1 /*

     2  * Copyright (c) 2014, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.

     8  *

     9  * This code is distributed in the hope that it will be useful, but WITHOUT

    10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    12  * version 2 for more details (a copy is included in the LICENSE file that

    13  * accompanied this code).

    14  *

    15  * You should have received a copy of the GNU General Public License version

    16  * 2 along with this work; if not, write to the Free Software Foundation,

    17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    18  *

    19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    20  * or visit www.oracle.com if you need additional information or have any

    21  * questions.

    22  */

    23 

    24 /*

    25  * @test

    26  * @bug 8047072

    27  * @summary javap OOM on fuzzed classfile

    28  * @run main BadAttributeLength

    29  */

    30 

    31 

    32 import java.io.*;

    33 

    34 public class BadAttributeLength {

    35 

    36     public static String source = "public class Test {\n" +

    37                                   "    public static void main(String[] args) {}\n" +

    38                                   "}";

    39 

    40     public static void main(String[] args) throws Exception {

    41         final File sourceFile = new File("Test.java");

    42         if (sourceFile.exists()) {

    43             if (!sourceFile.delete()) {

    44                 throw new IOException("Can't override the Test.java file. " +

    45                         "Check permissions.");

    46             }

    47         }

    48         try (FileWriter fw = new FileWriter(sourceFile)) {

    49             fw.write(source);

    50         }

    51 

    52         final String[] javacOpts = {"Test.java"};

    53 

    54         if (com.sun.tools.javac.Main.compile(javacOpts) != 0) {

    55             throw new Exception("Can't compile embedded test.");

    56         }

    57 

    58         RandomAccessFile raf = new RandomAccessFile("Test.class", "rw");

    59         long attPos = getFirstAttributePos(raf);

    60         if (attPos < 0) {

    61             throw new Exception("The class file contains no attributes at all.");

    62         }

    63         raf.seek(attPos + 2); // Jump to the attribute length

    64         raf.writeInt(Integer.MAX_VALUE - 1);

    65         raf.close();

    66 

    67         String[] opts = { "-v", "Test.class" };

    68         StringWriter sw = new StringWriter();

    69         PrintWriter pout = new PrintWriter(sw);

    70 

    71         com.sun.tools.javap.Main.run(opts, pout);

    72         pout.flush();

    73 

    74         if (sw.getBuffer().indexOf("OutOfMemoryError") != -1) {

    75             throw new Exception("javap exited with OutOfMemoryError " +

    76                     "instead of giving the proper error message.");

    77         }

    78     }

    79 

    80     private static long getFirstAttributePos(RandomAccessFile cfile) throws Exception {

    81         cfile.seek(0);

    82         int v1, v2;

    83         v1 = cfile.readInt();

    84         // System.out.println("Magic: " + String.format("%X", v1));

    85 

    86         v1 = cfile.readUnsignedShort();

    87         v2 = cfile.readUnsignedShort();

    88         // System.out.println("Version: " + String.format("%d.%d", v1, v2));

    89 

    90         v1 = cfile.readUnsignedShort();

    91         // System.out.println("CPool size: " + v1);

    92         // Exhaust the constant pool

    93         for (; v1 > 1; v1--) {

    94             // System.out.print(".");

    95             byte tag = cfile.readByte();

    96             switch (tag) {

    97                 case 7  : // Class

    98                 case 8  : // String

    99                     // Data is 2 bytes long

   100                     cfile.skipBytes(2);

   101                     break;

   102                 case 3  : // Integer

   103                 case 4  : // Float

   104                 case 9  : // FieldRef

   105                 case 10 : // MethodRef

   106                 case 11 : // InterfaceMethodRef

   107                 case 12 : // Name and Type

   108                     // Data is 4 bytes long

   109                     cfile.skipBytes(4);

   110                     break;

   111                 case 5  : // Long

   112                 case 6  : // Double

   113                     // Data is 8 bytes long

   114                     cfile.skipBytes(8);

   115                     break;

   116                 case 1  : // Utf8

   117                     v2 = cfile.readUnsignedShort(); // Read buffer size

   118                     cfile.skipBytes(v2); // Skip buffer

   119                     break;

   120                 default :

   121                     throw new Exception("Unexpected tag in CPool: [" + tag + "] at "

   122                             + Long.toHexString(cfile.getFilePointer()));

   123             }

   124         }

   125         // System.out.println();

   126 

   127         cfile.skipBytes(6); // Access flags, this_class and super_class

   128         v1 = cfile.readUnsignedShort(); // Number of interfaces

   129         // System.out.println("Interfaces: " + v1);

   130         cfile.skipBytes(3 * v1); // Each interface_info record is 3 bytes long

   131         v1 = cfile.readUnsignedShort(); // Number of fields

   132         // System.out.println("Fields: " + v1);

   133         // Exhaust the fields table

   134         for (; v1 > 0; v1--) {

   135             // System.out.print(".");

   136             cfile.skipBytes(6); // Skip access_flags, name_index and descriptor_index

   137             v2 = cfile.readUnsignedShort(); // Field attributes count

   138             if (v2 > 0) {

   139                 // This field has some attributes - suits our needs

   140                 // System.out.println();

   141                 return cfile.getFilePointer();

   142             }

   143         }

   144         // System.out.println();

   145         v1 = cfile.readUnsignedShort(); // Number of methods

   146         // System.out.println("Methods: " + v1);

   147         // Exhaust the methods table

   148         for (; v1 > 0; v1--) {

   149             // System.out.print(".");

   150             cfile.skipBytes(6); // Skip access_flags, name_index and descriptor_index

   151             v2 = cfile.readUnsignedShort(); // Method attributes count

   152             if (v2 > 0) {

   153                 // This method got attributes - Ok with us,

   154                 // return position of the first one

   155                 // System.out.println();

   156                 return cfile.getFilePointer();

   157             }

   158         }

   159         // System.out.println();

   160         // Class attributes section

   161         v1 = cfile.readUnsignedShort(); // Counts of attributes in class

   162         if (v1 > 0) {

   163             // Class has some attributes, return position of the first one

   164             return cfile.getFilePointer();

   165         }

   166         // Bummer! No attributes in the entire class file. Not fair!

   167         return -1L;

   168     }

   169 }