Repository navigation
jvm crash when compress #300
Copy link
Copy link
Closed
Labels
Description
java: target/snappy-1.1.1/snappy.cc:423: char* snappy::internal::CompressFragment(const char*, size_t, char*, snappy::uint16*, int): Assertion `0 == memcmp(base, candidate, matched)' failed.
#
# A fatal error has been detected by the Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0x00007fcfb60c7529, pid=1, tid=0x00007fcf713c2700
#
# JRE version: OpenJDK Runtime Environment (8.0_222-b10) (build 1.8.0_222-b10)
# Java VM: OpenJDK 64-Bit Server VM (25.222-b10 mixed mode linux-amd64 compressed oops)
# Problematic frame:
# C [libc.so.6+0x34529] abort+0x269
#
# Core dump written. Default location: /home/docker/core or core.1
#
# If you would like to submit a bug report, please visit:
# http://bugreport.java.com/bugreport/crash.jsp
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#
--------------- T H R E A D ---------------
Current thread (0x00007fcf9c04e800): JavaThread "task-exec-thread-19" [_thread_in_native, id=108, stack(0x00007fcf712c2000,0x00007fcf713c3000)]
siginfo: si_signo: 11 (SIGSEGV), si_code: 128 (SI_KERNEL), si_addr: 0x0000000000000000
Registers:
RAX=0x0000000000000006, RBX=0x00007fcfb6a8d000, RCX=0xffffffffffffffff, RDX=0x0000000000000000
RSP=0x00007fcf713c08d0, RBP=0x00007fcf72d06b97, RSI=0x00007fcf713c07c0, RDI=0x0000000000000002
R8 =0x0000000000000000, R9 =0x00007fcf713c07c0, R10=0x0000000000000008, R11=0x0000000000000246
R12=0x0000000000000180, R13=0x00007fcf72d072a0, R14=0x00000000833f9398, R15=0x00000000833f3444
RIP=0x00007fcfb60c7529, EFLAGS=0x0000000000010246, CSGSFS=0x0000000000000033, ERR=0x0000000000000000
TRAPNO=0x000000000000000d
Top of Stack: (sp=0x00007fcf713c08d0)
0x00007fcf713c08d0: 0000000000000020 0000000000000000
0x00007fcf713c08e0: 0000000000000000 0000000000000000
0x00007fcf713c08f0: 0000000000000000 0000000000000000
0x00007fcf713c0900: 0000000000000000 0000000000000000
0x00007fcf713c0910: 0000000000000000 0000000000000000
0x00007fcf713c0920: 0000000000000000 0000000000000000
0x00007fcf713c0930: 0000000000000000 0000000000000000
0x00007fcf713c0940: 0000000000000000 0000000000000000
0x00007fcf713c0950: 0000000000000000 ffffffffffffffff
0x00007fcf713c0960: ffffffffffffffff ffffffffffffffff
0x00007fcf713c0970: ffffffffffffffff ffffffffffffffff
0x00007fcf713c0980: ffffffffffffffff ffffffffffffffff
0x00007fcf713c0990: ffffffffffffffff ffffffffffffffff
0x00007fcf713c09a0: ffffffffffffffff ffffffffffffffff
0x00007fcf713c09b0: ffffffffffffffff ffffffffffffffff
0x00007fcf713c09c0: ffffffffffffffff ffffffffffffffff
0x00007fcf713c09d0: ffffffffffffffff 0000000000000000
0x00007fcf713c09e0: 0000000000000000 00000000833f9398
0x00007fcf713c09f0: 00000000833f3444 00007fcfb60bee67
0x00007fcf713c0a00: 00000077000000a5 00007fcf72d06a54
0x00007fcf713c0a10: 0000018000000000 00007fcf72d072a0
0x00007fcf713c0a20: 0000100000000180 00007fcfb15a7190
0x00007fcf713c0a30: 00000000833f9398 00007fcf72d06b97
0x00007fcf713c0a40: 00007fcf72d06a54 00007fcfb60bef12
0x00007fcf713c0a50: 00007fcf713c1318 00007fcfb0c792b0
0x00007fcf713c0a60: 00000000833f3444 00000000833f189b
