[prev in list] [next in list] [prev in thread] [next in thread] 

List:       openjdk-serviceability-dev
Subject:    Re: RFR(S): 8038233 : Fix unsafe strcpy in Java_sun_tools_attach_{Aix, Bsd, Linux}VirtualMachine_con
From:       Volker Simonis <volker.simonis () gmail ! com>
Date:       2014-03-28 15:41:27
Message-ID: CA+3eh10ESXBmjkS_=i50NMBvsZ4yYaod3mBf7UZbbrDWmk0UsA () mail ! gmail ! com
[Download RAW message or body]

Hi Dimitry,

sorry, but I already pushed the change.

However I don't think this is a big problem because:
- if the file does not exist, connect will fail with "No such file or directory"
- if the file exists by chance (but is not a socket) connect will fail
with "Connection refused"
- if the file exists and is a socket but from another user or with
wrong permissions, connect will fail with "Connection refused"

The only problematic case would be if the file is a listening socket
of another process with appropriate permissions which should be
extremely unlikely.

But in theory you're right - we may want to fix that as well.

Regards,
Volker


On Fri, Mar 28, 2014 at 2:46 PM, Dmitry Samersoff
<dmitry.samersoff@oracle.com> wrote:
> Volker,
>
> I think we should check the length of passed filename and
> throw an exception if filename is too long.
>
> Otherwise we can end up opening wrong file with possibly not expected
> permissions.
>
> -Dmitry
>
> On 2014-03-27 22:08, Volker Simonis wrote:
>> Hi,
>>
>> a security audit for the PPC64/AIX port revealed an unsecure useage of
>> 'strcpy' in Java_sun_tools_attach_AixVirtualMachine_connect(). Because
>> the same coding is also used in the Linux and BSD implementations, the
>> following change fixes them all together:
>>
>> http://cr.openjdk.java.net/~simonis/webrevs/8038233/
>> https://bugs.openjdk.java.net/browse/JDK-8038233
>>
>> Compiled and tested (with the com/sun/jdi, com/sun/tools/attach,
>> com/sun/management and sun/management JTreg tests) on Linux, MacOS X
>> and AIX.
>>
>> Please notice that this fix is also intended for backporting tu 8u.
>>
>> Thank you and best regards,
>> Volker
>>
>
>
> --
> Dmitry Samersoff
> Oracle Java development team, Saint Petersburg, Russia
> * I would love to change the world, but they won't give me the sources.
[prev in list] [next in list] [prev in thread] [next in thread]