8267130: Memory Overflow in Disassembler::load_library #4020

Wanghuang-Huawei · 2021-05-14T02:17:29Z

reproduce:
put your libjvm.so in a long enough path, such like

/home/aaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/jdk/lib/server/libjvm.so

reason: we strcpy hsdis_library_name into buf without checking the length.

if (jvm_offset >= 0) {
 // 1. <home>/lib/<vm>/libhsdis-<arch>.so
 strcpy(&buf[jvm_offset], hsdis_library_name);
 strcat(&buf[jvm_offset], os::dll_file_extension());
 if (Verbose) st->print_cr("Trying to load: %s", buf);
 _library = os::dll_load(buf, ebuf, sizeof ebuf);
 if (_library == NULL && lib_offset >= 0) {
   // 2. <home>/lib/<vm>/hsdis-<arch>.so
   strcpy(&buf[lib_offset], hsdis_library_name);
   strcat(&buf[lib_offset], os::dll_file_extension());
   if (Verbose) st->print_cr("Trying to load: %s", buf);
   _library = os::dll_load(buf, ebuf, sizeof ebuf);
 }
 if (_library == NULL && lib_offset > 0) {
   // 3. <home>/lib/hsdis-<arch>.so
   buf[lib_offset - 1] = '\0';
   const char* p = strrchr(buf, *os::file_separator());
   if (p != NULL) {
     lib_offset = p - buf + 1;
     strcpy(&buf[lib_offset], hsdis_library_name);
     strcat(&buf[lib_offset], os::dll_file_extension());
     if (Verbose) st->print_cr("Trying to load: %s", buf);
     _library = os::dll_load(buf, ebuf, sizeof ebuf);
   }
 }
}

Progress

Change must not contain extraneous whitespace
Commit message must refer to an issue
Change must be properly reviewed

Issue

JDK-8267130: Memory Overflow in Disassembler::load_library

Reviewers

Nils Eliasson (@neliasso - Reviewer)
Hamlin Li (@Hamlin-Li - Reviewer)

Contributors

Wang Huang <whuang@openjdk.org>
Miao Zhuojun <mouzhuojun@huawei.com>

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.java.net/jdk pull/4020/head:pull/4020
$ git checkout pull/4020

Update a local copy of the PR:
$ git checkout pull/4020
$ git pull https://git.openjdk.java.net/jdk pull/4020/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 4020

View PR using the GUI difftool:
$ git pr show -t 4020

Using diff file

Download this PR as a diff file:
https://git.openjdk.java.net/jdk/pull/4020.diff

bridgekeeper · 2021-05-14T02:18:43Z

👋 Welcome back whuang! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2021-05-14T02:20:34Z

@Wanghuang-Huawei The following label will be automatically applied to this pull request:

hotspot-compiler

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2021-05-14T02:24:00Z

Webrevs

00: Full (2abd0b0f)

Wanghuang-Huawei · 2021-05-14T02:24:41Z

/contributor add Wang Huang whuang@openjdk.org
/contributor add Miao Zhuojunmouzhuojun@huawei.com

openjdk · 2021-05-14T02:25:06Z

@Wanghuang-Huawei
Contributor Wang Huang <whuang@openjdk.org> successfully added.

openjdk · 2021-05-14T02:27:23Z

@Wanghuang-Huawei
Contributor Miao Zhuojun <mouzhuojun@huawei.com> successfully added.

tstuefe

Hi @Wanghuang-Huawei ,

Long term this coding may benefit by using stringStream, which takes care of truncating (or dynamically allocating) memory as well as string appending.

But for this fix, I think this is mostly fine. See inline remarks.

Cheers, Thomas

tstuefe · 2021-05-14T08:03:43Z

src/hotspot/share/compiler/disassembler.cpp

-      // 2. <home>/lib/<vm>/hsdis-<arch>.so
-      strcpy(&buf[lib_offset], hsdis_library_name);
-      strcat(&buf[lib_offset], os::dll_file_extension());
+    if (jvm_offset + strlen(hsdis_library_name) + strlen(os::dll_file_extension()) < JVM_MAXPATHLEN) {


Don't we need space for the terminating zero here?

We use < here. If we use <=, we should consider terminating zero ;-)

neliasso

Just noting (not requiring you to fix in this CR). The error printing should be converted to use unified logging.

Approved.

openjdk · 2021-05-18T10:03:54Z

@Wanghuang-Huawei This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8267130: Memory Overflow in Disassembler::load_library

Co-authored-by: Wang Huang <whuang@openjdk.org>
Co-authored-by: Miao  Zhuojun <mouzhuojun@huawei.com>
Reviewed-by: neliasso, mli

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 243 new commits pushed to the master branch:

9d305b9: 8252372: Check if cloning is required to move loads out of loops in PhaseIdealLoop::split_if_with_blocks_post()
0394416: 8267468: Rename refill waster counters in ThreadLocalAllocBuffer
b33b8bc: 8267750: Incomplete fix for JDK-8267683
ac36b7d: 8267452: Delegate forEachRemaining in Spliterators.iterator()
d0d2ddc: 8267651: runtime/handshake/HandshakeTimeoutTest.java times out when dumping core
a98e476: 8267311: vmTestbase/gc/gctests/StringInternGC/StringInternGC.java eventually OOMEs
5aa45f2: 8267403: tools/jpackage/share/FileAssociationsTest.java#id0 failed with "Error: Bundler "Mac PKG Package" (pkg) failed to produce a package"
c20ca42: 8267691: Change table to obsolete CriticalJNINatives in JDK 18, not 17
e751b7b: 8267683: rfc7301Grease8F value not displayed correctly in SSLParameters javadoc
0b77359: 8224243: Add implSpec's to AccessibleObject and seal Executable
... and 233 more: https://git.openjdk.java.net/jdk/compare/04fad70437a43c0f38fd53414b8eace2eac93509...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

As you do not have Committer status in this project an existing Committer must agree to sponsor your change. Possible candidates are the reviewers of this PR (@tstuefe, @neliasso, @Hamlin-Li) but any other Committer may sponsor as well.

