In the native code for forName0 we quickly extract the length of the proposed class name, before doing a number of actions:
len = (*env)->GetStringUTFLength(env, classname);
unicode_len = (*env)->GetStringLength(env, classname);
if (len >= (jsize)sizeof(buf)) {
clname = malloc(len + 1);
if (clname == NULL) {
JNU_ThrowOutOfMemoryError(env, NULL);
return NULL;
}
} else {
clname = buf;
}
(*env)->GetStringUTFRegion(env, classname, 0, unicode_len, clname);
if (verifyFixClassname(clname) == JNI_TRUE) {
/* slashes present in clname, use name b4 translation for exception */
(*env)->GetStringUTFRegion(env, classname, 0, unicode_len, clname);
JNU_ThrowClassNotFoundException(env, clname);
goto done;
}
if (!verifyClassname(clname, JNI_TRUE)) { /* expects slashed name */
JNU_ThrowClassNotFoundException(env, clname);
goto done;
}
before eventually calling into the VM to try and find the class, where eventually SystemDictionary will notice that the purported class name exceeds the maximum length of 65535 and throws an exception.
If the class name length is too long then we could potentially encounter other issues caused by the long string, before reaching the code that will actually reject it. It is better to validate the length immediately after extracting it before attempting any of these other actions.
len = (*env)->GetStringUTFLength(env, classname);
unicode_len = (*env)->GetStringLength(env, classname);
if (len >= (jsize)sizeof(buf)) {
clname = malloc(len + 1);
if (clname == NULL) {
JNU_ThrowOutOfMemoryError(env, NULL);
return NULL;
}
} else {
clname = buf;
}
(*env)->GetStringUTFRegion(env, classname, 0, unicode_len, clname);
if (verifyFixClassname(clname) == JNI_TRUE) {
/* slashes present in clname, use name b4 translation for exception */
(*env)->GetStringUTFRegion(env, classname, 0, unicode_len, clname);
JNU_ThrowClassNotFoundException(env, clname);
goto done;
}
if (!verifyClassname(clname, JNI_TRUE)) { /* expects slashed name */
JNU_ThrowClassNotFoundException(env, clname);
goto done;
}
before eventually calling into the VM to try and find the class, where eventually SystemDictionary will notice that the purported class name exceeds the maximum length of 65535 and throws an exception.
If the class name length is too long then we could potentially encounter other issues caused by the long string, before reaching the code that will actually reject it. It is better to validate the length immediately after extracting it before attempting any of these other actions.
- relates to
-
JDK-8329136 JNI_FindClass should check the proposed name length
- Closed