RFR: 8376855: ASAN reports out-of-range read in strncmp in MethodHandles::is_basic_type_signature

David Holmes dholmes at openjdk.org
Mon Feb 2 01:21:41 UTC 2026


An ASAN enabled build reported heap-buffer-overflow in `MethodHandles::is_basic_type_signature` with `ASAN_OPTIONS=strict_string_checks=true` when running test `jdk/jdk/jfr/api/metadata/annotations/TestThrottle.java`

The code is here:

bool MethodHandles::is_basic_type_signature(Symbol* sig) {
  assert(vmSymbols::object_signature()->utf8_length() == (int)OBJ_SIG_LEN, "");
  assert(vmSymbols::object_signature()->equals(OBJ_SIG), "");
  for (SignatureStream ss(sig, sig->starts_with(JVM_SIGNATURE_FUNC)); !ss.is_done(); ss.next()) {
    switch (ss.type()) {
    case T_OBJECT:
      // only java/lang/Object is valid here
      if (strncmp((char*) ss.raw_bytes(), OBJ_SIG, OBJ_SIG_LEN) != 0)

The ASAN `strncmp` interceptor acts as follows:

INTERCEPTOR(int, strncmp, const char *s1, const char *s2, size_t n) {
  void *ctx;
  ASAN_INTERCEPTOR_ENTER(linker, strncmp); // Sets up context
  ASAN_READ_RANGE(s1, n); // Validates s1
  ASAN_READ_RANGE(s2, n); // Validates s2
  return REAL(strncmp)(s1, s2, n); // Calls original function
}

With the test given `s1` is a buffer of size 15, containing a non-nul-terminated string, and `n` is 18, so `ASAN_READ_RANGE` fails for `s1` as we could potentially read beyond the end of the buffer. In practice however, given `s1` is guaranteed to be a valid type-string from a signature symbol of type `T_OBJECT`, its final character is `;` and the final character of `s2` is also `;` (it is the string constant `Ljava/lang/Object;`). Hence the comparison must terminate before we can run off the end of `s1`.

To appease ASAN we can make a simple change to the `strncmp` call to compare at most `ss.raw_length()` bytes. 

Testing 
 - ASAN no longer reports an error
 - tiers 1-3 sanity

Thanks

-------------

Commit messages:
 - copyright-year
 - 8376855: ASAN reports out-of-range read in strncmp in MethodHandles::is_basic_type_signature

Changes: https://git.openjdk.org/jdk/pull/29516/files
  Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=29516&range=00
  Issue: https://bugs.openjdk.org/browse/JDK-8376855
  Stats: 2 lines in 1 file changed: 0 ins; 0 del; 2 mod
  Patch: https://git.openjdk.org/jdk/pull/29516.diff
  Fetch: git fetch https://git.openjdk.org/jdk.git pull/29516/head:pull/29516

PR: https://git.openjdk.org/jdk/pull/29516


More information about the hotspot-dev mailing list