This is the mail archive of the
java@gcc.gnu.org
mailing list for the Java project.
Re: buffer overflow possible in CNI string-handling code?
- From: Tom Tromey <tromey at redhat dot com>
- To: Adam Megacz <gcj at lists dot megacz dot com>
- Cc: java at gcc dot gnu dot org
- Date: 11 Mar 2002 16:12:07 -0700
- Subject: Re: buffer overflow possible in CNI string-handling code?
- References: <86vgc2eod6.fsf@megacz.com>
- Reply-to: tromey at redhat dot com
>>>>> "Adam" == Adam Megacz <gcj@lists.megacz.com> writes:
Adam> char buf2[text->length() + 1];
Adam> buf2[text->length()] = '\0';
Adam> JvGetStringUTFRegion(text, 0, text->length(), buf2);
This code has a bug. text->length() is the length in characters.
These don't map directly onto UTF-8 bytes.
You must use JvGetStringUTFLength to find the length in bytes.
This is because UTF-8 is a variable-length encoding. A single Unicode
character, represented in UTF-8, can take from 1 to 5 (or is it 6?)
bytes.
Adam> If a malicious user sends a huge string for 'text'1, will the
Adam> allocation of buf2 notice that text->length() > stacksize, and
Adam> refuse to proceed (either a crash or an exception is
Adam> acceptable)?.
Assuming you use JvGetStringUTFLength, you'll get a crash, I think.
Eventually our goal is that you'll get StackOverflowError.
Tom