/hg/icedtea6: S4421494, CVE-2010-4476: infinite loop while parsi...
andrew at icedtea.classpath.org
andrew at icedtea.classpath.org
Wed Feb 9 02:47:39 PST 2011
changeset a3ab67013879 in /hg/icedtea6
details: http://icedtea.classpath.org/hg/icedtea6?cmd=changeset;node=a3ab67013879
author: Andrew John Hughes <ahughes at redhat.com>
date: Wed Feb 09 10:47:23 2011 +0000
S4421494, CVE-2010-4476: infinite loop while parsing double literal.
2011-02-09 Andrew John Hughes <ahughes at redhat.com>
* Makefile.am: Add patch.
* NEWS: Updated.
* patches/security/20110209/4421494.patch: Add floating point
bug fix.
diffstat:
4 files changed, 116 insertions(+), 1 deletion(-)
ChangeLog | 7 ++
Makefile.am | 2
NEWS | 2
patches/security/20110209/4421494.patch | 106 +++++++++++++++++++++++++++++++
diffs (148 lines):
diff -r fb1fdfc2f882 -r a3ab67013879 ChangeLog
--- a/ChangeLog Sun Feb 06 13:08:35 2011 +0000
+++ b/ChangeLog Wed Feb 09 10:47:23 2011 +0000
@@ -1,3 +1,10 @@ 2011-02-06 Andrew John Hughes <ahughes
+2011-02-09 Andrew John Hughes <ahughes at redhat.com>
+
+ * Makefile.am: Add patch.
+ * NEWS: Updated.
+ * patches/security/20110209/4421494.patch:
+ Add floating point bug fix.
+
2011-02-06 Andrew John Hughes <ahughes at redhat.com>
* Makefile.am: Add patches below.
diff -r fb1fdfc2f882 -r a3ab67013879 Makefile.am
--- a/Makefile.am Sun Feb 06 13:08:35 2011 +0000
+++ b/Makefile.am Wed Feb 09 10:47:23 2011 +0000
@@ -174,7 +174,7 @@ REWRITER_SRCS = $(abs_top_srcdir)/rewrit
ICEDTEA_FSG_PATCHES =
-SECURITY_PATCHES =
+SECURITY_PATCHES = patches/security/20110209/4421494.patch
ICEDTEA_PATCHES = \
$(SECURITY_PATCHES) \
diff -r fb1fdfc2f882 -r a3ab67013879 NEWS
--- a/NEWS Sun Feb 06 13:08:35 2011 +0000
+++ b/NEWS Wed Feb 09 10:47:23 2011 +0000
@@ -15,6 +15,8 @@ New in release 1.10 (2011-XX-XX):
* Shark provided upstream rather than as part of IcedTea.
* The option --with-openjdk becomes --with-jdk-home and --disable-bootstrap
* Support for building with HotSpot 20 from its stable tree
+* Security updates
+ - S4421494, CVE-2010-4476: infinite loop while parsing double literal.
* Import of OpenJDK6 b21 including upgrade to HotSpot 19
- S6961870: More rebranding fixes for templates/gpl-*-header files
- S6976186: Shark build system changes
diff -r fb1fdfc2f882 -r a3ab67013879 patches/security/20110209/4421494.patch
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/patches/security/20110209/4421494.patch Wed Feb 09 10:47:23 2011 +0000
@@ -0,0 +1,106 @@
+# HG changeset patch
+# User alanb
+# Date 1297019854 0
+# Node ID d00080320e439c339594d380f0322c865553a046
+# Parent f7afe7a5e086a6af1f23dd6304bcbe7fb2b6226a
+4421494: infinite loop while parsing double literal
+Reviewed-by: darcy, alanb
+Contributed-by: dmitry.nadezhin at oracle.com
+
+diff --git a/src/share/classes/sun/misc/FloatingDecimal.java b/src/share/classes/sun/misc/FloatingDecimal.java
+--- openjdk/jdk/src/share/classes/sun/misc/FloatingDecimal.java
++++ openjdk/jdk/src/share/classes/sun/misc/FloatingDecimal.java
+@@ -1547,7 +1547,7 @@ public class FloatingDecimal{
+ if ( (cmpResult = bigB.cmp( bigD ) ) > 0 ){
+ overvalue = true; // our candidate is too big.
+ diff = bigB.sub( bigD );
+- if ( (bigIntNBits == 1) && (bigIntExp > -expBias) ){
++ if ( (bigIntNBits == 1) && (bigIntExp > -expBias+1) ){
+ // candidate is a normalized exact power of 2 and
+ // is too big. We will be subtracting.
+ // For our purposes, ulp is the ulp of the
+diff --git a/test/java/lang/Double/ParseDouble.java b/test/java/lang/Double/ParseDouble.java
+--- openjdk/jdk/test/java/lang/Double/ParseDouble.java
++++ openjdk/jdk/test/java/lang/Double/ParseDouble.java
+@@ -23,11 +23,12 @@
+
+ /*
+ * @test
+- * @bug 4160406 4705734 4707389 4826774 4895911
++ * @bug 4160406 4705734 4707389 4826774 4895911 4421494
+ * @summary Test for Double.parseDouble method and acceptance regex
+ */
+
+ import java.util.regex.*;
++import java.math.BigDecimal;
+
+ public class ParseDouble {
+
+@@ -416,7 +417,15 @@ public class ParseDouble {
+
+ "0x00100p1",
+ "0x00.100p1",
+- "0x001.100p1"
++ "0x001.100p1",
++
++ // Limits
++
++ "1.7976931348623157E308", // Double.MAX_VALUE
++ "4.9e-324", // Double.MIN_VALUE
++ "2.2250738585072014e-308", // Double.MIN_NORMAL
++
++ "2.2250738585072012e-308", // near Double.MIN_NORMAL
+ };
+
+ static String paddedBadStrings[];
+@@ -546,6 +555,42 @@ public class ParseDouble {
+
+ }
+
++ /**
++ * For each subnormal power of two, test at boundaries of
++ * region that should convert to that value.
++ */
++ private static void testSubnormalPowers() {
++ BigDecimal TWO = BigDecimal.valueOf(2);
++ // An ulp is the same for all subnormal values
++ BigDecimal ulp_BD = new BigDecimal(Double.MIN_VALUE);
++
++ System.out.println("Testing subnormal powers of two.");
++ for(int i = -1074; i <= -1022; i++) {
++ double d = Math.scalb(1.0, i);
++
++ /*
++ * The region [d - ulp/2, d + ulp/2] should round to d.
++ */
++ BigDecimal d_BD = new BigDecimal(d);
++
++ BigDecimal lowerBound = d_BD.subtract(ulp_BD.divide(TWO));
++ BigDecimal upperBound = d_BD.add(ulp_BD.divide(TWO));
++
++ double convertedLowerBound = Double.parseDouble(lowerBound.toString());
++ double convertedUpperBound = Double.parseDouble(upperBound.toString());
++
++ if (convertedLowerBound != d) {
++ System.out.printf("Exponent %d, unexpected lower bound converted to %a, not %a.%n",
++ i, convertedLowerBound, d);
++ }
++
++ if (convertedUpperBound != d) {
++ System.out.printf("Exponent %d, unexpected upper bound converted to %a, not %a.%n",
++ i, convertedUpperBound, d);
++ }
++ }
++ }
++
+ public static void main(String[] args) throws Exception {
+ rudimentaryTest();
+
+@@ -558,5 +603,7 @@ public class ParseDouble {
+ testRegex(paddedGoodStrings, false);
+ testRegex(badStrings, true);
+ testRegex(paddedBadStrings, true);
++
++ testSubnormalPowers();
+ }
+ }
More information about the distro-pkg-dev
mailing list