Crashing bug in JVM-1.1.3

Dan Bornstein (danfuzz@communities.com)
Thu, 10 Jul 97 10:39:38 -0800

Message-Id: <199707101845.LAA05396@homer.communities.com>
Subject: Crashing bug in JVM-1.1.3
Date: Thu, 10 Jul 97 10:39:38 -0800
From: Dan Bornstein <danfuzz@communities.com>
To: <jdk-comments@web2.javasoft.com>, <jre-comments@web2.javasoft.com>,

The following script and files demonstrate a bug in the JVM-1.1.3. They
also arguably demonstrate a bug (or at least anomolous behavior) in
javac. While I do not know whether or not the nature of the crash is such
that it's exploitable as a security hole (other than trivially crashing
Java-1.1-based browsers), I figure that it is at least worth checking out.

Note, this report has also been sent through the JavaSoft bug report form.

Dan Bornstein
Electric Communities

#!/bin/csh -f
#
# Demonstrate the java-1.1.3 crash about abstract classes. According to
# the JLS 13.5.3, adding a member to an interface does not break
compatibility
# with pre-existing binaries. However, this example proves that in fact
# doing so can cause the JVM to crash. It seems that javac is covering
# for a bug in the JVM by spitting out "abstract method" descriptors for
# members of an interface implemented by an abstract class that aren't
# otherwise defined by that class; when the new member is added
(obviously)
# such a descriptor is not automatically added to all abstract classes
# that implement that interface.
rm -rf milk
javac -d . Go.java
echo "Proving it works before the mod:"
java milk.crash.Go
javac -d . Int.java
echo "Note that javap -verify incorrectly fails:"
javap -verify milk.crash.Abs
echo "Now making it crash horribly:"
java milk.crash.Go

// BEGIN Go.java

package milk.crash;

interface Int
{
//void meth();
}

abstract class Abs
implements Int
{
}

class Cla
extends Abs
{
public void meth() {
}
}

public class Go
{
static public void main(String[] args) {
System.err.println("Start");
try {
new Cla();
} catch (Throwable t) {
System.out.println("In first new:");
t.printStackTrace();
}
System.err.println("Middle");
new Cla();
System.err.println("End");
}
}

// END Go.java

// BEGIN Int.java

package milk.crash;

interface Int
{
void meth();
}

// END Int.java