JDK-4675817 : REGRESSION: Crash occurs loading a JPEG from a signed jar
  • Type: Bug
  • Component: tools
  • Sub-Component: jar
  • Affected Version: 1.2.0,1.4.0,1.4.1
  • Priority: P3
  • Status: Closed
  • Resolution: Duplicate
  • OS: windows_2000,windows_xp
  • CPU: x86
  • Submitted: 2002-04-26
  • Updated: 2003-05-01
  • Resolved: 2003-05-01
Related Reports
Duplicate :  
Duplicate :  
Relates :  
Description

Name: rmT116609			Date: 04/26/2002


FULL PRODUCT VERSION :
java version "1.4.0"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.4.0-b92)
Java HotSpot(TM) Client VM (build 1.4.0-b92, mixed mode)

FULL OPERATING SYSTEM VERSION :

Microsoft Windows 2000 [Version 5.00.2195]

A DESCRIPTION OF THE PROBLEM :
Signing my application with a self-generated certificate makes the HotSpot(HS) crash.

Not signing the application helps - HS does not crash.

REGRESSION.  Last worked in version 1.3.1_03

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
1. Create a Swing application that reads a JPG image
2. Create a self-signed certificate with keytool
3. Sign the Swing application with the certificate and signjar
4. run the application from the command line

EXPECTED VERSUS ACTUAL BEHAVIOR :
Expected: Application showing a JPEG image
Actual: HS crashes with 'unexpected exception'

ERROR MESSAGES/STACK TRACES THAT OCCUR :

An unexpected exception has been detected in native code outside the VM.
Unexpected Signal : EXCEPTION_ACCESS_VIOLATION occurred at PC=0x6D2834C1
Function=JNI_OnLoad+0x249
Library=D:\jdk1.4\jre\bin\jpeg.dll

Current Java thread:
	at sun.awt.image.JPEGImageDecoder.readImage(Native Method)
	at sun.awt.image.JPEGImageDecoder.produceImage
(JPEGImageDecoder.java:144)
	at sun.awt.image.InputStreamImageSource.doFetch
(InputStreamImageSource.java:257)
	at sun.awt.image.ImageFetcher.fetchloop(ImageFetcher.java:214)
	at sun.awt.image.ImageFetcher.run(ImageFetcher.java:182)

