Skip to content

coredump in TryCopyLastError #759

Description

@hnwyllmm

Describe the bug, including details regarding any error messages, version, and platform.

If Consumer throws exception, TryCopyLastError would copy exception message to C buffer. TryCopyLastError assume the string(byte[]) returned by lastError is '\0' terminated and test the length of the string by strlen which result in invalid memory access. In actually, lastError is a UTF8 encoded buffer(byte[]).

The code of TryCopyLastError:

jobjecterror_data=env->GetObjectField(private_data->j_private_data_, kPrivateDataLastErrorField);
...
auto arr=reinterpret_cast<jbyteArray>(error_data);
jbyte*error_bytes=env->GetByteArrayElements(arr, nullptr);
if (!error_bytes) {
private_data->last_error_.clear();
return;
}
char*error_str=reinterpret_cast<char*>(error_bytes);
private_data->last_error_=std::string(error_str, std::strlen(error_str));

The code below shows how lastError be setted:

privateintsetLastError(Throwableerr) {
// Do not let exceptions propagate up to JNItry {
StringWriterbuf = newStringWriter();
PrintWriterwriter = newPrintWriter(buf);
err.printStackTrace(writer);
lastError = buf.toString().getBytes(StandardCharsets.UTF_8);
} catch (Throwablee) {
// Bail out of setting the error message - we'll still return an error codelastError = null;
}
return5; // = EIO
}

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type: bugSomething isn't workinghelp wantedExtra attention is needed

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions