JDK-8129786 : Buffer overrun when passing long not existing option in JDK 9
  • Type: Bug
  • Component: hotspot
  • Sub-Component: runtime
  • Affected Version: 9
  • Priority: P2
  • Status: Closed
  • Resolution: Fixed
  • Submitted: 2015-06-24
  • Updated: 2017-08-16
  • Resolved: 2015-07-02
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 9
9 b74Fixed
Related Reports
Relates :  
Description
Running following command(in cygwin, abort6_options.txt is attached) cause JDK 9-b64 to exit with bad code(127) on Windows platforms:
./java.exe `cat abort6_options.txt` -version

Also, this command print nothing. Similar problem occur on MaxOS.

On the other hand, when Java runs with -XX:+IgnoreUnrecognizedVMOptions added, then it successfully exit:
java.exe `cat ~/abort6_options.txt` -XX:+IgnoreUnrecognizedVMOptions -version
java version "1.9.0-ea-fastdebug"
Java(TM) SE Runtime Environment (build 1.9.0-ea-fastdebug-b64)
Java HotSpot(TM) 64-Bit Server VM (build 1.9.0-ea-b64, mixed mode)

Fix for JDK-8073989 add strip of the unrecognized VM option in Arguments::process_argument before passing to the is_newly_obsolete function:
  // Construct a string which consists only of the argument name without '+', '-', or '='.
  char stripped_argname[256];
  strncpy(stripped_argname, argname, arg_len);
  stripped_argname[arg_len] = '\0'; //strncpy doesn't null terminate.

arg_len in this case equal to the length of the option name. Thus, if we pass option with very long name(longer than 256), then buffer overrun can occur when copy argname to the stripped_argname in strncpy function since stripped_argname is 256 bytes long.