Skip to content

8339192: Native annotation parsing code of deprecated annotations causes crash #21030

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

8339192: Native annotation parsing code of deprecated annotations causes crash #21030

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c71a773
8339192: Native annotation parsing code of deprecated annotations cau…
dholmes-ora Sep 17, 2024
1e7f7b0
MIN macro was Linux specific - need MIN2
dholmes-ora Sep 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 33 additions & 13 deletions src/hotspot/share/classfile/classFileParser.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1150,30 +1150,40 @@ static void parse_annotations(const ConstantPool* const cp,
if (AnnotationCollector::_unknown == id) continue;
coll->set_annotation(id);
if (AnnotationCollector::_java_lang_Deprecated == id) {
assert(count <= 2, "change this if more element-value pairs are added to the @Deprecated annotation");
// @Deprecated can specify forRemoval=true
// @Deprecated can specify forRemoval=true, which we need
// to record for JFR to use. If the annotation is not well-formed
// then we may not be able to determine that.
const u1* offset = abase + member_off;
for (int i = 0; i < count; ++i) {
// There are only 2 members in @Deprecated.
int n_members = MIN2(count, 2);
for (int i = 0; i < n_members; ++i) {
int member_index = Bytes::get_Java_u2((address)offset);
offset += 2;
member = check_symbol_at(cp, member_index);
if (member == vmSymbols::since()) {
assert(*((address)offset) == s_tag_val, "invariant");
if (member == vmSymbols::since() &&
(*((address)offset) == s_tag_val)) {
// Found `since` first so skip over it
offset += 3;
continue;
}
if (member == vmSymbols::for_removal()) {
assert(*((address)offset) == b_tag_val, "invariant");
else if (member == vmSymbols::for_removal() &&
(*((address)offset) == b_tag_val)) {
const u2 boolean_value_index = Bytes::get_Java_u2((address)offset + 1);
if (cp->int_at(boolean_value_index) == 1) {
// No guarantee the entry is valid so check it refers to an int in the CP.
if (cp->is_within_bounds(boolean_value_index) &&
cp->tag_at(boolean_value_index).is_int() &&
cp->int_at(boolean_value_index) == 1) {
// forRemoval == true
coll->set_annotation(AnnotationCollector::_java_lang_Deprecated_for_removal);
}
break; // no need to check further
}
else {
// This @Deprecated annotation is malformed so we don't try to
// determine whether forRemoval is set.
break;
}

}
continue;
continue; // proceed to next annotation
}

if (AnnotationCollector::_jdk_internal_vm_annotation_Contended == id) {
Expand All @@ -1194,11 +1204,21 @@ static void parse_annotations(const ConstantPool* const cp,
&& s_tag_val == *(abase + tag_off)
&& member == vmSymbols::value_name()) {
group_index = Bytes::get_Java_u2((address)abase + s_con_off);
if (cp->symbol_at(group_index)->utf8_length() == 0) {
group_index = 0; // default contended group
// No guarantee the group_index is valid so check it refers to a
// symbol in the CP.
if (cp->is_within_bounds(group_index) &&
cp->tag_at(group_index).is_utf8()) {
// Seems valid, so check for empty string and reset
if (cp->symbol_at(group_index)->utf8_length() == 0) {
group_index = 0; // default contended group
}
} else {
// Not valid so use the default
group_index = 0;
}
}
coll->set_contended_group(group_index);
continue; // proceed to next annotation
}
}
}
Expand Down
123 changes: 123 additions & 0 deletions test/hotspot/jtreg/runtime/Annotations/BadContendedGroupBadCPIndex.jcod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,123 @@
/*
* Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/

/* Based on source:
* public class ContendedField {
* @Contended("group1")
* public int field;
* }
*
* We change the value of "value" so it refers to an invalid CP entry
*/

class BadContendedGroupBadCPIndex {
0xCAFEBABE;
0; // minor version
65; // version
[19] { // Constant Pool
; // first element is empty
Method #2 #3; // #1 at 0x0A
class #4; // #2 at 0x0F
NameAndType #5 #6; // #3 at 0x12
Utf8 "java/lang/Object"; // #4 at 0x17
Utf8 "<init>"; // #5 at 0x2A
Utf8 "()V"; // #6 at 0x33
class #8; // #7 at 0x39
Utf8 "BadContendedGroupBadCPIndex"; // #8 at 0x3C
Utf8 "field"; // #9 at 0x4D
Utf8 "I"; // #10 at 0x55
Utf8 "RuntimeVisibleAnnotations"; // #11 at 0x59
Utf8 "Ljdk/internal/vm/annotation/Contended;"; // #12 at 0x75
Utf8 "value"; // #13 at 0x9E
Utf8 "group1"; // #14 at 0xA6
Utf8 "Code"; // #15 at 0xAF
Utf8 "LineNumberTable"; // #16 at 0xB6
Utf8 "SourceFile"; // #17 at 0xC8
Utf8 "BadContendedGroupBadCPIndex.java"; // #18 at 0xD5
} // Constant Pool

