UnitTestBot / UnitTestBot/usvm

USVM freezes with java.security.SecureRandom (new SecureRandom())

Open
#76 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Kotlin
Stars
33
Forks
27
Avg merge
4d 3h
Merged PRs (30d)
15

Description

Code

package javajuliet.testcase.CWE190_Integer_Overflow;
import javajuliet.testcasesupport.*;

import javax.servlet.http.*;

import java.security.SecureRandom;

public class CWE190_Integer_Overflow__int_random_square_01 extends AbstractTestCase
{
    public void bad() throws Throwable
    {
        int data;

        /* POTENTIAL FLAW: Set data to a random value */
        data = (new SecureRandom()).nextInt();

        /* POTENTIAL FLAW: if (data*data) > Integer.MAX_VALUE, this will overflow */
        int result = (int)(data * data);

        IO.writeLine("result: " + result);

    }
}

Call stack

Instruction: return
Call stack (contains 13 frames):
	0: UCallStackFrame(method=(id:73)javajuliet.testcase.CWE190_Integer_Overflow.CWE190_Integer_Overflow__int_random_square_01#bad(), returnSite=null)
	1: UCallStackFrame(method=(id:1)java.security.SecureRandom#<init>(), returnSite=%0.<init>())
	2: UCallStackFrame(method=(id:1)java.security.SecureRandom#getDefaultPRNG(boolean, byte[]), returnSite=this.getDefaultPRNG(0, null))
	3: UCallStackFrame(method=(id:1)sun.security.jca.Providers#getProviderList(), returnSite=%2 = sun.security.jca.Providers.getProviderList())
	4: UCallStackFrame(method=(id:1)sun.security.jca.Providers#getThreadProviderList(), returnSite=%1 = sun.security.jca.Providers.getThreadProviderList())
	5: UCallStackFrame(method=(id:1)sun.security.jca.Providers#<clinit>(), returnSite=%0 = sun.security.jca.Providers.threadListsUsed)
	6: UCallStackFrame(method=(id:1)sun.security.jca.ProviderList#<clinit>(), returnSite=%1 = sun.security.jca.ProviderList.EMPTY)
	7: UCallStackFrame(method=(id:1)sun.security.util.Debug#getInstance(java.lang.String, java.lang.String), returnSite=%0 = sun.security.util.Debug.getInstance("jca", "ProviderList"))
	8: UCallStackFrame(method=(id:1)sun.security.util.Debug#isOn(java.lang.String), returnSite=%0 = sun.security.util.Debug.isOn(arg$0))
	9: UCallStackFrame(method=(id:1)sun.security.util.Debug#<clinit>(), returnSite=%0 = sun.security.util.Debug.args)
	10: UCallStackFrame(method=(id:1)sun.security.action.GetPropertyAction#privilegedGetProperty(java.lang.String), returnSite=%0 = sun.security.action.GetPropertyAction.privilegedGetProperty("java.security.debug"))

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing javajuliet.testcase.CWE190_Integer_Overflow.CWE190_Integer_Overflow__int_random_square_01#bad() with new SecureRandom(), then inspect the SecureRandom and provider-initialization frames shown in the call stack. Done means this testcase completes instead of freezing and reaches its result output.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.