Uploaded image for project: 'XalanJ2'
  1. XalanJ2
  2. XALANJ-2146

Byte code generated by XSLTC contains backwards branch when uninitialized object is on stack

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Critical
    • Resolution: Fixed
    • 2.7.1
    • 2.7
    • XSLTC
    • None
    • PatchAvailable

    Description

      Section 4.3.4 of the Java Virtual Machine Specification, 2nd Edition, places the following restriction on Java byte code:

      «A valid instruction sequence must not have an uninitialized object on the operand stack or in a local variable during a backwards branch, or in a local variable in code protected by an exception handler or a finally clause. Otherwise, a devious piece of code might fool the verifier into thinking it had initialized a class instance when it had, in fact, initialized a class instance created in a previous pass through a loop.»

      There are a number of places where XSLTC generates code that violates this requirement; a strict implementation of the verification process described by the JVM specification would detect the invalid byte code. Most popular JVMs do not seem to detect this problem - presumably because their verification is less stringent - but this is a problem that needs to be fixed.

      See copy16.xsl for an example of the offending code sequence. The id function seems to be involved in all cases that pose a problem.

      Attachments

        1. patch.j2146.txt
          39 kB
          Henry Zongaro

        Activity

          People

            zongaro@ca.ibm.com Henry Zongaro
            zongaro@ca.ibm.com Henry Zongaro
            Christine Li Christine Li
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: