Security

Submitted by lsantha on Mon, 04/12/2004 - 20:08.

I opened charvabsh and eveluated the following expression:

System.out.println(org.jnode.vm.Unsafe.getJumpTable());

JNode instantly died.

How?

‹ NTFS driver is ready for testing. CD-ROM can be read ›

Unsafe class is ..... unsafe

Submitted by admin on Tue, 04/13/2004 - 07:29.

Does not use the Unsafe class! unless you really know what to do with it.
Also the returntype: Address is not a normal object. Address is actually a memory pointer and used differently by the VM.

Now for the fix, i'll try to protect this method soon.

Ewout

Wrong ClassLoader..?

Submitted by samreid on Tue, 04/13/2004 - 03:38.

Please see Forums->News and Announcements->Charva Beanshell. I had trouble loading/running non-java.* and javax.* code also.

The Unsafe class

Submitted by lsantha on Tue, 04/13/2004 - 05:29.

It looks like this is a security hole combined with a bug in the Unsafe class (in fact in the assembly code implementing it). When you call that method you get the state of the registers and real panic before JNode dies. However you can successfully call the debug(String) method from the same class and the string gets displayed at the bottom of the screen.
The getJumpTable() method probably should not be public and/or there is a bug in it.

Levente