Bug Report: Stack buffer overflow in libparser/java.c

--000000000000f29f9d0641b2d98b
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

In libparser/java.c, there is a fixed-size buffer which is filled with
potentially unbounded-length data due to multiple layers of nesting.

Specifically, an out-of-bounds write to completename can occur due to
unchecked concatenation of nested class names and separators in the '{'
handler. At lines ~91=E2=80=93106, p points into completename and is advanc=
ed via
'*p++ =3D '.';' and 'while (*q) *p++ =3D *q++;' with no bounds checking. Wi=
th
enough nesting or long class names, p exceeds the 1024-byte buffer.

Note: each name component is limited to 511 characters, but there is no
limit on the number of components.

A fix to safely support arbitrary depths should switch to using a heap
buffer which is reallocated as needed to fit the current name.

Note: this bug was found by Theori's Xint Code analysis.

Thanks,
Tim Becker
Theori

--000000000000f29f9d0641b2d98b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div id=3D"m_-4773737140236912699gmail-:q=
k" aria-label=3D"Message Body" role=3D"textbox" aria-multiline=3D"true" sty=
le=3D"direction:ltr;min-height:360px" aria-controls=3D":tc" aria-expanded=
=3D"false">In libparser/java.c, there is a fixed-size buffer which is fille=
d with potentially unbounded-length data due to multiple layers of nesting.=
<br><br>Specifically, an out-of-bounds write to completename can occur due =
to unchecked concatenation of nested class names and separators in the &#39=
;{&#39; handler. At lines ~91=E2=80=93106, p points into completename and i=
s advanced via &#39;*p++ =3D &#39;.&#39;;&#39; and &#39;while (*q) *p++ =3D=
 *q++;&#39; with no bounds checking. With enough nesting or long class name=
s, p exceeds the 1024-byte buffer.<br><br>Note: each name component is limi=
ted to 511 characters, but there is no limit on the number of components.<b=
r><br>A fix to safely support arbitrary depths should switch to using a hea=
p buffer which is reallocated as needed to fit the current name.<br><br>Not=
e: this bug was found by Theori&#39;s Xint Code analysis.<br><br>Thanks,<br=
>Tim Becker<br>Theori</div></div>
</div>

--000000000000f29f9d0641b2d98b--