JDK-4883425 : Crash with Sequencer.setSequence
  • Type: Bug
  • Component: client-libs
  • Sub-Component: javax.sound
  • Affected Version: 1.4.1
  • Priority: P3
  • Status: Closed
  • Resolution: Duplicate
  • OS: windows_xp
  • CPU: x86
  • Submitted: 2003-06-24
  • Updated: 2003-06-25
  • Resolved: 2003-06-25
Related Reports
Duplicate :  
JDK-4834374 - MIDI file reader fails for some MIDI files
Description

Name: rmT116609			Date: 06/24/2003


FULL PRODUCT VERSION :
java version "1.4.1_03"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.4.1_03-b02)
Java HotSpot(TM) Client VM (build 1.4.1_03-b02, mixed mode)

java version "1.4.2-beta"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.4.2-beta-b19)
Java HotSpot(TM) Client VM (build 1.4.2-beta-b19, mixed mode)

FULL OS VERSION :
Microsoft Windows XP [Version 5.1.2600]

A DESCRIPTION OF THE PROBLEM :
Crash with Sequencer.setSequence

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
import javax.sound.midi.*;
import java.io.*;

public class MidiCrashBug extends java.applet.Applet{


public static void main(String[] args) throws Exception {
	crash();
}

public void init() {
	try {
	crash();
	}
	catch (Exception e) {
		e.printStackTrace();
	}
}

    public static void crash() throws Exception {
    	
    	byte midData[]={
	0x4D,0x54,0x68,0x64,0x00,0x00,0x00,0x06,0x00,0x01,
	0x00,0x02,0x01,(byte)0x80,0x4D,0x54,0x72,0x6B,0x01,0x01,
	0x01,0x01,0x00,(byte)0xFF,0x01,0x27,0x43,0x72,0x65,0x61,
	0x74,0x6F,0x72,0x3A,0x20,0x47,0x4E,0x55,0x20,0x4C,
	0x69,0x6C,0x79,0x50,0x6F,0x6E,0x64,0x20,0x31,0x2E,
	0x36,0x2E,0x38,0x20,0x20,0x20,0x20,0x20,0x20,0x20,
	0x20,0x20,0x20,0x20,0x20,0x00,(byte)0xFF,0x01,0x3A,0x47,
	0x65,0x6E,0x65,0x72,0x61,0x74,0x65,0x64,0x20,0x61,
	0x75,0x74,0x6F,0x6D,0x61,0x74,0x69,0x63,0x61,0x6C,
	0x6C,0x79,0x20,0x62,0x79,0x3A,0x20,0x47,0x4E,0x55,
	0x20,0x4C,0x69,0x6C,0x79,0x50,0x6F,0x6E,0x64,0x20,
	0x31,0x2E,0x36,0x2E,0x38,0x20,0x20,0x20,0x20,0x20,
	0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x00,(byte)0xFF,0x01,
	0x3C,0x61,0x74,0x20,0x4D,0x6F,0x6E,0x20,0x4A,0x75,
	0x6E,0x20,0x32,0x33,0x20,0x31,0x34,0x3A,0x30,0x39,
	0x3A,0x31,0x37,0x20,0x32,0x30,0x30,0x33,0x20,0x20,
	0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,
	0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,
	0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,
	0x20,0x00,(byte)0xFF,0x01,0x24,0x66,0x72,0x6F,0x6D,0x20,
	0x6D,0x75,0x73,0x69,0x63,0x61,0x6C,0x20,0x64,0x65,
	0x66,0x69,0x6E,0x69,0x74,0x69,0x6F,0x6E,0x3A,0x20,
	0x74,0x65,0x73,0x74,0x2E,0x6C,0x79,0x3A,0x36,0x3A,
	0x31,0x00,(byte)0xFF,0x03,0x07,0x54,0x72,0x61,0x63,0x6B,
	0x20,0x30,0x00,(byte)0xFF,0x2F,0x00,0x4D,0x54,0x72,0x6B,
	0x00,0x00,0x00,0x51,0x00,(byte)0xFF,0x03,0x00,0x00,(byte)0xFF,
	0x51,0x03,0x0C,(byte)0xB7,0x35,0x00,(byte)0xFF,0x04,0x0F,0x62,
	0x72,0x69,0x67,0x68,0x74,0x20,0x61,0x63,0x6F,0x75,
	0x73,0x74,0x69,0x63,0x00,(byte)0xC0,0x01,0x00,(byte)0xFF,0x58,
	0x04,0x03,0x02,0x12,0x08,0x00,(byte)0x90,0x39,(byte)0x7F,(byte)0x83,
	0x00,(byte)0x80,0x39,0x40,0x00,(byte)0x90,0x3B,(byte)0x7F,(byte)0x83,0x00,
	(byte)0x80,0x3B,0x40,0x00,(byte)0x90,0x30,(byte)0x7F,(byte)0x83,0x00,(byte)0x80,
	0x30,0x40,0x00,(byte)0x90,0x32,(byte)0x7F,(byte)0x83,0x00,(byte)0x80,0x32,
	0x40,0x00,(byte)0xFF,0x2F,0x00
        };
    	ByteArrayInputStream bis = new ByteArrayInputStream(midData);


