/hg/icedtea6: 2009-08-27 Kees Cook <kees at canonical.com>

[doko at icedtea.classpath.org]

changeset 24f3605b8aa8 in /hg/icedtea6
details: http://icedtea.classpath.org/hg/icedtea6?cmd=changeset;node=24f3605b8aa8
author: doko at ubuntu.com
date: Thu Aug 27 17:43:31 2009 +0200

	2009-08-27 Kees Cook <kees at canonical.com>

	 * patches/openjdk/oj100103-debugger-socket-overflow.patch:
	New. Fix buffer overflow in debugger's socket handler.
	https://bugs.openjdk.java.net/show_bug.cgi?id=100103


diffstat:

3 files changed, 24 insertions(+)
ChangeLog                                               |    6 +++++
Makefile.am                                             |    1 
patches/openjdk/oj100103-debugger-socket-overflow.patch |   17 +++++++++++++++

diffs (45 lines):

diff -r 1aba471c0799 -r 24f3605b8aa8 ChangeLog
--- a/ChangeLog	Thu Aug 27 17:33:25 2009 +0200
+++ b/ChangeLog	Thu Aug 27 17:43:31 2009 +0200
@@ -1,3 +1,9 @@ 2009-08-27  Matthias Klose  <doko at ubuntu
+2009-08-27  Kees Cook <kees at canonical.com>
+
+	* patches/openjdk/oj100103-debugger-socket-overflow.patch: New.
+	Fix buffer overflow in debugger's socket handler.
+	https://bugs.openjdk.java.net/show_bug.cgi?id=100103
+
 2009-08-27  Matthias Klose  <doko at ubuntu.com>
 
 	* acinclude.m4, configure.ac (FIND_PULSEAUDIO): Remove.
diff -r 1aba471c0799 -r 24f3605b8aa8 Makefile.am
--- a/Makefile.am	Thu Aug 27 17:33:25 2009 +0200
+++ b/Makefile.am	Thu Aug 27 17:43:31 2009 +0200
@@ -706,6 +706,7 @@ ICEDTEA_PATCHES += \
 	patches/icedtea-disable-cc-incompatible-sanity-checks.patch \
 	patches/icedtea-explicit-target-arch.patch \
 	patches/openjdk/6648816.patch \
+	patches/openjdk/oj100103-debugger-socket-overflow.patch \
 	$(DISTRIBUTION_PATCHES)
 
 stamps/extract.stamp: stamps/download.stamp
diff -r 1aba471c0799 -r 24f3605b8aa8 patches/openjdk/oj100103-debugger-socket-overflow.patch
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/patches/openjdk/oj100103-debugger-socket-overflow.patch	Thu Aug 27 17:43:31 2009 +0200
@@ -0,0 +1,17 @@
+Description: buffer not large enough for maximum size of debugger warning.
+ (Largest error could be 73 bytes long: "handshake failed - received >Here's
+ a poke < - excepted >JDWP-Handshake<")
+Ubuntu: https://launchpad.net/bugs/419018
+Upstream: https://bugs.openjdk.java.net/show_bug.cgi?id=100103
+
+--- openjdk/jdk/src/share/transport/socket/socketTransport.c~	2009-08-25 21:19:38.000000000 -0700
++++ openjdk/jdk/src/share/transport/socket/socketTransport.c	2009-08-25 21:19:55.000000000 -0700
+@@ -168,7 +168,7 @@ handshake(int fd, jlong timeout) {
+     }
+     for (i=0; i<(int)strlen(hello); i++) {
+         if (b[i] != hello[i]) {
+-            char msg[64];
++            char msg[80];
+             strcpy(msg, "handshake failed - received >");
+             strncat(msg, b, strlen(hello));
+             strcat(msg, "< - excepted >");