[BCEL-309] NegativeArraySizeException when Code attribute length is negative

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 6.2
• Fix Version/s: 6.8.0
• Component/s: Parser
• Assignee: Unassigned
• Reporter: Rohan Padhye
• Created: 23/Aug/18 02:46
• Updated: 17/Jun/23 18:16
• Resolved: 17/Jun/23 18:16

Description

Class parser throws an undocumented NegativeArraySizeException when parsing a malformed class file.

Steps to reproduce:

 

 

Attempt to parse the attached file "Hello.class" using the API

org.apache.bcel.classfile.ClassParser.parse(java.io.InputStream)

 

The file Hello.class was generated automatically by the fuzzer JQF (https://github.com/rohanpadhye/jqf).

Expected output:

ClassFormatException should be thrown as the class file is malformed.

Observed output:

Undocumented run-time exception is thrown:

java.lang.NegativeArraySizeException

at org.apache.bcel.classfile.Code.<init>(Code.java:75)

at org.apache.bcel.classfile.Attribute.readAttribute(Attribute.java:220)

at org.apache.bcel.classfile.FieldOrMethod.<init>(FieldOrMethod.java:109)

at org.apache.bcel.classfile.Method.<init>(Method.java:82)

at org.apache.bcel.classfile.ClassParser.readMethods(ClassParser.java:294)

at org.apache.bcel.classfile.ClassParser.parse(ClassParser.java:153)

 

 

This is probably because the length of the Code attribute in a method is read as a 4-byte signed integer, an an array of that size is allocated without checking to see if the integer is negative.