public inbox for java-prs@sourceware.org
help / color / mirror / Atom feed
* [Bug java/24461] New: array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib
@ 2005-10-20 19:48 jrandom-gcc at i2p dot net
2005-10-22 11:57 ` [Bug libgcj/24461] " jrandom-gcc at i2p dot net
` (7 more replies)
0 siblings, 8 replies; 9+ messages in thread
From: jrandom-gcc at i2p dot net @ 2005-10-20 19:48 UTC (permalink / raw)
To: java-prs
I hate posting bug reports without test cases, but this one
is a bit beyond me - hopefully someone else will know whats up.
Symptom:
java.lang.ArrayIndexOutOfBoundsException
at java.lang.System.arraycopy(java.lang.Object, int, java.lang.Object, int,
int) (/usr/local/gcc-4.0.2/lib/libgcj.so.6.0.0)
at java.util.zip.GZIPInputStream.read(byte[], int, int)
(/usr/local/gcc-4.0.2/lib/libgcj.so.6.0.0)
at java.io.FilterInputStream.read(byte[])
(/usr/local/gcc-4.0.2/lib/libgcj.so.6.0.0)
at net.i2p.i2ptunnel.HTTPResponseOutputStream$Pusher.run()
(/home/jrandom/dev/i2p/build/libi2p.so)
at java.lang.Thread.run() (/usr/local/gcc-4.0.2/lib/libgcj.so.6.0.0)
This occurs on EOF, the buffer passed in to GZIPInputStream is 8KB,
and the length and offset fields are fine too (set by
FilterInputStream as '0, buf.length'). The problem is, I believe,
in the inf.getRemaining() and/or the fixed size buffer in
GZIPInputStream:
byte[] tmp = new byte[8];
// First copy remaining bytes from inflater input buffer.
int avail = inf.getRemaining();
System.arraycopy(this.buf, this.len - avail, tmp, 0, avail);
I have no idea why tmp is 8 bytes long, probably something I don't
understand about zlib. inf.getRemaining() just returns
'z_streamp->avail_in', and from what I can see, that can either be
set explicitly, via inflater.setInput(buf[], off, len), or
implicitly, within zlib's inflate(z_streamp, Z_SYNC_FLUSH).
My very cursory look into inflate(...) leads me nowhere, but
InflaterInputStream.java seems to be allowing arbitrarily large
setInput(buf, 0, buf.length) calls - e.g. line 157. The default
buf.length is 4KB.
Or, maybe is there something in the zlib format such that it will
never have more than 8 bytes uninflated?
FWIW, I'm on the latest zlib (1.2.3) and gcj 4.0.2 (and I haven't
seen any updates on the related classes in gcj's cvsweb)
=jr
--
Summary: array access in either GZIPInputStream, Inflater,
natInflate.cc, or zlib
Product: gcc
Version: 4.0.2
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: java
AssignedTo: unassigned at gcc dot gnu dot org
ReportedBy: jrandom-gcc at i2p dot net
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=24461
^ permalink raw reply [flat|nested] 9+ messages in thread
* [Bug libgcj/24461] array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib
2005-10-20 19:48 [Bug java/24461] New: array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib jrandom-gcc at i2p dot net
@ 2005-10-22 11:57 ` jrandom-gcc at i2p dot net
2005-10-24 19:05 ` tromey at gcc dot gnu dot org
` (6 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: jrandom-gcc at i2p dot net @ 2005-10-22 11:57 UTC (permalink / raw)
To: java-prs
------- Comment #1 from jrandom-gcc at i2p dot net 2005-10-22 11:57 -------
Found the cause & can reproduce it. The bug can be reproduced by dealing with
a truncated gzip stream, as shown below. The fix, I believe, would have
GZIPInputStream using inf.getRemaining() to determine the tmp[] buffer size,
instead of the fixed 8 bytes. Note that classpath does not have the same
GZIPInputStream.read(byte[],int,int), and this bug hasn't been tested on a JVM
using classpath, so it may be gcj-specific.
jrandom@betty /tmp/b $ gcj -o bug --main=gunzipbug gunzipbug.java
jrandom@betty /tmp/b $ ./bug
java.lang.ArrayIndexOutOfBoundsException
at java.lang.System.arraycopy(java.lang.Object, int, java.lang.Object, int,
int) (/usr/local/gcc-4.0.2/lib/libgcj.so.6.0.0)
at java.util.zip.GZIPInputStream.read(byte[], int, int)
(/usr/local/gcc-4.0.2/lib/libgcj.so.6.0.0)
at gunzipbug.main(java.lang.String[]) (Unknown Source)
at gnu.java.lang.MainThread.call_main()
(/usr/local/gcc-4.0.2/lib/libgcj.so.6.0.0)
at gnu.java.lang.MainThread.run() (/usr/local/gcc-4.0.2/lib/libgcj.so.6.0.0)
jrandom@betty /tmp/b $ javac gunzipbug.java
jrandom@betty /tmp/b $ java -cp . gunzipbug
java.io.EOFException: Unexpected end of ZLIB input stream
at java.util.zip.InflaterInputStream.fill(InflaterInputStream.java:215)
at java.util.zip.InflaterInputStream.read(InflaterInputStream.java:134)
at java.util.zip.GZIPInputStream.read(GZIPInputStream.java:87)
at gunzipbug.main(gunzipbug.java:19)
jrandom@betty /tmp/b $ cat gunzipbug.java
import java.util.Random;
import java.util.zip.*;
import java.io.*;
public class gunzipbug {
public static void main(String args[]) {
try {
ByteArrayOutputStream full = new ByteArrayOutputStream(1024);
GZIPOutputStream gzout = new GZIPOutputStream(full);
byte buf[] = new byte[1024];
new Random().nextBytes(buf);
gzout.write(buf);
gzout.close();
byte gzdata[] = full.toByteArray();
// now only read the first 128 bytes of that data
ByteArrayInputStream truncated = new ByteArrayInputStream(gzdata, 0,
128);
GZIPInputStream gzin = new GZIPInputStream(truncated);
byte read[] = new byte[1024];
int cur = 0;
while ( (cur = gzin.read(read, cur, read.length-cur)) != -1)
; //noop
} catch (Exception e) {
e.printStackTrace();
}
}
}
--
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=24461
^ permalink raw reply [flat|nested] 9+ messages in thread
* [Bug libgcj/24461] array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib
2005-10-20 19:48 [Bug java/24461] New: array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib jrandom-gcc at i2p dot net
2005-10-22 11:57 ` [Bug libgcj/24461] " jrandom-gcc at i2p dot net
@ 2005-10-24 19:05 ` tromey at gcc dot gnu dot org
2005-10-24 19:31 ` tromey at gcc dot gnu dot org
` (5 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: tromey at gcc dot gnu dot org @ 2005-10-24 19:05 UTC (permalink / raw)
To: java-prs
--
tromey at gcc dot gnu dot org changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |NEW
Ever Confirmed|0 |1
Last reconfirmed|0000-00-00 00:00:00 |2005-10-24 19:05:27
date| |
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=24461
^ permalink raw reply [flat|nested] 9+ messages in thread
* [Bug libgcj/24461] array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib
2005-10-20 19:48 [Bug java/24461] New: array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib jrandom-gcc at i2p dot net
2005-10-22 11:57 ` [Bug libgcj/24461] " jrandom-gcc at i2p dot net
2005-10-24 19:05 ` tromey at gcc dot gnu dot org
@ 2005-10-24 19:31 ` tromey at gcc dot gnu dot org
2006-02-04 23:51 ` tromey at gcc dot gnu dot org
` (4 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: tromey at gcc dot gnu dot org @ 2005-10-24 19:31 UTC (permalink / raw)
To: java-prs
------- Comment #2 from tromey at gcc dot gnu dot org 2005-10-24 19:31 -------
FWIW, I tried this with jamvm+classpath cvs, and got the expected result.
So it does appear to be gcj-specific.
--
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=24461
^ permalink raw reply [flat|nested] 9+ messages in thread
* [Bug libgcj/24461] array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib
2005-10-20 19:48 [Bug java/24461] New: array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib jrandom-gcc at i2p dot net
` (2 preceding siblings ...)
2005-10-24 19:31 ` tromey at gcc dot gnu dot org
@ 2006-02-04 23:51 ` tromey at gcc dot gnu dot org
2006-03-09 19:02 ` tromey at gcc dot gnu dot org
` (3 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: tromey at gcc dot gnu dot org @ 2006-02-04 23:51 UTC (permalink / raw)
To: java-prs
------- Comment #3 from tromey at gcc dot gnu dot org 2006-02-04 23:51 -------
*** Bug 25948 has been marked as a duplicate of this bug. ***
--
tromey at gcc dot gnu dot org changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |GCC at Stolsvik dot com
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=24461
^ permalink raw reply [flat|nested] 9+ messages in thread
* [Bug libgcj/24461] array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib
2005-10-20 19:48 [Bug java/24461] New: array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib jrandom-gcc at i2p dot net
` (3 preceding siblings ...)
2006-02-04 23:51 ` tromey at gcc dot gnu dot org
@ 2006-03-09 19:02 ` tromey at gcc dot gnu dot org
2006-03-09 20:22 ` tromey at gcc dot gnu dot org
` (2 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: tromey at gcc dot gnu dot org @ 2006-03-09 19:02 UTC (permalink / raw)
To: java-prs
------- Comment #4 from tromey at gcc dot gnu dot org 2006-03-09 19:02 -------
Testing a patch.