	Sequencer s = MidiSystem.getSequencer();

	s.open();

	    try {
		    BufferedInputStream bus = new BufferedInputStream(bis);
		s.setSequence(bus);
	    } catch (Exception e) {
		e.printStackTrace();
	    }
	    s.close();
    }
}




EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Exception like MidiFileCorruptException
ACTUAL -
C:\entw\java>c:\java\1.4.1\03\jre\bin\java MidiCrashBug

An unexpected exception has been detected in native code outside the VM.
Unexpected Signal : EXCEPTION_ACCESS_VIOLATION occurred at PC=0x6D2C314B
Function=[Unknown.]
Library=C:\java\1.4.1\03\jre\bin\jsound.dll

NOTE: We are unable to locate the function name symbol for the error
      just occurred. Please refer to release documentation for possible
      reason and solutions.


Current Java thread:
        at com.sun.media.sound.MixerSequencer.nOpenMidiSequencer(Native Method)
        at com.sun.media.sound.MixerSequencer.setSequence(MixerSequencer.java:26
4)
        - locked <02AF08A0> (a com.sun.media.sound.MixerSequencer)
        at MidiCrashBug.crash(MidiCrashBug.java:67)
        at MidiCrashBug.main(MidiCrashBug.java:8)

Dynamic libraries:
0x00400000 - 0x00406000         c:\java\1.4.1\03\jre\bin\java.exe
0x77F40000 - 0x77FEE000         C:\WINDOWS\System32\ntdll.dll
0x77E40000 - 0x77F38000         C:\WINDOWS\system32\kernel32.dll
0x77DA0000 - 0x77E3C000         C:\WINDOWS\system32\ADVAPI32.dll
0x78000000 - 0x7807F000         C:\WINDOWS\system32\RPCRT4.dll
0x77BE0000 - 0x77C33000         C:\WINDOWS\system32\MSVCRT.dll
0x6D340000 - 0x6D46B000         c:\java\1.4.1\03\jre\bin\client\jvm.dll
0x77D10000 - 0x77D96000         C:\WINDOWS\system32\USER32.dll
0x77C40000 - 0x77C80000         C:\WINDOWS\system32\GDI32.dll
0x76AF0000 - 0x76B1D000         C:\WINDOWS\System32\WINMM.dll
0x76330000 - 0x7634C000         C:\WINDOWS\System32\IMM32.DLL
0x6D1E0000 - 0x6D1E7000         c:\java\1.4.1\03\jre\bin\hpi.dll
0x6D310000 - 0x6D31E000         c:\java\1.4.1\03\jre\bin\verify.dll
0x6D220000 - 0x6D239000         c:\java\1.4.1\03\jre\bin\java.dll
0x6D330000 - 0x6D33D000         c:\java\1.4.1\03\jre\bin\zip.dll
0x6D000000 - 0x6D105000         C:\java\1.4.1\03\jre\bin\awt.dll
0x72F70000 - 0x72F93000         C:\WINDOWS\System32\WINSPOOL.DRV
0x77180000 - 0x772A1000         C:\WINDOWS\system32\ole32.dll
0x6D2B0000 - 0x6D2D1000         C:\java\1.4.1\03\jre\bin\jsound.dll
0x72C90000 - 0x72C99000         C:\WINDOWS\System32\wdmaud.drv
0x72C80000 - 0x72C88000         C:\WINDOWS\System32\msacm32.drv
0x77BB0000 - 0x77BC4000         C:\WINDOWS\System32\MSACM32.dll
0x77BA0000 - 0x77BA7000         C:\WINDOWS\System32\midimap.dll
0x76C50000 - 0x76C72000         C:\WINDOWS\system32\imagehlp.dll
0x6DA00000 - 0x6DA7D000         C:\WINDOWS\system32\DBGHELP.dll
0x77BD0000 - 0x77BD7000         C:\WINDOWS\system32\VERSION.dll
0x76BB0000 - 0x76BBB000         C:\WINDOWS\System32\PSAPI.DLL

Local Time = Mon Jun 23 18:00:01 2003
Elapsed Time = 1
#
# The exception above was detected in native code outside the VM
#
# Java VM: Java HotSpot(TM) Client VM (1.4.1_03-b02 mixed mode)
#
# An error report file has been saved as hs_err_pid2864.log.

