Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8269630

Bad clipboard data causes JVM to crash

    XMLWordPrintable

    Details

      Description

      ADDITIONAL SYSTEM INFORMATION :
      Centos 8.4
      OpenJDK 11.0.11 2-21-04-20 LTS
      JavaFX-16




      A DESCRIPTION OF THE PROBLEM :
      ClipBoardContent content = new ClipboardContent();
      contetn.put(dataFormat.PLAIN_TEXT, Array.asList("A","B")));
      Clipboard.getSystemClipboard.setContent(content);

      causes the JVM to crash.
      Exception in thread "JavaFX Application Thread" java.lang.NegativeArraySizeException: -7272228
      at java.base/java.lang.StringCoding.encodeUTF8(StringCoding.java:904)
      at java.base/java.lang.StringCoding.encode(StringCoding.java:428)
      at java.base/java.lang.String.getBytes(String.java:959)
      at javafx.graphics/com.sun.glass.ui.gtk.GtkApplication._runLoop(Native Method)
      at javafx.graphics/com.sun.glass.ui.gtk.GtkApplication.lambda$runLoop$11(GtkApplication.java:277)
      at java.base/java.lang.Thread.run(Thread.java:832)
      #
      # A fatal error has been detected by the Java Runtime Environment:
      #
      # SIGSEGV (0xb) at pc=0x00007fc8a3a35190, pid=3511446, tid=3511507
      #
      # JRE version: OpenJDK Runtime Environment (14.0+36) (build 14+36-1461)
      # Java VM: OpenJDK 64-Bit Server VM (14+36-1461, mixed mode, sharing, tiered, compressed oops, g1 gc, linux-amd64)
      # Problematic frame:
      # V [libjvm.so+0x241190] AccessInternal::PostRuntimeDispatch<G1BarrierSet::AccessBarrier<1097844ul, G1BarrierSet>, (AccessInternal::BarrierType)2, 1097844ul>::oop_access_barrier(void*)+0x0
      #
      # Core dump will be written. Default location: Core dumps may be processed with "/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t %P %I %h %e" (or dumping to /home/schatzman/IdeaProjects/tallgrass-geo1/core.3511446)
      #
      # An error report file with more information is saved as:
      # /home/schatzman/IdeaProjects/tallgrass-geo1/hs_err_pid3511446.log
      #
      # If you would like to submit a bug report, please visit:
      # https://bugreport.java.com/bugreport/crash.jsp
      #




      STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
      Compile and execute this code

      ClipBoardContent content = new ClipboardContent();
      content.put(dataFormat.PLAIN_TEXT, Array.asList("A","B")));
      Clipboard.getSystemClipboard.setContent(content);


      EXPECTED VERSUS ACTUAL BEHAVIOR :
      EXPECTED -
      Either array of strings being added to system clipboard or a catchable exception if this data type (list of strings) is not supported.
      ACTUAL -
      JVM aborts.

      Exception in thread "JavaFX Application Thread" java.lang.NegativeArraySizeException: -7272228
      at java.base/java.lang.StringCoding.encodeUTF8(StringCoding.java:904)
      at java.base/java.lang.StringCoding.encode(StringCoding.java:428)
      at java.base/java.lang.String.getBytes(String.java:959)
      at javafx.graphics/com.sun.glass.ui.gtk.GtkApplication._runLoop(Native Method)
      at javafx.graphics/com.sun.glass.ui.gtk.GtkApplication.lambda$runLoop$11(GtkApplication.java:277)
      at java.base/java.lang.Thread.run(Thread.java:832)
      #
      # A fatal error has been detected by the Java Runtime Environment:
      #
      # SIGSEGV (0xb) at pc=0x00007fc8a3a35190, pid=3511446, tid=3511507
      #
      # JRE version: OpenJDK Runtime Environment (14.0+36) (build 14+36-1461)
      # Java VM: OpenJDK 64-Bit Server VM (14+36-1461, mixed mode, sharing, tiered, compressed oops, g1 gc, linux-amd64)
      # Problematic frame:
      # V [libjvm.so+0x241190] AccessInternal::PostRuntimeDispatch<G1BarrierSet::AccessBarrier<1097844ul, G1BarrierSet>, (AccessInternal::BarrierType)2, 1097844ul>::oop_access_barrier(void*)+0x0
      #
      # Core dump will be written. Default location: Core dumps may be processed with "/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t %P %I %h %e" (or dumping to /home/schatzman/IdeaProjects/tallgrass-geo1/core.3511446)
      #
      # An error report file with more information is saved as:
      # /home/schatzman/IdeaProjects/tallgrass-geo1/hs_err_pid3511446.log
      #
      # If you would like to submit a bug report, please visit:
      # https://bugreport.java.com/bugreport/crash.jsp
      #