➡️ To flag this PR as ready for integration with the above commit message, type /integrate in a new comment. (Afterwards, your sponsor types /sponsor in a new comment to perform the integration).

Wanghuang-Huawei · 2021-05-26T02:45:44Z

/integrate

openjdk · 2021-05-26T02:47:22Z

@Wanghuang-Huawei
Your change (at version 2abd0b0) is now ready to be sponsored by a Committer.

Hamlin-Li · 2021-05-26T09:26:29Z

/approve

openjdk · 2021-05-26T09:27:34Z

@Hamlin-Li Unknown command approve - for a list of valid commands use /help.

Hamlin-Li

looks good.
/sponser

Hamlin-Li · 2021-05-26T10:20:26Z

/sponsor

openjdk · 2021-05-26T10:22:15Z

@Hamlin-Li @Wanghuang-Huawei Since your change was applied there have been 243 commits pushed to the master branch:

9d305b9: 8252372: Check if cloning is required to move loads out of loops in PhaseIdealLoop::split_if_with_blocks_post()
0394416: 8267468: Rename refill waster counters in ThreadLocalAllocBuffer
b33b8bc: 8267750: Incomplete fix for JDK-8267683
ac36b7d: 8267452: Delegate forEachRemaining in Spliterators.iterator()
d0d2ddc: 8267651: runtime/handshake/HandshakeTimeoutTest.java times out when dumping core
a98e476: 8267311: vmTestbase/gc/gctests/StringInternGC/StringInternGC.java eventually OOMEs
5aa45f2: 8267403: tools/jpackage/share/FileAssociationsTest.java#id0 failed with "Error: Bundler "Mac PKG Package" (pkg) failed to produce a package"
c20ca42: 8267691: Change table to obsolete CriticalJNINatives in JDK 18, not 17
e751b7b: 8267683: rfc7301Grease8F value not displayed correctly in SSLParameters javadoc
0b77359: 8224243: Add implSpec's to AccessibleObject and seal Executable
... and 233 more: https://git.openjdk.java.net/jdk/compare/04fad70437a43c0f38fd53414b8eace2eac93509...master

Your commit was automatically rebased without conflicts.

Pushed as commit 083416d.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

8267130: Memory Overflow in Disassembler::load_library

2abd0b0

openjdk bot added the rfr Pull request is ready for review label May 14, 2021

openjdk bot added the hotspot-compiler hotspot-compiler-dev@openjdk.org label May 14, 2021

tstuefe suggested changes May 14, 2021

View reviewed changes

neliasso approved these changes May 18, 2021

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label May 18, 2021

openjdk bot added the sponsor Pull request is ready to be sponsored label May 26, 2021

Hamlin-Li approved these changes May 26, 2021

View reviewed changes

openjdk bot closed this May 26, 2021

openjdk bot added integrated Pull request has been integrated and removed sponsor Pull request is ready to be sponsored ready Pull request is ready to be integrated rfr Pull request is ready for review labels May 26, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

8267130: Memory Overflow in Disassembler::load_library #4020

8267130: Memory Overflow in Disassembler::load_library #4020

Wanghuang-Huawei commented May 14, 2021 •

edited by openjdk bot

Loading

bridgekeeper bot commented May 14, 2021

openjdk bot commented May 14, 2021

mlbridge bot commented May 14, 2021

Wanghuang-Huawei commented May 14, 2021

openjdk bot commented May 14, 2021

openjdk bot commented May 14, 2021

tstuefe left a comment

tstuefe May 14, 2021

Wanghuang-Huawei May 14, 2021

neliasso left a comment

openjdk bot commented May 18, 2021 •

edited

Loading

Wanghuang-Huawei commented May 26, 2021

openjdk bot commented May 26, 2021

Hamlin-Li commented May 26, 2021

openjdk bot commented May 26, 2021

Hamlin-Li left a comment

Hamlin-Li commented May 26, 2021

openjdk bot commented May 26, 2021

8267130: Memory Overflow in Disassembler::load_library #4020

8267130: Memory Overflow in Disassembler::load_library #4020

Conversation

Wanghuang-Huawei commented May 14, 2021 • edited by openjdk bot Loading

Progress

Issue

Reviewers

Contributors

Reviewing

bridgekeeper bot commented May 14, 2021

openjdk bot commented May 14, 2021

mlbridge bot commented May 14, 2021

Webrevs

Wanghuang-Huawei commented May 14, 2021

openjdk bot commented May 14, 2021

openjdk bot commented May 14, 2021

tstuefe left a comment

Choose a reason for hiding this comment

tstuefe May 14, 2021

Choose a reason for hiding this comment

Wanghuang-Huawei May 14, 2021

Choose a reason for hiding this comment

neliasso left a comment

Choose a reason for hiding this comment

openjdk bot commented May 18, 2021 • edited Loading

Wanghuang-Huawei commented May 26, 2021

openjdk bot commented May 26, 2021

Hamlin-Li commented May 26, 2021

openjdk bot commented May 26, 2021

Hamlin-Li left a comment

Choose a reason for hiding this comment

Hamlin-Li commented May 26, 2021

openjdk bot commented May 26, 2021

Wanghuang-Huawei commented May 14, 2021 •

edited by openjdk bot

Loading

openjdk bot commented May 18, 2021 •

edited

Loading