Dynamic libraries:
0x00400000 - 0x00406000 	d:\jdk1.4\bin\java.exe
0x77F80000 - 0x77FFA000 	C:\WINNT\System32\ntdll.dll
0x77DB0000 - 0x77E0A000 	C:\WINNT\system32\ADVAPI32.dll
0x77E80000 - 0x77F35000 	C:\WINNT\system32\KERNEL32.DLL
0x77D40000 - 0x77DB0000 	C:\WINNT\system32\RPCRT4.DLL
0x78000000 - 0x78046000 	C:\WINNT\system32\MSVCRT.dll
0x6D330000 - 0x6D442000 	d:\jdk1.4\jre\bin\client\jvm.dll
0x77E10000 - 0x77E74000 	C:\WINNT\system32\USER32.dll
0x77F40000 - 0x77F7C000 	C:\WINNT\system32\GDI32.DLL
0x77570000 - 0x775A0000 	C:\WINNT\System32\WINMM.dll
0x6D1D0000 - 0x6D1D7000 	d:\jdk1.4\jre\bin\hpi.dll
0x6D300000 - 0x6D30D000 	d:\jdk1.4\jre\bin\verify.dll
0x6D210000 - 0x6D228000 	d:\jdk1.4\jre\bin\java.dll
0x6D320000 - 0x6D32D000 	d:\jdk1.4\jre\bin\zip.dll
0x6D000000 - 0x6D0F6000 	D:\jdk1.4\jre\bin\awt.dll
0x77800000 - 0x7781D000 	C:\WINNT\System32\WINSPOOL.DRV
0x75E60000 - 0x75E7A000 	C:\WINNT\System32\IMM32.dll
0x77A50000 - 0x77B45000 	C:\WINNT\system32\ole32.dll
0x6D2D0000 - 0x6D2DD000 	D:\jdk1.4\jre\bin\net.dll
0x75050000 - 0x75058000 	C:\WINNT\System32\WSOCK32.dll
0x75030000 - 0x75044000 	C:\WINNT\System32\WS2_32.DLL
0x75020000 - 0x75028000 	C:\WINNT\System32\WS2HELP.DLL
0x78280000 - 0x7828C000 	C:\WINNT\System32\rnr20.dll
0x77980000 - 0x779A4000 	C:\WINNT\System32\DNSAPI.DLL
0x777E0000 - 0x777E8000 	C:\WINNT\System32\winrnr.dll
0x77950000 - 0x77979000 	C:\WINNT\system32\WLDAP32.DLL
0x777F0000 - 0x777F5000 	C:\WINNT\System32\rasadhlp.dll
0x77830000 - 0x7783E000 	C:\WINNT\System32\RTUTILS.DLL
0x74FD0000 - 0x74FED000 	C:\WINNT\system32\msafd.dll
0x77340000 - 0x77353000 	C:\WINNT\System32\IPHLPAPI.DLL
0x77520000 - 0x77525000 	C:\WINNT\System32\ICMP.DLL
0x77320000 - 0x77337000 	C:\WINNT\System32\MPRAPI.DLL
0x75150000 - 0x7515F000 	C:\WINNT\System32\SAMLIB.DLL
0x75170000 - 0x751BF000 	C:\WINNT\System32\NETAPI32.DLL
0x77BE0000 - 0x77BEF000 	C:\WINNT\System32\SECUR32.DLL
0x751C0000 - 0x751C6000 	C:\WINNT\System32\NETRAP.DLL
0x779B0000 - 0x77A45000 	C:\WINNT\system32\OLEAUT32.DLL
0x773B0000 - 0x773DE000 	C:\WINNT\System32\ACTIVEDS.DLL
0x77380000 - 0x773A2000 	C:\WINNT\System32\ADSLDPC.DLL
0x77880000 - 0x7790D000 	C:\WINNT\System32\SETUPAPI.DLL
0x77C10000 - 0x77C6D000 	C:\WINNT\System32\USERENV.DLL
0x774E0000 - 0x77512000 	C:\WINNT\System32\RASAPI32.DLL
0x774C0000 - 0x774D1000 	C:\WINNT\System32\RASMAN.DLL
0x77530000 - 0x77552000 	C:\WINNT\System32\TAPI32.DLL
0x77B50000 - 0x77BD9000 	C:\WINNT\system32\COMCTL32.DLL
0x77C70000 - 0x77CBA000 	C:\WINNT\system32\SHLWAPI.DLL
0x77360000 - 0x77379000 	C:\WINNT\System32\DHCPCSVC.DLL
0x691D0000 - 0x69255000 	C:\WINNT\System32\CLBCATQ.DLL
0x75010000 - 0x75017000 	C:\WINNT\System32\wshtcpip.dll
0x6D180000 - 0x6D1D0000 	D:\jdk1.4\jre\bin\fontmanager.dll
0x6E420000 - 0x6E426000 	C:\WINNT\System32\INDICDLL.dll
0x6D280000 - 0x6D29E000 	D:\jdk1.4\jre\bin\jpeg.dll
0x77920000 - 0x77942000 	C:\WINNT\system32\imagehlp.dll
0x72A00000 - 0x72A2D000 	C:\WINNT\system32\DBGHELP.dll
0x690A0000 - 0x690AB000 	C:\WINNT\System32\PSAPI.DLL

Local Time = Thu Mar 21 08:35:20 2002
Elapsed Time = 3
#
# The exception above was detected in native code outside the VM
#
# Java VM: Java HotSpot(TM) Client VM (1.4.0-b92 mixed mode)
#

This bug can be reproduced always.

---------- BEGIN SOURCE ----------
package com.oce.hubble;

import java.awt.*;
import java.awt.event.*;

import javax.swing.*;
import javax.swing.event.*;

public class HSMain {
	private JFrame mainFrame;

  private void createHubbleLabel(Container contentPane) {
	  Icon icon;
	  JLabel hubbleLabel;

	  icon = new ImageIcon(getClass().getResource("S82E5718_n.jpg"));

	  hubbleLabel = new JLabel(icon);
	  hubbleLabel.setBorder(BorderFactory.createLoweredBevelBorder());
	  hubbleLabel.setToolTipText("Space telescope Hubble in repair");

	  contentPane.add(hubbleLabel,BorderLayout.NORTH);
  }


  private void createMainFrame() {
	  Container contentPane;
	  mainFrame = new JFrame("Hubble");
	  ImageIcon icon;

	contentPane = mainFrame.getContentPane();

	createHubbleLabel(contentPane);

	mainFrame.setResizable(false);
	mainFrame.setDefaultCloseOperation(WindowConstants.DO_NOTHING_ON_CLOSE);

	mainFrame.addWindowListener(new WindowAdapter() {
	  public void windowClosing(WindowEvent evt) {
		String title;
		String msg;
		int options;

		title = "Exit?";
		msg = "Closing this window will close the application";
		options = JOptionPane.YES_NO_OPTION;
		if ( JOptionPane.showConfirmDialog(mainFrame,
		  msg,title,options) == JOptionPane.YES_OPTION) {
			 ((JFrame)evt.getSource()).dispose();
		}
	  }

	  public void windowClosed(WindowEvent evt) {
		System.exit(0);
	  }
	});

	mainFrame.pack();
  }


	public HSMain(String[] args) throws Exception {
		createMainFrame();
	}

	public void run() {
	  mainFrame.setVisible(true);
	}

	public static void main(String[] args) throws Throwable {
	  try {
		JDialog.setDefaultLookAndFeelDecorated(true);
		JFrame.setDefaultLookAndFeelDecorated(true);
	} catch(Throwable t) {
	   //ignore, 'wrong' jdk version
	}

		new HSMain(args).run();
	}
}
---------- END SOURCE ----------

CUSTOMER WORKAROUND :
Do not sign code or use JDK1.3.1_03

Release Regression From : 1.3.1_03
The above release value was the last known release where this 
bug was known to work. Since then there has been a regression.

(Review ID: 144447) 
======================================================================

Name: rmT116609			Date: 04/26/2002


FULL PRODUCT VERSION :
java version "1.4.0"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.4.0-b92)
Java HotSpot(TM) Client VM (build 1.4.0-b92, mixed mode)

FULL OPERATING SYSTEM VERSION :
Microsoft Windows XP [Version 5.1.2600]

EXTRA RELEVANT SYSTEM CONFIGURATION :
 Toshiba Satellite 1800 laptop. Trident display system.

A DESCRIPTION OF THE PROBLEM :
I have a jarfile that contains the project classes and also all the images required by our gui.  When I run it on the command line against an unsigned version of the jar, the application loads fine.  If I then sign that jar, the application dies with the following:

[Mon Apr 22 11:37:56 MDT 2002] getImage: images/splash.gif

An unexpected exception has been detected in native code
outside the VM.
Unexpected Signal : EXCEPTION_ACCESS_VIOLATION occurred at
PC=0x6D2834C1
Function=JNI_OnLoad+0x249
Library=C:\Program Files\Java\j2re1.4.0\bin\jpeg.dll

Current Java thread:
        at sun.awt.image.JPEGImageDecoder.readImage(Native
Method)
        at sun.awt.image.JPEGImageDecoder.produceImage
(JPEGImageDecoder.java:144)
        at sun.awt.image.InputStreamImageSource.doFetch
(InputStreamImageSource.java:257)
        at sun.awt.image.ImageFetcher.fetchloop
(ImageFetcher.java:214)
        at sun.awt.image.ImageFetcher.run
(ImageFetcher.java:182)

.... many many lines of DLL listings left out.....

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
1. Compile the code below.

2. Place a GIF file in the same directory as the class.

3. Execute 'java ImageBug'.  The VM will start and the
program will exit normally with no output.

4. Execute 'jar cvf imagebug.jar'.  Point your classpath to
that jar and execute 'java ImageBug' outside the sourcce
directory to make sure it's the jar you're pointing at.
The VM will start and the program will exit normally with
no output.

5. Sign the jar.

6. Execute 'java ImageBug'.  The program will explode
giving a native code exception.

EXPECTED VERSUS ACTUAL BEHAVIOR :
What should happen at step 6 is that the VM should run and
the program should exit normally with no output.  What DOES
happen is it explodes with the native code exception.

ERROR MESSAGES/STACK TRACES THAT OCCUR :
Adminstration@NOMAD ~
$ java ImageBug

An unexpected exception has been detected in native code outside the VM.
Unexpected Signal : EXCEPTION_ACCESS_VIOLATION occurred at PC=0x6D2834C1
Function=JNI_OnLoad+0x249
Library=C:\Program Files\Java\j2re1.4.0\bin\jpeg.dll

Current Java thread:
        at sun.awt.image.JPEGImageDecoder.readImage(Native Method)
        at sun.awt.image.JPEGImageDecoder.produceImage
(JPEGImageDecoder.java:144)
        at sun.awt.image.InputStreamImageSource.doFetch
(InputStreamImageSource.java:257)
        at sun.awt.image.ImageFetcher.fetchloop(ImageFetcher.java:214)
        at sun.awt.image.ImageFetcher.run(ImageFetcher.java:182)