--
tromey at gcc dot gnu dot org changed:
What |Removed |Added
----------------------------------------------------------------------------
AssignedTo|unassigned at gcc dot gnu |tromey at gcc dot gnu dot
|dot org |org
Status|NEW |ASSIGNED
Last reconfirmed|2005-10-24 19:05:27 |2006-03-09 19:02:16
date| |
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=24461
^ permalink raw reply [flat|nested] 9+ messages in thread
* [Bug libgcj/24461] array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib
2005-10-20 19:48 [Bug java/24461] New: array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib jrandom-gcc at i2p dot net
` (4 preceding siblings ...)
2006-03-09 19:02 ` tromey at gcc dot gnu dot org
@ 2006-03-09 20:22 ` tromey at gcc dot gnu dot org
2006-03-09 20:25 ` tromey at gcc dot gnu dot org
2006-03-09 20:27 ` tromey at gcc dot gnu dot org
7 siblings, 0 replies; 9+ messages in thread
From: tromey at gcc dot gnu dot org @ 2006-03-09 20:22 UTC (permalink / raw)
To: java-prs
------- Comment #5 from tromey at gcc dot gnu dot org 2006-03-09 20:22 -------
Subject: Bug 24461
Author: tromey
Date: Thu Mar 9 20:21:58 2006
New Revision: 111870
URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=111870
Log:
PR libgcj/24461:
* java/util/zip/InflaterInputStream.java (fill): Throw exception
if stream is truncated.
Modified:
trunk/libjava/ChangeLog
trunk/libjava/java/util/zip/InflaterInputStream.java
--
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=24461
^ permalink raw reply [flat|nested] 9+ messages in thread
* [Bug libgcj/24461] array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib
2005-10-20 19:48 [Bug java/24461] New: array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib jrandom-gcc at i2p dot net
` (5 preceding siblings ...)
2006-03-09 20:22 ` tromey at gcc dot gnu dot org
@ 2006-03-09 20:25 ` tromey at gcc dot gnu dot org
2006-03-09 20:27 ` tromey at gcc dot gnu dot org
7 siblings, 0 replies; 9+ messages in thread
From: tromey at gcc dot gnu dot org @ 2006-03-09 20:25 UTC (permalink / raw)
To: java-prs
------- Comment #6 from tromey at gcc dot gnu dot org 2006-03-09 20:25 -------
Subject: Bug 24461
Author: tromey
Date: Thu Mar 9 20:25:23 2006
New Revision: 111871
URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=111871
Log:
PR libgcj/24461:
* java/util/zip/InflaterInputStream.java (fill): Throw exception
if stream is truncated.
Modified:
branches/gcc-4_1-branch/libjava/ChangeLog
branches/gcc-4_1-branch/libjava/java/util/zip/InflaterInputStream.java
--
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=24461
^ permalink raw reply [flat|nested] 9+ messages in thread
* [Bug libgcj/24461] array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib
2005-10-20 19:48 [Bug java/24461] New: array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib jrandom-gcc at i2p dot net
` (6 preceding siblings ...)
2006-03-09 20:25 ` tromey at gcc dot gnu dot org
@ 2006-03-09 20:27 ` tromey at gcc dot gnu dot org
7 siblings, 0 replies; 9+ messages in thread
From: tromey at gcc dot gnu dot org @ 2006-03-09 20:27 UTC (permalink / raw)
To: java-prs
------- Comment #7 from tromey at gcc dot gnu dot org 2006-03-09 20:27 -------
Fix checked in.
--
tromey at gcc dot gnu dot org changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |RESOLVED
Resolution| |FIXED
Target Milestone|--- |4.1.1
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=24461
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2006-03-09 20:27 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2005-10-20 19:48 [Bug java/24461] New: array access in either GZIPInputStream, Inflater, natInflate.cc, or zlib jrandom-gcc at i2p dot net
2005-10-22 11:57 ` [Bug libgcj/24461] " jrandom-gcc at i2p dot net
2005-10-24 19:05 ` tromey at gcc dot gnu dot org
2005-10-24 19:31 ` tromey at gcc dot gnu dot org
2006-02-04 23:51 ` tromey at gcc dot gnu dot org
2006-03-09 19:02 ` tromey at gcc dot gnu dot org
2006-03-09 20:22 ` tromey at gcc dot gnu dot org
2006-03-09 20:25 ` tromey at gcc dot gnu dot org
2006-03-09 20:27 ` tromey at gcc dot gnu dot org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).