      ---------- BEGIN SOURCE ----------
      import com.aac.data.SystemConstants;
      import javafx.application.Application;
      import javafx.application.Platform;
      import javafx.scene.input.Clipboard;
      import javafx.scene.input.ClipboardContent;
      import javafx.scene.input.DataFormat;
      import javafx.stage.Stage;

      import java.util.Arrays;

      public class Abort1 extends Application {

          public static void main(String[] args) throws Exception {
              SystemConstants.init();
              Application.launch(Abort1.class, args);
          }

          @Override
          public void start(Stage primaryStage) throws Exception {
              Platform.runLater(new Runnable() {
                  @Override
                  public void run() {
                      ClipboardContent content = new ClipboardContent();
                      content.put(DataFormat.PLAIN_TEXT, Arrays.asList("A","B"));
                      Clipboard.getSystemClipboard().setContent(content);
                  }
              });
          }
      }



      Note: Appropriate module options must be provided one the JVM command line. I used:

      --module-path
      <path-to-modules>
      --add-modules
      javafx.swing,javafx.graphics,javafx.fxml,javafx.media,javafx.web,javafx.controls
      -Dprism.verbose=true
      -Djavafx.verbose=true
      --add-reads
      javafx.graphics=ALL-UNNAMED
      --add-opens
      javafx.controls/com.sun.javafx.charts=ALL-UNNAMED
      --add-opens
      javafx.controls/com.sun.javafx.scene.control=ALL-UNNAMED
      --add-opens
      javafx.controls/com.sun.javafx.scene.control.behavior=ALL-UNNAMED
      --add-opens
      javafx.controls/com.sun.javafx.scene.control.skin=ALL-UNNAMED
      --add-opens
      javafx.graphics/com.sun.javafx.iio=ALL-UNNAMED
      --add-opens
      javafx.graphics/com.sun.javafx.iio.common=ALL-UNNAMED
      --add-opens
      javafx.graphics/com.sun.javafx.css=ALL-UNNAMED
      --add-opens
      javafx.graphics/com.sun.javafx.scene=ALL-UNNAMED
      --add-opens
      javafx.graphics/com.sun.javafx.scene.traversal=ALL-UNNAMED
      --add-opens
      javafx.graphics/com.sun.javafx.util=ALL-UNNAMED
      --add-opens
      javafx.base/com.sun.javafx.runtime=ALL-UNNAMED
      --add-opens
      javafx.base/com.sun.javafx.event=ALL-UNNAMED
      ---------- END SOURCE ----------

      CUSTOMER SUBMITTED WORKAROUND :
      Pass only a single String to content.put() instead of a List. Presumably, this is the expected data type.. However, bad data should not cause the JVM to crash.

      FREQUENCY : always


        Attachments

        1. Abort1.java
          0.9 kB
        2. Capture.PNG
          Capture.PNG
          170 kB

          Activity

            People

            Assignee:
            kcr Kevin Rushforth
            Reporter:
            webbuggrp Webbug Group
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Dates

              Created:
              Updated: