[Bug 123] New: Memory corruption in _svmf_parse_unknown_attribute

http://sablevm.org/bugs/show_bug.cgi?id=123

           Summary: Memory corruption in _svmf_parse_unknown_attribute
           Product: SableVM
           Version: trunk
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: default
        AssignedTo: [email protected]
        ReportedBy: [email protected]
         QAContact: [email protected]


These are steps to reproduce the bug I reported on #sablevm. The memory
corruption is detected by electric fence. I don't have a small testcase, but
it's reproducible. This _might_ involve custom classloaders.

Since there is a SEGV, you need a sablevm built with
--disable-signals-for-exceptions


wget http://mesh.dl.sourceforge.net/sourceforge/nice/Nice-0.9.10-source.tar.gz
cd nice-0.9.10.orig
mkdir cls
cd cls
jar xf ../external/nice-bootstrap.jar
cd ..
ulimit -c unlimited
LD_PRELOAD=/usr/lib/libefence.so /usr/local/src/sablevm/install/bin/sablevm
--classpath cls nice.tools.testsuite.TestNice testsuite/

The output I get is:

  Electric Fence 2.1 Copyright (C) 1987-1998 Bruce Perens.

SableVM version trunk+3839
Copyright (C) 2000-2004 Etienne M. Gagnon <[email protected]> and
others.  All rights reserved.

This software comes with ABSOLUTELY NO WARRANTY.  This is free
software, and you are welcome to redistribute it under certain
conditions.

To get the name of all copyright holders and detailed license
information, type "sablevm --license" or look in the directory
"/usr/local/src/sablevm/install/share/sablevm".

The SableVM web site is located at http://www.sablevm.org/ .

run test engine
  testsuite: testsuite/compiler/statements/variables/scoping.testsuite
zsh: 3469 segmentation fault (core dumped)  LD_PRELOAD=/usr/lib/libefence.so
/usr/local/src/sablevm/install/bin/sablevm

Inspecting the core with gdb:

(gdb) bt
#0  0x40130aaf in memcpy () from /lib/libc.so.6
#1  0x40039f1f in _svmf_parse_unknown_attribute (env=0x48d2a400,
    class_loader_info=0x2c43, pcurrent=0xbfffe910, psize=0xbfffe914,
    length=5247462059016192000, class=0x48999f24, attribute=0x48d2a3f4)
    at class_file_parser.c:1021
#2  0x4003b310 in _svmh_parse_class_attribute (env=0x402a8ee8,
    class_loader_info=0x45c53f64, pcurrent=0xbfffe910, psize=0xbfffe914,
    class=0x48999f24, pattribute=0x48d2a3f0) at class_file_parser.c:1999
#3  0x4003bb6b in _svmh_parse_class_file (env=0x402a8ee8,
    class_loader_info=0x45c53f64, class_file_length=11331,
    class_file_bytes=0x2c43 <Address 0x2c43 out of bounds>, pclass=0x2c43)
    at class_file_parser.c:2347
#4  0x4009059b in Java_java_lang_VMClassLoader_nativeDefineClass (
    _env=0x402a8ee8, _class=0x444b6ff4, cl=0x2c43, name=0x446a6ff4,
    data=0x2c43, offset=0, len=11331, protection_domain=0x2c43)
    at java_lang_VMClassLoader.c:485
#5  0x40260803 in ffi_call_SYSV () from /usr/lib/libffi.so.3
#6  0x402604f3 in ffi_call () from /usr/lib/libffi.so.3
#7  0x40043a5e in _svmf_invoke_native_static (env=0x402a8ee8) at native.c:888
#8  0x4007bf4d in _svmf_interpreter (_env=0x2c43)
    at instructions_preparation_inlined_threaded.c:16717
#9  0x4003102c in _svmh_invoke_static_virtualmachine_createclass (
    env=0x402a8ee8, param_1=0x45e2fff4, param_2=0x446caff4, ret=0x2c43)
    at method_invoke.c:5365
#10 0x40041f66 in _svmf_usercl_create_class (env=0x402a8ee8,
    class_loader_info=0x2c43,
    class_name=0x2c43 <Address 0x2c43 out of bounds>, pclass=0x48d2a400)
    at class_loader.c:994
#11 0x40042020 in _svmh_create_class (env=0x402a8ee8,
    class_loader_info=0x45c53f64, class_name=0x489787a0 "bossa/syntax/fun",
    pclass=0xbfffef04) at class_loader.c:1042
#12 0x4003597b in _svmf_resolve_CONSTANT_Class (env=0x402a8ee8,
#13 0x4003685d in _svmf_resolve_CONSTANT_Methodref (env=0x402a8ee8,
    class=0x48976da0, methodref=0x48979e4c) at resolve.c:441
#14 0x40083610 in _svmf_interpreter (_env=0x2c43)
    at instructions_preparation_inlined_threaded.c:26403
#15 0x40033e7f in _svmh_invoke_specific_static_main (env=0x402a8ee8,
    method=0x45f3a248, param_1=0x4434bff4) at method_invoke.c:6996
#16 0x40091703 in Java_java_lang_VirtualMachine_invokeMain (_env=0x402a8ee8,
    _class=0x44347ff4, mainClass=0x45f37000, args=0x4434bff4) at cast.c:245
#17 0x40260803 in ffi_call_SYSV () from /usr/lib/libffi.so.3
#18 0x402604f3 in ffi_call () from /usr/lib/libffi.so.3
#19 0x40043a5e in _svmf_invoke_native_static (env=0x402a8ee8) at native.c:888
#20 0x4007bf4d in _svmf_interpreter (_env=0x2c43)
    at instructions_preparation_inlined_threaded.c:16717
#21 0x4005f838 in CallStaticVoidMethod (_env=0x402a8ee8, cls=0x402eeff4,
    methodID=0x4139464c) at native_interface.c:14883
#22 0x0804a195 in main (argc=11331, argv=0x2c43) at sablevm.c:1455



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
You are the QA contact for the bug, or are watching the QA contact.