Skip to content

Commit de7bcd8

Browse files
committed
Reject negative line_number_table_size and fix counters.h macro alignment
A corrupted negative size out-param fell through both branches, leaving line_number_table non-null and untrusted for Deallocate().
1 parent 3d9ccc2 commit de7bcd8

2 files changed

Lines changed: 6 additions & 4 deletions

File tree

ddprof-lib/src/main/cpp/counters.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@
7474
X(UNWINDING_TIME_JVMTI, "unwinding_ticks_jvmti") \
7575
X(CALLTRACE_STORAGE_DROPPED, "calltrace_storage_dropped_traces") \
7676
X(LINE_NUMBER_TABLES, "line_number_tables") \
77-
X(LINE_NUMBER_TABLE_UNREADABLE, "line_number_table_unreadable") \
77+
X(LINE_NUMBER_TABLE_UNREADABLE, "line_number_table_unreadable") \
7878
X(REMOTE_SYMBOLICATION_FRAMES, "remote_symbolication_frames") \
7979
X(REMOTE_SYMBOLICATION_LIBS_WITH_BUILD_ID, "remote_symbolication_libs_with_build_id") \
8080
X(REMOTE_SYMBOLICATION_BUILD_ID_CACHE_HITS, "remote_symbolication_build_id_cache_hits") \

ddprof-lib/src/main/cpp/flightRecorder.cpp

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -394,12 +394,14 @@ void Lookup::fillJavaMethodInfo(MethodInfo *mi, jmethodID method,
394394
line_number_table = nullptr; // make sure the invalid address is not used for jvmti->Deallocate
395395
Counters::increment(LINE_NUMBER_TABLE_UNREADABLE);
396396
}
397-
} else if (line_number_table_size > MAX_LINE_NUMBER_TABLE_ENTRIES) {
397+
} else if (line_number_table_size != 0) {
398398
// A corrupted size out-param alongside a corrupted pointer is exactly
399399
// as plausible as the corrupted-pointer case above (both come from
400400
// the same GetLineNumberTable() call on the same stale jmethodID);
401-
// an implausible entry count means the pointer can't be trusted for
402-
// Deallocate() either, so treat it the same as the unreadable case.
401+
// an implausible entry count -- including a negative one, since this
402+
// is a signed jint and a corrupted value can fall on either side of
403+
// zero -- means the pointer can't be trusted for Deallocate() either,
404+
// so treat it the same as the unreadable case.
403405
line_number_table = nullptr;
404406
Counters::increment(LINE_NUMBER_TABLE_UNREADABLE);
405407
}

0 commit comments

Comments
 (0)