public inbox for java-prs@sourceware.org
help / color / mirror / Atom feed
* [Bug libgcj/23367] New: _Jv_FindMethodInCache is not thread-safe
@ 2005-08-12 21:09 greenrd at greenrd dot org
  2005-08-12 22:04 ` [Bug libgcj/23367] " pinskia at gcc dot gnu dot org
  2005-08-22 22:09 ` tromey at gcc dot gnu dot org
  0 siblings, 2 replies; 6+ messages in thread
From: greenrd at greenrd dot org @ 2005-08-12 21:09 UTC (permalink / raw)
  To: java-prs

_Jv_FindMethodInCache is not thread-safe, because it assumes that the following
check is enough to assure thread-safety:

 _Jv_mcache *mc = method_cache + index;
 _Jv_Method *m = mc->method;

  if (mc->klass == klass
      && m != NULL             // thread safe check
      && _Jv_equalUtf8Consts (m->name, name)
      && _Jv_equalUtf8Consts (m->signature, signature))

But this is bogus! If mc has already been assigned to, m will not be null, but
if it has never been assigned to, m will be null, so it's a useless check.
Therefore there is no effective measure for thread safety, so it's not thread-safe.

This could cause fairly arbitrary bad behaviour, including NPEs, security
violations, and weird hard-to-reproduce bugs.

I believe I have seen an NPE caused by this bug, because the symptoms match what
would be expected from this bug, and I know of no other plausible cause for
these symptoms: Method called with "this" object being of incompatible type, so
the method tries to read the "this" object as if it were the expected class, and
receives garbage (in this case, 0x0).

-- 
           Summary: _Jv_FindMethodInCache is not thread-safe
           Product: gcc
           Version: 4.0.2
            Status: UNCONFIRMED
          Severity: critical
          Priority: P2
         Component: libgcj
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: greenrd at greenrd dot org
                CC: gcc-bugs at gcc dot gnu dot org,java-prs at gcc dot gnu
                    dot org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23367


^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2005-09-30 21:04 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <20050812210922.23367.greenrd@gcc.gnu.org>
2005-09-27 20:03 ` [Bug libgcj/23367] _Jv_FindMethodInCache is not thread-safe cvs-commit at gcc dot gnu dot org
2005-09-27 20:04 ` tromey at gcc dot gnu dot org
2005-09-30 21:03 ` cvs-commit at gcc dot gnu dot org
2005-09-30 21:04 ` tromey at gcc dot gnu dot org
2005-08-12 21:09 [Bug libgcj/23367] New: " greenrd at greenrd dot org
2005-08-12 22:04 ` [Bug libgcj/23367] " pinskia at gcc dot gnu dot org
2005-08-22 22:09 ` tromey at gcc dot gnu dot org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).