[LOG4J2-2650] ArrayIndexOutOfBoundsException in the initialization of UuidUtil

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.12.0
• Fix Version/s: 2.12.1
• Component/s: Core

Environment

os : Mac OS

java: 1.8 (jdk1.8.0_172.jdk)

none network interfaces connected

• Assignee: Unassigned
• Reporter: Mattia Bertorello
• Created: 02/Jul/19 12:32
• Updated: 21/Dec/20 13:13
• Resolved: 29/Jul/19 02:30

Description

Hi, 

I found a problem in the UuidUtil initialization.

The code that generate the exception

  private static Logger log = LogManager.getLogger(MyClass.class);

This code return a ip address of localhost and when the stack is IPv4 return 4 bytes but when the default stack is IPv6 it's going to return 16 bytes.
 NetUtils.java#L108

if (mac == null || mac.length == 0) { 
   mac = localHost.getAddress(); 
}

This is the part that generate the ArrayIndexOutOfBoundsException

 UuidUtil.java#L81

System.arraycopy(mac, index, node, index + 2, length);

These 16 bytes will generate a wrong destination index that exceed the length of the node array.

mac = {byte[16]@3217} 
length = 6 
index = 10 
node = {byte[8]@3222}

This is the complete exception  

java.lang.ExceptionInInitializerError at org.apache.logging.log4j.core.util.WatchManager.<init>(WatchManager.java:53) at org.apache.logging.log4j.core.config.AbstractConfiguration.<init>(AbstractConfiguration.java:135) at org.apache.logging.log4j.core.config.NullConfiguration.<init>(NullConfiguration.java:32) at org.apache.logging.log4j.core.LoggerContext.<clinit>(LoggerContext.java:79) at org.apache.logging.log4j.core.selector.ClassLoaderContextSelector.createContext(ClassLoaderContextSelector.java:171) at org.apache.logging.log4j.core.selector.ClassLoaderContextSelector.locateContext(ClassLoaderContextSelector.java:145) at org.apache.logging.log4j.core.selector.ClassLoaderContextSelector.getContext(ClassLoaderContextSelector.java:70) at org.apache.logging.log4j.core.selector.ClassLoaderContextSelector.getContext(ClassLoaderContextSelector.java:57) at org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContextFactory.java:148) at org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContextFactory.java:45) at org.apache.logging.log4j.LogManager.getContext(LogManager.java:194) at org.apache.logging.log4j.LogManager.getLogger(LogManager.java:581) at cc.arduino.contributions.packages.ContributionInstaller.<clinit>(ContributionInstaller.java:66) at processing.app.Base.<init>(Base.java:291) at processing.app.Base.main(Base.java:150) Caused by: java.lang.ArrayIndexOutOfBoundsException at java.lang.System.arraycopy(Native Method) at org.apache.logging.log4j.core.util.UuidUtil.<clinit>(UuidUtil.java:81) ... 15 more

To reproduce the exception you need

• disconnect every network interface
• verify that java will use the IPv6 stack -Djava.net.preferIPv4Stack=false -Djava.net.preferIPv6Addresses=true
• Initialize a log of log4j

I suggest different solution:

• Remove  NetUtils.java#L108 and return always null (when the other code fail to init the mac variable ) because in general the method is called getMacAddress but in that particular case will return and IP address 
• Mange the IPv6 case in the static part of the class UuidUtil UuidUtil.java#L81

Issue Links

• is cloned by: LOG4J2-2980 CLONE - ArrayIndexOutOfBoundsException in the initialization of UuidUtil
• links to: GitHub Pull Request #290