0x00007fcf713c0a70: 00000000833f13a0 00007fcf72cec3ba
0x00007fcf713c0a80: 13a07fcf713c1380 00007fcfb0c792b0
0x00007fcf713c0a90: 00000000833f93a0 00000000833f9391
0x00007fcf713c0aa0: 00000012c1889218 00000000833e79f7
0x00007fcf713c0ab0: 00007fcfb0c792b0 0000000000008000
0x00007fcf713c0ac0: 00007fcf713c1380 00000000833f13a0
Instructions: (pc=0x00007fcfb60c7529)
0x00007fcfb60c7509: 00 00 c7 05 cb 66 36 00 06 00 00 00 e8 16 ea ff
0x00007fcfb60c7519: ff 8b 05 c0 66 36 00 83 f8 06 0f 85 39 fe ff ff
0x00007fcfb60c7529: f4 bf 7f 00 00 00 c7 05 a7 66 36 00 08 00 00 00
0x00007fcfb60c7539: e8 a2 40 08 00 66 90 41 57 41 56 41 55 41 54 55
Register to memory mapping:
RAX=0x0000000000000006 is an unknown value
RBX=0x00007fcfb6a8d000 is an unknown value
RCX=0xffffffffffffffff is an unknown value
RDX=0x0000000000000000 is an unknown value
RSP=0x00007fcf713c08d0 is pointing into the stack for thread: 0x00007fcf9c04e800
RBP=0x00007fcf72d06b97: <offset 0x2eb97> in /tmp/snappy-unknown-f8e101fe-18e5-435e-a5f4-deb9251e4a34-libsnappyjava.so at 0x00007fcf72cd8000
RSI=0x00007fcf713c07c0 is pointing into the stack for thread: 0x00007fcf9c04e800
RDI=0x0000000000000002 is an unknown value
R8 =0x0000000000000000 is an unknown value
R9 =0x00007fcf713c07c0 is pointing into the stack for thread: 0x00007fcf9c04e800
R10=0x0000000000000008 is an unknown value
R11=0x0000000000000246 is an unknown value
R12=0x0000000000000180 is an unknown value
R13=0x00007fcf72d072a0: <offset 0x2f2a0> in /tmp/snappy-unknown-f8e101fe-18e5-435e-a5f4-deb9251e4a34-libsnappyjava.so at 0x00007fcf72cd8000
R14=0x00000000833f9398 is pointing into object: 0x00000000833f1390
[B
- klass: {type array byte}
- length: 32768
R15=0x00000000833f3444 is pointing into object: 0x00000000833f1390
[B
- klass: {type array byte}
- length: 32768
Stack: [0x00007fcf712c2000,0x00007fcf713c3000], sp=0x00007fcf713c08d0, free space=1018k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C [libc.so.6+0x34529] abort+0x269
Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
J 14242 org.xerial.snappy.SnappyNative.rawCompress(Ljava/lang/Object;IILjava/lang/Object;I)I (0 bytes) @ 0x00007fcfa2f00c67 [0x00007fcfa2f00c00+0x67]
J 18356 C2 org.xerial.snappy.SnappyOutputStream.compressInput()V (76 bytes) @ 0x00007fcfa15566c4 [0x00007fcfa15564c0+0x204]
J 20717 C2 com.xxx.xxx.xxx.xxx.util.SnappyCompressUtil.compressData([B)[B (301 bytes) @ 0x00007fcfa2df0f04 [0x00007fcfa2df04a0+0xa64]
J 21499 C2 com.xxx.xxx.xxx.xxx.component.TaskLogManager.saveLog(Ljava/lang/Long;)V (61 bytes) @ 0x00007fcfa2cb51a8 [0x00007fcfa2cb4ea0+0x308]
J 21163 C2 com.xxx.xxx.xxx.xxx.component.HttpTaskHandle$HttpTaskJob.run()V (761 bytes) @ 0x00007fcfa40fe4ec [0x00007fcfa40fcfe0+0x150c]
J 13768 C2 java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run()V (59 bytes) @ 0x00007fcfa2640a1c [0x00007fcfa26408c0+0x15c]
J 19994% C2 java.util.concurrent.ThreadPoolExecutor.runWorker(Ljava/util/concurrent/ThreadPoolExecutor$Worker;)V (225 bytes) @ 0x00007fcfa1776da4 [0x00007fcfa1776c00+0x1a4]
j java.util.concurrent.ThreadPoolExecutor$Worker.run()V+5
j java.lang.Thread.run()V+11
v ~StubRoutines::call_stub
