Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8300491

SymbolLookup::libraryLookup accepts strings with terminators

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: P3 P3
    • 21
    • 19, 20
    • core-libs
    • None

      SymbolLookup::libraryLookup(String) doesn't validate the incoming library name. So, the following is possible:


      jshell> var lookup = SymbolLookup.libraryLookup("libc.so.6\0foobar", MemorySession.global());
      lookup ==> java.lang.foreign.SymbolLookup$$Lambda$20/0x000000080105bce0@4769b07b

      jshell> lookup.lookup("strlen");
      $5 ==> Optional[MemorySegment{ id=0x6cb06628 limit: 0 }]

      As it can be seen, the lookup for "libc.so.6\0foobar" succeds, because, under the hood, the string is truncated to "libc.so.6" which does exist.

      The specification of the method should be clarified to throw IAE in such cases.

            mcimadamore Maurizio Cimadamore
            mcimadamore Maurizio Cimadamore
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated:
              Resolved: