Java 有缓冲区溢出吗？

Does Java have buffer overflows?

提问by ecleel

Does Java have buffer overflows? If yes can you give me scenarios?

Java 有缓冲区溢出吗？如果是，你能给我场景吗？

采纳答案by Michael Borgwardt

Since Java Strings are based on char arrays and Java automatically checks array bounds, buffer overflows are only possible in unusual scenarios:

由于 Java 字符串基于字符数组，并且 Java 会自动检查数组边界，因此只有在不常见的情况下才会出现缓冲区溢出：

1. If you call native code via JNI
2. In the JVM itself (usually written in C++)
3. The interpreter or JIT compiler does not work correctly (Java bytecode mandated bounds checks)

1. 如果您通过 JNI 调用本机代码
2. 在 JVM 本身中（通常用 C++ 编写）
3. 解释器或 JIT 编译器无法正常工作（Java 字节码强制边界检查）

回答by Brian Rasmussen

Managed languages such as Java and C# do not have these problems, but the specific virtual machines (JVM/CLR/etc) which actually run the code may.

Java 和 C# 等托管语言没有这些问题，但实际运行代码的特定虚拟机（JVM/CLR/etc）可能会出现这些问题。

回答by coobird

For all intents and purposes, no.

出于所有意图和目的，不。

Java has array bounds checkingwhich will check that data cannot be accessed from area outside of the allocated array. When one tries to access area that is beyond the size of the array, an ArrayOutOfBoundsexception will be thrown.

Java 有数组边界检查，它会检查数据不能从分配的数组之外的区域访问。当试图访问超出数组大小的区域时，ArrayOutOfBounds将引发异常。

If there is a buffer-overrun, it is probably from a bug in the Java Virtual Machine, and is, to my knowledge, not the intended behavior that is written in the Java Language Specifications nor the Java Virtual Machine Specifications.

如果出现缓冲区溢出，则可能是由于 Java 虚拟机中的错误，据我所知，这不是 Java 语言规范或 Java 虚拟机规范中编写的预期行为。

回答by BobbyShaftoe

Yes and no. No, in that you cannot really create mistakenly open yourself up to a buffer overflow vulnerability because it is a managed memory model. However, there can be buffer overflow vulnerabilities in the JVM and JDK. See this Secunia advisory:

是和否。不，因为它是一种托管内存模型，因此您不能真正错误地创建缓冲区溢出漏洞。但是，JVM 和 JDK 中可能存在缓冲区溢出漏洞。请参阅此 Secunia 咨询：

http://secunia.com/advisories/25295

http://secunia.com/advisories/25295

Or see these old advisories on several previous JDK and JRE vulnerabilities:

或者查看这些关于以前的几个 JDK 和 JRE 漏洞的旧建议：

• Integer and Buffer Overflow Vulnerabilities in the Java Runtime Environment (JRE) "unpack200" JAR Unpacking Utility May Lead to Escalation of Privileges https://download.oracle.com/sunalerts/1020225.1.html

  Integer and buffer overflow vulnerabilities in the Java Runtime Environment (JRE) with unpacking applets and Java Web Start applications using the "unpack200" JAR unpacking utility may allow an untrusted applet or application to escalate privileges. For example, an untrusted applet may grant itself permissions to read and write local files or execute local applications that are accessible to the user running the untrusted applet.

  Sun acknowledges with thanks, "regenrecht" working with the iDefense VCP (http://labs.idefense.com/vcp/) and Chris Evans of Google for bringing these issues to our attention.

• Multiple vulnerabilities have been identified in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE). https://security.gentoo.org/glsa/200705-23

  An unspecified vulnerability involving an "incorrect use of system classes" was reported by the Fujitsu security team. Additionally, Chris Evans from the Google Security Team reported an integer overflow resulting in a buffer overflow in the ICC parser used with JPG or BMP files, and an incorrect open() call to /dev/tty when processing certain BMP files.

• Java 运行时环境 (JRE)“unpack200”JAR 解包实用程序中的整数和缓冲区溢出漏洞可能导致权限升级https://download.oracle.com/sunalerts/1020225.1.html

  使用“unpack200”JAR 解包实用程序解包小程序和 Java Web Start 应用程序的 Java 运行时环境 (JRE) 中的整数和缓冲区溢出漏洞可能允许不受信任的小程序或应用程序提升权限。例如，不受信任的小程序可能会授予自己读取和写入本地文件或执行本地应用程序的权限，这些权限对运行不受信任的小程序的用户来说是可访问的。

  Sun 非常感谢与 iDefense VCP ( http://labs.idefense.com/vcp/) 和 Google 的 Chris Evans合作的“regenrecht”让我们注意到这些问题。

• 在 Sun Java Development Kit (JDK) 和 Java Runtime Environment (JRE) 中发现了多个漏洞。https://security.gentoo.org/glsa/200705-23

  富士通安全团队报告了一个涉及“不正确使用系统类”的未指明漏洞。此外，来自 Google 安全团队的 Chris Evans 报告了整数溢出，导致与 JPG 或 BMP 文件一起使用的 ICC 解析器中的缓冲区溢出，以及在处理某些 BMP 文件时对 /dev/tty 的错误 open() 调用。

回答by ShuggyCoUk

A buffer overflow in the strict sense of overwriting the stack or heap itself would require either:

覆盖堆栈或堆本身的严格意义上的缓冲区溢出需要：

1. A bug in the framework (these have existed in the past and may well again)
2. The use of JNI (essentially no longer using managed code)

1. 框架中的错误（这些在过去已经存在，并且可能再次出现）
2. JNI的使用（基本上不再使用托管代码）

A buffer overflow in the sense that you have code using a buffer and your code is responsible for parsing it correctly but fail to do so is possible. For example You might write an XML parser and someone could provide you with a malformed (or legitimate but uncommon) request which, owing to the design of your parser overwrites previously validated data with some payload that would cause your application to behave badly.

缓冲区溢出是指您的代码使用缓冲区并且您的代码负责正确解析它但未能正确解析它是可能的。例如，您可能会编写一个 XML 解析器，而有人可能会向您提供一个格式错误（或合法但不常见）的请求，由于您的解析器的设计，该请求会使用一些负载覆盖先前验证过的数据，这会导致您的应用程序表现不佳。

This latter form is less likely but a poorly written sql string cleansing function widely distributed that had a problem such as this would be an inviting target.

后一种形式不太可能，但广泛分布的编写不佳的 sql 字符串清理函数会成为一个诱人的目标。

回答by falstro

As has already been pointed out, Java has, as a language, bounds checking on all memory access, and if there's an error here, the JVM is at fault and not the program. However, what should be noted, which is a similar argument to memory leaks in Java; while not possible to smash the stack, an ArrayOutOfBoundsException in the wrong place, which is not handled correctly, may still end up screwing up your system.

正如已经指出的那样，Java 作为一种语言，对所有内存访问进行了边界检查，如果这里出现错误，则是 JVM 而不是程序有问题。但是，需要注意的是，这与 Java 中的内存泄漏类似；虽然不可能粉碎堆栈，但在错误位置的 ArrayOutOfBoundsException 没有正确处理，最终可能仍然会搞砸你的系统。

回答by Mendelt

Java (and .Net) virtual machines catch code that tries to write outside of reserved memory. Applications that don't handle this correctly can still cause security problems. If malicious users can trigger exceptions by entering invalid input they can do denial of service attacks for example.

Java（和 .Net）虚拟机捕获试图在保留内存之外写入的代码。未正确处理此问题的应用程序仍会导致安全问题。如果恶意用户可以通过输入无效输入触发异常，例如，他们可以进行拒绝服务攻击。

回答by Tim Howland

You could conceivably cause a buffer overflow in a Java program if you were using the Java Native Interace (JNI) facility to invoke external code, and the external code had an exploitable issue. This is fairly uncommon, as most applications avoid using JNI where possible.

如果您使用 Java Native Interace (JNI) 工具调用外部代码，并且外部代码存在可利用的问题，那么您可能会导致 Java 程序中的缓冲区溢出。这是相当少见的，因为大多数应用程序尽可能避免使用 JNI。

回答by Tom Hawtin - tackline

It is possible for a method to write into valid entries of an array that it did not intend to, typically through integer overflow.

方法可能会写入它不打算写入的数组的有效条目，通常是通过整数溢出。

For instance the following is not sufficient to check bounds:

例如，以下内容不足以检查边界：

/* !! WRONG !! */ 0 <= off && 0 <= len && off+len <= buff.length /* !! WRONG !! */

IIRC, StringBufferonce had a bug like that, but there wasn't anything interesting you could do with it.

IIRC，StringBuffer曾经有一个这样的错误，但你不能用它做任何有趣的事情。

回答by ABHISHEK SRIVASTAVA

One of the key features of JAVA is Security. Programs written in interpreted languages are not prone to the buffer overflow exploit, but you can always cause a buffer overflow in Interpreter itself. Although it will be difficult. Similarly Python also is an interpreted language and is safe from buffer overflow.

JAVA 的主要特性之一是安全性。用解释语言编写的程序不容易受到缓冲区溢出漏洞的影响，但您总是可以在解释器本身中导致缓冲区溢出。虽然会很困难。类似地，Python 也是一种解释型语言，可以避免缓冲区溢出。