54874 631c31a5bf40
child 54876 da3834261f0c
8211826: StringIndexOutOfBoundsException happens via GetStringUTFRegion() Reviewed-by: serb
src/java.desktop/unix/native/libawt_xawt/awt/awt_UNIXToolkit.c
src/java.desktop/unix/native/libawt_xawt/awt/swing_GTKEngine.c
test/jdk/java/awt/Gtk/GtkJNITest/GtkIconTest.java
--- a/src/java.desktop/unix/native/libawt_xawt/awt/awt_UNIXToolkit.c	Wed May 08 16:19:22 2019 -0700
+++ b/src/java.desktop/unix/native/libawt_xawt/awt/awt_UNIXToolkit.c	Wed May 08 22:59:20 2019 -0700
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2004, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2004, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -113,6 +113,7 @@
 {
 #ifndef HEADLESS
     int len;
+    jsize jlen;
     char *filename_str = NULL;
     GError **error = NULL;
 
@@ -122,6 +123,7 @@
     }
 
     len = (*env)->GetStringUTFLength(env, filename);
+    jlen = (*env)->GetStringLength(env, filename);
     filename_str = (char *)SAFE_SIZE_ARRAY_ALLOC(malloc,
             sizeof(char), len + 1);
     if (filename_str == NULL) {
@@ -132,7 +134,7 @@
         free(filename_str);
         return JNI_FALSE;
     }
-    (*env)->GetStringUTFRegion(env, filename, 0, len, filename_str);
+    (*env)->GetStringUTFRegion(env, filename, 0, jlen, filename_str);
     jboolean result = gtk->get_file_icon_data(env, filename_str, error,
                                             icon_upcall_method, this);
 
@@ -159,6 +161,7 @@
 {
 #ifndef HEADLESS
     int len;
+    jsize jlen;
     char *stock_id_str = NULL;
     char *detail_str = NULL;
     jboolean result = JNI_FALSE;
@@ -169,18 +172,20 @@
     }
 
     len = (*env)->GetStringUTFLength(env, stock_id);
+    jlen = (*env)->GetStringLength(env, stock_id);
     stock_id_str = (char *)SAFE_SIZE_ARRAY_ALLOC(malloc,
             sizeof(char), len + 1);
     if (stock_id_str == NULL) {
         JNU_ThrowOutOfMemoryError(env, "OutOfMemoryError");
         return JNI_FALSE;
     }
-    (*env)->GetStringUTFRegion(env, stock_id, 0, len, stock_id_str);
+    (*env)->GetStringUTFRegion(env, stock_id, 0, jlen, stock_id_str);
 
     /* Detail isn't required so check for NULL. */
     if (detail != NULL)
     {
         len = (*env)->GetStringUTFLength(env, detail);
+        jlen = (*env)->GetStringLength(env, detail);
         detail_str = (char *)SAFE_SIZE_ARRAY_ALLOC(malloc,
                 sizeof(char), len + 1);
         if (detail_str == NULL) {
@@ -188,7 +193,7 @@
             JNU_ThrowOutOfMemoryError(env, "OutOfMemoryError");
             return JNI_FALSE;
         }
-        (*env)->GetStringUTFRegion(env, detail, 0, len, detail_str);
+        (*env)->GetStringUTFRegion(env, detail, 0, jlen, detail_str);
     }
 
     if (init_method(env, this)) {
--- a/src/java.desktop/unix/native/libawt_xawt/awt/swing_GTKEngine.c	Wed May 08 16:19:22 2019 -0700
+++ b/src/java.desktop/unix/native/libawt_xawt/awt/swing_GTKEngine.c	Wed May 08 22:59:20 2019 -0700
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2005, 2016, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2005, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -24,11 +24,12 @@
  */
 
 #include <stdlib.h>
+#include <string.h>
 #include "gtk_interface.h"
 #include "com_sun_java_swing_plaf_gtk_GTKEngine.h"
 
 /* Static buffer for conversion from java.lang.String to UTF-8 */
-static char conversionBuffer[CONV_BUFFER_SIZE];
+static char conversionBuffer[(CONV_BUFFER_SIZE - 1) * 3 + 1];
 
 const char *getStrFor(JNIEnv *env, jstring val)
 {
@@ -38,6 +39,7 @@
         length = CONV_BUFFER_SIZE-1;
     }
 
+    memset(conversionBuffer, 0, sizeof(conversionBuffer));
     (*env)->GetStringUTFRegion(env, val, 0, length, conversionBuffer);
     return conversionBuffer;
 }
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/test/jdk/java/awt/Gtk/GtkJNITest/GtkIconTest.java	Wed May 08 22:59:20 2019 -0700
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+ * @key headful
+ * @bug 8211826
+ * @summary StringIndexOutOfBoundsException happens via GetStringUTFRegion()
+ * @modules java.desktop/sun.awt
+ * @requires (os.family == "linux")
+ * @run main GtkIconTest
+ */
+
+import java.awt.Toolkit;
+import sun.awt.UNIXToolkit;
+
+public class GtkIconTest {
+    public static void main(String[] args) throws Exception {
+        UNIXToolkit utk = (UNIXToolkit)Toolkit.getDefaultToolkit();
+        if (utk.loadGTK()) {
+            for (String s : new String[]{ "abc", "\u3042" }) {
+                Object obj = utk.getGTKIcon(s);
+            }
+        }
+    }
+}