UnitTestBot / UnitTestBot/usvm
USVM freezes with java.security.SecureRandom (new SecureRandom())
Open
Nobody has claimed this yet.
bug
- Dominant language
- Kotlin
- Stars
- 33
- Forks
- 27
- Avg merge
- 4d 3h
- Merged PRs (30d)
- 15
Description
Code
package javajuliet.testcase.CWE190_Integer_Overflow;
import javajuliet.testcasesupport.*;
import javax.servlet.http.*;
import java.security.SecureRandom;
public class CWE190_Integer_Overflow__int_random_square_01 extends AbstractTestCase
{
public void bad() throws Throwable
{
int data;
/* POTENTIAL FLAW: Set data to a random value */
data = (new SecureRandom()).nextInt();
/* POTENTIAL FLAW: if (data*data) > Integer.MAX_VALUE, this will overflow */
int result = (int)(data * data);
IO.writeLine("result: " + result);
}
}
Call stack
Instruction: return
Call stack (contains 13 frames):
0: UCallStackFrame(method=(id:73)javajuliet.testcase.CWE190_Integer_Overflow.CWE190_Integer_Overflow__int_random_square_01#bad(), returnSite=null)
1: UCallStackFrame(method=(id:1)java.security.SecureRandom#<init>(), returnSite=%0.<init>())
2: UCallStackFrame(method=(id:1)java.security.SecureRandom#getDefaultPRNG(boolean, byte[]), returnSite=this.getDefaultPRNG(0, null))
3: UCallStackFrame(method=(id:1)sun.security.jca.Providers#getProviderList(), returnSite=%2 = sun.security.jca.Providers.getProviderList())
4: UCallStackFrame(method=(id:1)sun.security.jca.Providers#getThreadProviderList(), returnSite=%1 = sun.security.jca.Providers.getThreadProviderList())
5: UCallStackFrame(method=(id:1)sun.security.jca.Providers#<clinit>(), returnSite=%0 = sun.security.jca.Providers.threadListsUsed)
6: UCallStackFrame(method=(id:1)sun.security.jca.ProviderList#<clinit>(), returnSite=%1 = sun.security.jca.ProviderList.EMPTY)
7: UCallStackFrame(method=(id:1)sun.security.util.Debug#getInstance(java.lang.String, java.lang.String), returnSite=%0 = sun.security.util.Debug.getInstance("jca", "ProviderList"))
8: UCallStackFrame(method=(id:1)sun.security.util.Debug#isOn(java.lang.String), returnSite=%0 = sun.security.util.Debug.isOn(arg$0))
9: UCallStackFrame(method=(id:1)sun.security.util.Debug#<clinit>(), returnSite=%0 = sun.security.util.Debug.args)
10: UCallStackFrame(method=(id:1)sun.security.action.GetPropertyAction#privilegedGetProperty(java.lang.String), returnSite=%0 = sun.security.action.GetPropertyAction.privilegedGetProperty("java.security.debug"))
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing javajuliet.testcase.CWE190_Integer_Overflow.CWE190_Integer_Overflow__int_random_square_01#bad() with new SecureRandom(), then inspect the SecureRandom and provider-initialization frames shown in the call stack. Done means this testcase completes instead of freezing and reaches its result output.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- devtools
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100