ERROR MESSAGES/STACK TRACES THAT OCCUR :
C:\entw\java>c:\java\1.4.1\03\jre\bin\java MidiCrashBug

An unexpected exception has been detected in native code outside the VM.
Unexpected Signal : EXCEPTION_ACCESS_VIOLATION occurred at PC=0x6D2C314B
Function=[Unknown.]
Library=C:\java\1.4.1\03\jre\bin\jsound.dll

NOTE: We are unable to locate the function name symbol for the error
      just occurred. Please refer to release documentation for possible
      reason and solutions.


Current Java thread:
        at com.sun.media.sound.MixerSequencer.nOpenMidiSequencer(Native Method)
        at com.sun.media.sound.MixerSequencer.setSequence(MixerSequencer.java:26
4)
        - locked <02AF08A0> (a com.sun.media.sound.MixerSequencer)
        at MidiCrashBug.crash(MidiCrashBug.java:67)
        at MidiCrashBug.main(MidiCrashBug.java:8)

Dynamic libraries:
0x00400000 - 0x00406000         c:\java\1.4.1\03\jre\bin\java.exe
0x77F40000 - 0x77FEE000         C:\WINDOWS\System32\ntdll.dll
0x77E40000 - 0x77F38000         C:\WINDOWS\system32\kernel32.dll
0x77DA0000 - 0x77E3C000         C:\WINDOWS\system32\ADVAPI32.dll
0x78000000 - 0x7807F000         C:\WINDOWS\system32\RPCRT4.dll
0x77BE0000 - 0x77C33000         C:\WINDOWS\system32\MSVCRT.dll
0x6D340000 - 0x6D46B000         c:\java\1.4.1\03\jre\bin\client\jvm.dll
0x77D10000 - 0x77D96000         C:\WINDOWS\system32\USER32.dll
0x77C40000 - 0x77C80000         C:\WINDOWS\system32\GDI32.dll
0x76AF0000 - 0x76B1D000         C:\WINDOWS\System32\WINMM.dll
0x76330000 - 0x7634C000         C:\WINDOWS\System32\IMM32.DLL
0x6D1E0000 - 0x6D1E7000         c:\java\1.4.1\03\jre\bin\hpi.dll
0x6D310000 - 0x6D31E000         c:\java\1.4.1\03\jre\bin\verify.dll
0x6D220000 - 0x6D239000         c:\java\1.4.1\03\jre\bin\java.dll
0x6D330000 - 0x6D33D000         c:\java\1.4.1\03\jre\bin\zip.dll
0x6D000000 - 0x6D105000         C:\java\1.4.1\03\jre\bin\awt.dll
0x72F70000 - 0x72F93000         C:\WINDOWS\System32\WINSPOOL.DRV
0x77180000 - 0x772A1000         C:\WINDOWS\system32\ole32.dll
0x6D2B0000 - 0x6D2D1000         C:\java\1.4.1\03\jre\bin\jsound.dll
0x72C90000 - 0x72C99000         C:\WINDOWS\System32\wdmaud.drv
0x72C80000 - 0x72C88000         C:\WINDOWS\System32\msacm32.drv
0x77BB0000 - 0x77BC4000         C:\WINDOWS\System32\MSACM32.dll
0x77BA0000 - 0x77BA7000         C:\WINDOWS\System32\midimap.dll
0x76C50000 - 0x76C72000         C:\WINDOWS\system32\imagehlp.dll
0x6DA00000 - 0x6DA7D000         C:\WINDOWS\system32\DBGHELP.dll
0x77BD0000 - 0x77BD7000         C:\WINDOWS\system32\VERSION.dll
0x76BB0000 - 0x76BBB000         C:\WINDOWS\System32\PSAPI.DLL

Local Time = Mon Jun 23 18:00:01 2003
Elapsed Time = 1
#
# The exception above was detected in native code outside the VM
#
# Java VM: Java HotSpot(TM) Client VM (1.4.1_03-b02 mixed mode)
#
# An error report file has been saved as hs_err_pid2864.log.


