-
Bug
-
Resolution: Fixed
-
P4
-
None
-
None
-
b12
-
generic
-
generic
A fuzzed jar file causes an NPE in JarFile::verifiableEntry due to
access to a null pointer.
java JarTest npe_ze_null.jar javax/inject/Singleton.class
[...]
Exception in thread "main" java.lang.NullPointerException: Cannot invoke
"java.util.zip.ZipEntry.getName()" because "ze" is null
at java.base/java.util.jar.JarFile.verifiableEntry(JarFile.java:863)
at java.base/java.util.jar.JarFile.getInputStream(JarFile.java:853)
at JarTest.main(JarTest.java:18)
private JarEntry verifiableEntry(ZipEntry ze) {
if (ze instanceof JarFileEntry) {
// assure the name and entry match for verification
return ((JarFileEntry)ze).realEntry();
}
ze = getJarEntry(ze.getName()); <======
if (ze instanceof JarFileEntry) {
return ((JarFileEntry)ze).realEntry();
}
return (JarEntry)ze;
}
access to a null pointer.
java JarTest npe_ze_null.jar javax/inject/Singleton.class
[...]
Exception in thread "main" java.lang.NullPointerException: Cannot invoke
"java.util.zip.ZipEntry.getName()" because "ze" is null
at java.base/java.util.jar.JarFile.verifiableEntry(JarFile.java:863)
at java.base/java.util.jar.JarFile.getInputStream(JarFile.java:853)
at JarTest.main(JarTest.java:18)
private JarEntry verifiableEntry(ZipEntry ze) {
if (ze instanceof JarFileEntry) {
// assure the name and entry match for verification
return ((JarFileEntry)ze).realEntry();
}
ze = getJarEntry(ze.getName()); <======
if (ze instanceof JarFileEntry) {
return ((JarFileEntry)ze).realEntry();
}
return (JarEntry)ze;
}
- csr for
-
JDK-8282022 JarFile::getInputStream can fail with NPE accessing ze.getName()
-
- Closed
-
- links to
-
Commit openjdk/jdk/a020b6ba
-
Review openjdk/jdk/7348
-
Review(master) openjdk/jdk/7348