0x0021; // access [ ACC_PUBLIC ACC_SUPER ]
#7;// this_cpx
#2;// super_cpx

[0] { // Interfaces
} // Interfaces

[1] { // Fields
{ // field at 0xF5
0x0001; // access
#9; // name_index : field
#10; // descriptor_index : I
[1] { // Attributes
Attr(#11, 11) { // RuntimeVisibleAnnotations at 0xFD
[1] { // annotations
{ // annotation
#12;
[1] { // element_value_pairs
{ // element value pair
#13;
{ // element_value
's';
#1400; // Changed from #14 to #1400
} // element_value
} // element value pair
} // element_value_pairs
} // annotation
}
} // end RuntimeVisibleAnnotations
} // Attributes
}
} // Fields

[1] { // Methods
{ // method at 0x0110
0x0001; // access
#5; // name_index : <init>
#6; // descriptor_index : ()V
[1] { // Attributes
Attr(#15, 29) { // Code at 0x0118
1; // max_stack
1; // max_locals
Bytes[5]{
0x2AB70001B1;
}
[0] { // Traps
} // end Traps
[1] { // Attributes
Attr(#16, 6) { // LineNumberTable at 0x012F
[1] { // line_number_table
0 2; // at 0x013B
}
} // end LineNumberTable
} // Attributes
} // end Code
} // Attributes
}
} // Methods

[1] { // Attributes
Attr(#17, 2) { // SourceFile at 0x013D
#18;
} // end SourceFile
} // Attributes
} // end class BadContendedGroupBadCPIndex
123 changes: 123 additions & 0 deletions test/hotspot/jtreg/runtime/Annotations/BadContendedGroupWrongType.jcod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,123 @@
/*
* Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/

/* Based on source:
* public class ContendedField {
* @Contended("group1")
* public int field;
* }
*
* We change the value of "value" so it refers to the wrong type of CP entry
*/

class BadContendedGroupWrongType {
0xCAFEBABE;
0; // minor version
65; // version
[19] { // Constant Pool
; // first element is empty
Method #2 #3; // #1 at 0x0A
class #4; // #2 at 0x0F
NameAndType #5 #6; // #3 at 0x12
Utf8 "java/lang/Object"; // #4 at 0x17
Utf8 "<init>"; // #5 at 0x2A
Utf8 "()V"; // #6 at 0x33
class #8; // #7 at 0x39
Utf8 "BadContendedGroupWrongType"; // #8 at 0x3C
Utf8 "field"; // #9 at 0x4D
Utf8 "I"; // #10 at 0x55
Utf8 "RuntimeVisibleAnnotations"; // #11 at 0x59
Utf8 "Ljdk/internal/vm/annotation/Contended;"; // #12 at 0x75
Utf8 "value"; // #13 at 0x9E
Utf8 "group1"; // #14 at 0xA6
Utf8 "Code"; // #15 at 0xAF
Utf8 "LineNumberTable"; // #16 at 0xB6
Utf8 "SourceFile"; // #17 at 0xC8
Utf8 "BadContendedGroupWrongType.java"; // #18 at 0xD5
} // Constant Pool

0x0021; // access [ ACC_PUBLIC ACC_SUPER ]
#7;// this_cpx
#2;// super_cpx

[0] { // Interfaces
} // Interfaces

[1] { // Fields
{ // field at 0xF5
0x0001; // access
#9; // name_index : field
#10; // descriptor_index : I
[1] { // Attributes
Attr(#11, 11) { // RuntimeVisibleAnnotations at 0xFD
[1] { // annotations
{ // annotation
#12;
[1] { // element_value_pairs
{ // element value pair
#13;
{ // element_value
's';
#7; // Changed from #14 (utf8) to #7 (class)
} // element_value
} // element value pair
} // element_value_pairs
} // annotation
}
} // end RuntimeVisibleAnnotations
} // Attributes
}
} // Fields

[1] { // Methods
{ // method at 0x0110
0x0001; // access
#5; // name_index : <init>
#6; // descriptor_index : ()V
[1] { // Attributes
Attr(#15, 29) { // Code at 0x0118
1; // max_stack
1; // max_locals
Bytes[5]{
0x2AB70001B1;
}
[0] { // Traps
} // end Traps
[1] { // Attributes
Attr(#16, 6) { // LineNumberTable at 0x012F
[1] { // line_number_table
0 2; // at 0x013B
}
} // end LineNumberTable
} // Attributes
} // end Code
} // Attributes
}
} // Methods

[1] { // Attributes
Attr(#17, 2) { // SourceFile at 0x013D
#18;
} // end SourceFile
} // Attributes
} // end class BadContendedGroupWrongType
Loading