With J2SE 1.4.2-beta:
--------------------
The code does not crash, but the VM freezes with the following  thread dump:

C:\>java MidiCrashBug
javax.sound.midi.InvalidMidiDataException: Failed to load sequence
        at com.sun.media.sound.MixerSequencer.setSequence(MixerSequencer.java:28
2)
        at MidiCrashBug.crash(MidiCrashBug.java:67)
        at MidiCrashBug.main(MidiCrashBug.java:8)
Full thread dump Java HotSpot(TM) Client VM (1.4.2-beta-b19 mixed mode):

"DestroyJavaVM" prio=5 tid=0x00035b88 nid=0xd24 waiting on condition [0..7fae0]

"Headspace mixer frame proc thread" daemon prio=10 tid=0x02da3540 nid=0xaac in O
bject.wait() [319f000..319fd94]
        at java.lang.Object.wait(Native Method)
        - waiting on <0x100a0060> (a com.sun.media.sound.MixerThread)
        at java.lang.Object.wait(Object.java:429)
        at com.sun.media.sound.MixerThread.run(MixerThread.java:326)
        - locked <0x100a0060> (a com.sun.media.sound.MixerThread)

"Java Sound event dispatcher" prio=5 tid=0x02da2450 nid=0xcd4 in Object.wait() [
30cf000..30cfd94]
        at java.lang.Object.wait(Native Method)
        - waiting on <0x100a0108> (a com.sun.media.sound.EventDispatcher)
        at java.lang.Object.wait(Object.java:429)
        at com.sun.media.sound.EventDispatcher.dispatchEvents(EventDispatcher.ja
va:317)
        - locked <0x100a0108> (a com.sun.media.sound.EventDispatcher)
        at com.sun.media.sound.EventDispatcher.run(EventDispatcher.java:374)
        at java.lang.Thread.run(Thread.java:534)

"Java Sound event dispatcher" prio=5 tid=0x02da20b8 nid=0xb34 in Object.wait() [
308f000..308fd94]
        at java.lang.Object.wait(Native Method)
        - waiting on <0x100a0180> (a com.sun.media.sound.EventDispatcher)
        at java.lang.Object.wait(Object.java:429)
        at com.sun.media.sound.EventDispatcher.dispatchEvents(EventDispatcher.ja
va:317)
        - locked <0x100a0180> (a com.sun.media.sound.EventDispatcher)
        at com.sun.media.sound.EventDispatcher.run(EventDispatcher.java:374)
        at java.lang.Thread.run(Thread.java:534)

"Signal Dispatcher" daemon prio=10 tid=0x0003dc60 nid=0xcb4 waiting on condition
 [0..0]

"Finalizer" daemon prio=9 tid=0x009c0278 nid=0xb4c in Object.wait() [2b5f000..2b
5fd94]
        at java.lang.Object.wait(Native Method)
        - waiting on <0x100a0288> (a java.lang.ref.ReferenceQueue$Lock)
        at java.lang.ref.ReferenceQueue.remove(ReferenceQueue.java:111)
        - locked <0x100a0288> (a java.lang.ref.ReferenceQueue$Lock)
        at java.lang.ref.ReferenceQueue.remove(ReferenceQueue.java:127)
        at java.lang.ref.Finalizer$FinalizerThread.run(Finalizer.java:159)

"Reference Handler" daemon prio=10 tid=0x009bee48 nid=0x4e0 in Object.wait() [2b
1f000..2b1fd94]
        at java.lang.Object.wait(Native Method)
        - waiting on <0x100a02f0> (a java.lang.ref.Reference$Lock)
        at java.lang.Object.wait(Object.java:429)
        at java.lang.ref.Reference$ReferenceHandler.run(Reference.java:115)
        - locked <0x100a02f0> (a java.lang.ref.Reference$Lock)