………………
VM Arguments:
jvm_args: -Denv=daily -Xms2048M -Xmx2048M -XX:+UseG1GC -XX:MaxGCPauseMillis=200 -XX:MetaspaceSize=64m -verbose:gc -XX:+HeapDumpOnOutOfMemoryError -XX:+PrintGC -XX:+PrintGCDetails -XX:+PrintGCDateStamps -Xloggc:/home/docker/logs/gc.log
java_command: /home/docker/start.jar
java_class_path (initial): /home/docker/start.jar
Launcher Type: SUN_STANDARD
Environment Variables:
JAVA_HOME=/usr/local/openjdk-8
PATH=/usr/local/openjdk-8/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
Signal Handlers:
SIGSEGV: [libjvm.so+0xa4c9c0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
SIGBUS: [libjvm.so+0xa4c9c0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
SIGFPE: [libjvm.so+0x8b51e0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
SIGPIPE: [libjvm.so+0x8b51e0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
SIGXFSZ: [libjvm.so+0x8b51e0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
SIGILL: [libjvm.so+0x8b51e0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
SIGUSR1: SIG_DFL, sa_mask[0]=00000000000000000000000000000000, sa_flags=none
SIGUSR2: [libjvm.so+0x8b6990], sa_mask[0]=00000000000000000000000000000000, sa_flags=SA_RESTART|SA_SIGINFO
SIGHUP: [libjvm.so+0x8b83c0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
SIGINT: [libjvm.so+0x8b83c0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
SIGTERM: [libjvm.so+0x8b83c0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
SIGQUIT: [libjvm.so+0x8b83c0], sa_mask[0]=11111111011111111101111111111110, sa_flags=SA_RESTART|SA_SIGINFO
--------------- S Y S T E M ---------------
OS:PRETTY_NAME="Debian GNU/Linux 9 (stretch)"
NAME="Debian GNU/Linux"
VERSION_ID="9"
VERSION="9 (stretch)"
VERSION_CODENAME=stretch
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
uname:Linux 3.10.0-957.21.3.el7.x86_64 #1 SMP Tue Jun 18 16:35:19 UTC 2019 x86_64
libc:glibc 2.24 NPTL 2.24
rlimit: STACK 8192k, CORE infinity, NPROC infinity, NOFILE 1048576, AS infinity
load average:0.02 0.07 0.20
/proc/meminfo:
MemTotal: 3880560 kB
MemFree: 166172 kB
MemAvailable: 553540 kB
Buffers: 7888 kB
Cached: 758776 kB
SwapCached: 0 kB
Active: 3218508 kB
Inactive: 370996 kB
Active(anon): 2915516 kB
Inactive(anon): 101716 kB
Active(file): 302992 kB
Inactive(file): 269280 kB
Unevictable: 0 kB
Mlocked: 0 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 2212 kB
Writeback: 0 kB
AnonPages: 2822908 kB
Mapped: 47108 kB
Shmem: 194340 kB
Slab: 59472 kB
SReclaimable: 39540 kB
SUnreclaim: 19932 kB
KernelStack: 6368 kB
PageTables: 11064 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 1940280 kB
Committed_AS: 4867628 kB
VmallocTotal: 34359738367 kB
VmallocUsed: 14348 kB
VmallocChunk: 34359715252 kB
HardwareCorrupted: 0 kB
AnonHugePages: 421888 kB
CmaTotal: 0 kB
CmaFree: 0 kB
HugePages_Total: 0
HugePages_Free: 0
HugePages_Rsvd: 0
HugePages_Surp: 0
Hugepagesize: 2048 kB
DirectMap4k: 69496 kB
DirectMap2M: 4124672 kB
DirectMap1G: 2097152 kB
container (cgroup) information:
container_type: cgroupv1
cpu_cpuset_cpus: 0
cpu_memory_nodes: 0
active_processor_count: 1
cpu_quota: -1
cpu_period: 100000
cpu_shares: -1
memory_limit_in_bytes: -1
memory_and_swap_limit_in_bytes: -1
memory_soft_limit_in_bytes: -1
memory_usage_in_bytes: 2675822592
memory_max_usage_in_bytes: 2698739712
CPU:total 1 (initial active 1) (1 cores per cpu, 1 threads per core) family 6 model 85 stepping 5, cmov, cx8, fxsr, mmx, sse, sse2, sse3, ssse3, sse4.1, sse4.2, popcnt, avx, avx2, aes, clmul, erms, rtm, 3dnowpref, lzcnt, tsc, bmi1, bmi2, adx
/proc/cpuinfo:
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 85
model name : Intel(R) Xeon(R) Platinum 8255C CPU @ 2.50GHz
stepping : 5
microcode : 0x1
cpu MHz : 2499.990
cache size : 36608 KB
physical id : 0
siblings : 1
core id : 0
cpu cores : 1
apicid : 0
initial apicid : 0
fpu : yes
fpu_exception : yes
cpuid level : 13
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss syscall nx pdpe1gb rdtscp lm constant_tsc rep_good nopl eagerfpu pni pclmulqdq ssse3 fma cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm abm 3dnowprefetch fsgsbase bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx avx512f avx512dq rdseed adx smap clflushopt clwb avx512cd avx512bw avx512vl xsaveopt xsavec xgetbv1 arat avx512_vnni
bogomips : 4999.98
clflush size : 64
cache_alignment : 64
address sizes : 46 bits physical, 48 bits virtual
power management:
Memory: 4k page, physical 3880560k(166048k free), swap 0k(0k free)
vm_info: OpenJDK 64-Bit Server VM (25.222-b10) for linux-amd64 JRE (1.8.0_222-b10), built on Jul 11 2019 10:18:43 by "openjdk" with gcc 4.4.7 20120313 (Red Hat 4.4.7-23)
time: Thu Nov 25 15:52:33 2021
timezone: CST
elapsed time: 532897 seconds (6d 4h 1m 37s)
<snappy.version>1.1.1.7</snappy.version>
Reactions are currently unavailable
Activity
garyelephant commentedon Feb 22, 2022
@eddie-zhou-yi Hi,I also encounterd this problem when using this api:
but, strangely, when I use the follow api, it does not core dump:
So, I suspect that the implementation of the first api in snappy-java java code has a serious bug. @xerial can you take a look at this ?
xerial commentedon Sep 26, 2023
@garyelephant, I cannot undertake such an investigation work for free as my time is limited. Can you provide a reproduction and propose a fix?
xerial commentedon Oct 3, 2026
The crash in Snappy.compress(byte[], int, int, byte[], int) reported here is what happens when the output buffer is smaller than Snappy.maxCompressedLength(inputLength): native code writes past it. Since #739 (merged), compress validates the input range and output space and throws IllegalArgumentException instead of crashing the JVM. Ships in 1.1.10.9.
xerial commentedon Oct 3, 2026
Correction to my previous comment: the assertion
0 == memcmp(base, candidate, matched)fires inside the compressor's input matching, so the likely causes are on the input side, not the output side:inputOffset + inputLengthextends past the end of the input array, so native code reads memory outside it. Since Fix buffer overflows and unbounded allocations from untrusted input (CVE-2026-90559 and others) #739 this throws IllegalArgumentException.If you still see this on 1.1.10.9 with a valid range and no concurrent writes, please reopen with a reproduction.