Dynamic libraries:
0x00400000 - 0x00406000         c:\WINDOWS\system32\java.exe
0x77F50000 - 0x77FF9000         C:\WINDOWS\System32\ntdll.dll
0x77E60000 - 0x77F45000         C:\WINDOWS\system32\kernel32.dll
0x77DD0000 - 0x77E5B000         C:\WINDOWS\system32\ADVAPI32.dll
0x77CC0000 - 0x77D35000         C:\WINDOWS\system32\RPCRT4.dll
0x77C10000 - 0x77C63000         C:\WINDOWS\system32\MSVCRT.dll
0x6D330000 - 0x6D442000         C:\Program Files\Java\j2re1.4.0
\bin\client\jvm.dll
0x77D40000 - 0x77DCD000         C:\WINDOWS\system32\USER32.dll
0x77C70000 - 0x77CB0000         C:\WINDOWS\system32\GDI32.dll
0x76B40000 - 0x76B6C000         c:\WINDOWS\system32\WINMM.dll
0x6D1D0000 - 0x6D1D7000         C:\Program Files\Java\j2re1.4.0\bin\hpi.dll
0x6D300000 - 0x6D30D000         C:\Program Files\Java\j2re1.4.0\bin\verify.dll
0x6D210000 - 0x6D228000         C:\Program Files\Java\j2re1.4.0\bin\java.dll
0x6D320000 - 0x6D32D000         C:\Program Files\Java\j2re1.4.0\bin\zip.dll
0x6D000000 - 0x6D0F6000         C:\Program Files\Java\j2re1.4.0\bin\awt.dll
0x73000000 - 0x73023000         c:\WINDOWS\system32\WINSPOOL.DRV
0x76390000 - 0x763AA000         c:\WINDOWS\system32\IMM32.dll
0x771B0000 - 0x772CA000         C:\WINDOWS\system32\ole32.dll
0x6D180000 - 0x6D1D0000         C:\Program Files\Java\j2re1.4.0
\bin\fontmanager.dll
0x73760000 - 0x737A5000         c:\WINDOWS\system32\DDRAW.dll
0x73BC0000 - 0x73BC6000         c:\WINDOWS\system32\DCIMAN32.dll
0x69000000 - 0x690E2000         c:\WINDOWS\system32\tridicdf.dll
0x6D280000 - 0x6D29E000         C:\Program Files\Java\j2re1.4.0\bin\jpeg.dll
0x76C90000 - 0x76CB2000         C:\WINDOWS\system32\imagehlp.dll
0x6D510000 - 0x6D58C000         C:\WINDOWS\system32\DBGHELP.dll
0x77C00000 - 0x77C07000         C:\WINDOWS\system32\VERSION.dll
0x76BF0000 - 0x76BFB000         c:\WINDOWS\system32\PSAPI.DLL

Local Time = Mon Apr 22 12:00:30 2002
Elapsed Time = 2
#
# The exception above was detected in native code outside the VM
#
# Java VM: Java HotSpot(TM) Client VM (1.4.0-b92 mixed mode)
#
# An error report file has been saved as hs_err_pid3176.log.
# Please refer to the file for further information.
#

This bug can be reproduced always.

---------- BEGIN SOURCE ----------
import javax.swing.ImageIcon;

public class ImageBug {

    public static void main(String args[]) {

        ImageIcon image = new ImageIcon(ImageBug.class.getResource
("image.gif"));

    }
}
---------- END SOURCE ----------


(Review ID: 145741)
======================================================================

Comments
WORK AROUND The bug will not manifest if the JAR file is not compressed. The workaround is to leave the JAR file/entries uncompressed. ###@###.### 2002-12-05
05-12-2002

EVALUATION There seems to be a problem in the method sun_jpeg_fill_suspended_buffer (in jpegdecoder.c) in which memcpy() is being fed a negative value for offset, thus causing the crash. It is not yet clear why this is happening only in the case of signed JAR files, and it only seems to be provoked with certain JPEG files. It may be a problem with how we read bytes from the input stream, but in any case, we should not be crashing in native code. ###@###.### 2002-06-17 After some discussion with ###@###.###, it appears that this is a Tools/Libraries bug in ZipFileInputStream. Refer to the following email thread: --------------- Hi Chris- You are right, it is a bug. I am not sure we can fix it for Mantis though, since it would introduce incompatibilities with existing code. We should probably target it for Tiger. Konstantin Hi Konstantin, I have a couple of ImageIO/JAR related bugs assigned to me, and since it appears (from bugtraq) that you handle JAR issues, I was hoping you could help me solve some problems. First, there is 4675817 (REGRESSION: Crash occurs loading a JPEG from a signed jar). I've verified that this bug started failing in Merlin, but I'm not quite sure why. I've been digging around some old bugs (4214785, 4198073) and the InputStream.available() method (specifically the Inflater/Zip/ZipFile variants of InputStream). I was curious why the change was made for Inflater/ZipInputStream to return 1 at all times from available() (see 4109069), but a similar change wasn't made to ZipFileInputStream. When I hacked in a change to ZFIS.available() so that it always returns 1, the bug in 4675817 goes away... The JPEG reader buffer fills at a constant pace, whereas before ZFIS.available() was returning the total size of the uncompressed data, even though it wasn't yet available to the JPEG decoder. This caused a negative offset to be passed to memcpy(), crashing the VM. So I guess the first question is, should ZFIS follow the same modified spec of InflaterInputStream and ZipInputStream for available()? ------------ Based on this evaluation, I'm transferring this bug to T&L for investigation. ###@###.### 2002-09-19 Probably a duplicate of 4401122. We will attempt to fix this in the next feature release. ###@###.### 2002-12-04
19-09-2002