"VM Thread" prio=5 tid=0x009fb6f8 nid=0xa68 runnable

"VM Periodic Task Thread" prio=10 tid=0x009fc478 nid=0xb30 waiting on condition

"Suspend Checker Thread" prio=10 tid=0x0003d318 nid=0xc28 runnable

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
import javax.sound.midi.*;
import java.io.*;

public class MidiCrashBug extends java.applet.Applet{


public static void main(String[] args) throws Exception {
	crash();
}

public void init() {
	try {
	crash();
	}
	catch (Exception e) {
		e.printStackTrace();
	}
}

    public static void crash() throws Exception {
    	
    	byte midData[]={
	0x4D,0x54,0x68,0x64,0x00,0x00,0x00,0x06,0x00,0x01,
	0x00,0x02,0x01,(byte)0x80,0x4D,0x54,0x72,0x6B,0x01,0x01,
	0x01,0x01,0x00,(byte)0xFF,0x01,0x27,0x43,0x72,0x65,0x61,
	0x74,0x6F,0x72,0x3A,0x20,0x47,0x4E,0x55,0x20,0x4C,
	0x69,0x6C,0x79,0x50,0x6F,0x6E,0x64,0x20,0x31,0x2E,
	0x36,0x2E,0x38,0x20,0x20,0x20,0x20,0x20,0x20,0x20,
	0x20,0x20,0x20,0x20,0x20,0x00,(byte)0xFF,0x01,0x3A,0x47,
	0x65,0x6E,0x65,0x72,0x61,0x74,0x65,0x64,0x20,0x61,
	0x75,0x74,0x6F,0x6D,0x61,0x74,0x69,0x63,0x61,0x6C,
	0x6C,0x79,0x20,0x62,0x79,0x3A,0x20,0x47,0x4E,0x55,
	0x20,0x4C,0x69,0x6C,0x79,0x50,0x6F,0x6E,0x64,0x20,
	0x31,0x2E,0x36,0x2E,0x38,0x20,0x20,0x20,0x20,0x20,
	0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x00,(byte)0xFF,0x01,
	0x3C,0x61,0x74,0x20,0x4D,0x6F,0x6E,0x20,0x4A,0x75,
	0x6E,0x20,0x32,0x33,0x20,0x31,0x34,0x3A,0x30,0x39,
	0x3A,0x31,0x37,0x20,0x32,0x30,0x30,0x33,0x20,0x20,
	0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,
	0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,
	0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,
	0x20,0x00,(byte)0xFF,0x01,0x24,0x66,0x72,0x6F,0x6D,0x20,
	0x6D,0x75,0x73,0x69,0x63,0x61,0x6C,0x20,0x64,0x65,
	0x66,0x69,0x6E,0x69,0x74,0x69,0x6F,0x6E,0x3A,0x20,
	0x74,0x65,0x73,0x74,0x2E,0x6C,0x79,0x3A,0x36,0x3A,
	0x31,0x00,(byte)0xFF,0x03,0x07,0x54,0x72,0x61,0x63,0x6B,
	0x20,0x30,0x00,(byte)0xFF,0x2F,0x00,0x4D,0x54,0x72,0x6B,
	0x00,0x00,0x00,0x51,0x00,(byte)0xFF,0x03,0x00,0x00,(byte)0xFF,
	0x51,0x03,0x0C,(byte)0xB7,0x35,0x00,(byte)0xFF,0x04,0x0F,0x62,
	0x72,0x69,0x67,0x68,0x74,0x20,0x61,0x63,0x6F,0x75,
	0x73,0x74,0x69,0x63,0x00,(byte)0xC0,0x01,0x00,(byte)0xFF,0x58,
	0x04,0x03,0x02,0x12,0x08,0x00,(byte)0x90,0x39,(byte)0x7F,(byte)0x83,
	0x00,(byte)0x80,0x39,0x40,0x00,(byte)0x90,0x3B,(byte)0x7F,(byte)0x83,0x00,
	(byte)0x80,0x3B,0x40,0x00,(byte)0x90,0x30,(byte)0x7F,(byte)0x83,0x00,(byte)0x80,
	0x30,0x40,0x00,(byte)0x90,0x32,(byte)0x7F,(byte)0x83,0x00,(byte)0x80,0x32,
	0x40,0x00,(byte)0xFF,0x2F,0x00
        };
    	ByteArrayInputStream bis = new ByteArrayInputStream(midData);


	Sequencer s = MidiSystem.getSequencer();

	s.open();

	    try {
		    BufferedInputStream bus = new BufferedInputStream(bis);
		s.setSequence(bus);
	    } catch (Exception e) {
		e.printStackTrace();
	    }
	    s.close();
    }
}

---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
Do not use Midi files
(Review ID: 188997) 
======================================================================
Comments
EVALUATION ###@###.### 2003-06-25 Java Sound's MIDI file reader was vulnerable to corrupt MIDI files. This will be fixed in 1.4.2. It is tracked under bug number 4834374.
25-06-2003