lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <3da3d8310603281953q12efdf4cs52b2e5af019af1bd@mail.gmail.com>
Date: Wed Mar 29 04:53:55 2006
From: degeneracypressure at gmail.com (Eliah Kagan)
Subject: Re: Java integer overflows (was: a really long
	topic)

> On 3/29/06, Andrew van der Stock wrote:
> > This is not quite true.
> >
> > Java does not prevent integer overflows (it will not throw an
> > exception). So you still have to be careful about array indexes.

On 3/28/06, michaelslists@...il.com replied:
> No you dont.
>
> Arrays are all bounds checked; ..., that is, the following code will
> throw an exception:
>
> ================================
> class Foo {
>   static {
>     int[] m = new int[2];
>     System.out.println(m[34]);
>   }
> }
> ================================
>
>
> What do you mean by "overflow"? Do you mean this?
>
> ================================
> class Foo {
>   static {
>     int m = Integer.MAX_VALUE;
>     int k = Integer.MAX_VALUE + Integer.MAX_VALUE;
>     System.out.println(m);
>     System.out.println(k);
>     System.exit(0);
>   }
> }
> ================================
>
> if so, I don't see how that is an issue.
>
> -- Michael

That is an issue in a limited way--if you are trying to access a
record with a high enough number (say by adding a number to a previous
array index), you might end up accessing a record with a low number,
which could potentially compromise the security of an application if
certain assumptions are made. But this would only be within the same
array that is already being accessed. The risk is minimal compared to
the risks of accessing past the end of an array in, say, C.

Even with bounds checking, there is no general way for a programming
language to stop the programmer from writing a program that accesses
the wrong piece of data in within a data structure, causing a security
problem. Java was never designed to solve this sort of problem. Java
does abstract data access so that many common bugs like buffer
overflows are prevented, which is very useful.

-Eliah

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