CVE-2018-2815

app("2018 APRIL CPU"):
    requires(version: "ARMR/2.6")

    /***************************************************************************
        CVE-2018-2815 (2018 APRIL CPU)

        CVSS 3.0 Summary:
            Base Score              | 5.3 MEDIUM
            Attack Vector           | Network
            Attack Complexity       | Low
            Privileges Required     | None
            User Interaction        | None
            Scope                   | Unchanged
            Confidentiality Impact  | None
            Integrity Impact        | None
            Availability Impact     | Low

        Description:
            It was discovered that the implementation of the StubIORImpl class
            in the Serialization component of OpenJDK did not limit the amount
            of memory allocated when creating object instance from a serialized
            form. A specially-crafted input could cause a Java application to
            use an excessive amount of memory when deserialized.

        Resources:
            https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-2815

        Affected Versions:
            6u181, 7u171, 8u162, JRockit R28.3.17

        Tested Versions:
            6u171 - 6u181
            7u161 - 7u171
            8u151 - 8u162

        Protection Provided:
            Functional

        Patch Version:
            1.0
    ***************************************************************************/

    patch("CVE-2018-2815 :01"):
        function("com/sun/corba/se/impl/ior/StubIORImpl.doRead(Ljava/io/ObjectInputStream;)V",
            checksums: ["d6e1b118bb"])  // 6u0 - 6u181, 7u0 - 7u171, 8u0 - 8u162
        callreturn("java/io/ObjectInputStream.readInt()I",
            occurrences: [1])

        code(language: java,   import: ["java.io.ObjectInputStream",
                                        "java.io.InvalidClassException",
                                        "java.io.IOException"]):
            private static JavaMethod filterCheckMethod;

            public void load() {
                filterCheckMethod =
                    JavaMethod.load("java/io/ObjectInputStream.filterCheck(Ljava/lang/Class;I)V");
            }

            public void patch(JavaFrame frame) {
                Object self = frame.loadThisVariable();
                ObjectInputStream stream = (ObjectInputStream) frame.loadObjectVariable(1);
                int typeLength = frame.loadIntOperand(0);

                try {
                    checkArray(stream, byte[].class, typeLength);
                } catch (Throwable t) {
                    if (t instanceof NullPointerException ||
                        t instanceof IllegalArgumentException ||
                        t instanceof NegativeArraySizeException ||
                        t instanceof InvalidClassException) {
                        frame.raiseException(t);
                    } else {
                        throw new RuntimeException(t);
                    }
                }
            }

            private void checkArray(ObjectInputStream s, Class<?> arrayType, int arrayLength)
                    throws InvalidClassException {
                if (arrayType == null) {
                    throw new NullPointerException();
                }
                if (!arrayType.isArray()) {
                    throw new IllegalArgumentException("not an array type");
                }
                if (arrayLength < 0) {
                    throw new NegativeArraySizeException();
                }
                if (filterCheckMethod.isSupported()) {
                    filterCheckMethod.call(s, arrayType, arrayLength);
                }
            }
        endcode
    endpatch

    patch("CVE-2018-2815 :02"):
        function("com/sun/corba/se/impl/ior/StubIORImpl.doRead(Ljava/io/ObjectInputStream;)V",
            checksums: ["d6e1b118bb"])  // 6u0 - 6u181, 7u0 - 7u171, 8u0 - 8u162
        callreturn("java/io/ObjectInputStream.readInt()I",
            occurrences: [2])

        code(language: java,   import: ["java.io.ObjectInputStream",
                                        "java.io.InvalidClassException",
                                        "java.io.IOException"]):
            private static JavaMethod filterCheckMethod;

            public void load() {
                filterCheckMethod =
                    JavaMethod.load("java/io/ObjectInputStream.filterCheck(Ljava/lang/Class;I)V");
            }

            public void patch(JavaFrame frame) {
                Object self = frame.loadThisVariable();
                ObjectInputStream stream = (ObjectInputStream) frame.loadObjectVariable(1);
                int numProfiles = frame.loadIntOperand(0);

                try {
                    checkArray(stream, int[].class, numProfiles);
                    checkArray(stream, byte[].class, numProfiles);
                } catch (Throwable t) {
                    if (t instanceof NullPointerException ||
                        t instanceof IllegalArgumentException ||
                        t instanceof NegativeArraySizeException ||
                        t instanceof InvalidClassException) {
                        frame.raiseException(t);
                    } else {
                        throw new RuntimeException(t);
                    }
                }
            }

            private void checkArray(ObjectInputStream s, Class<?> arrayType, int arrayLength)
                    throws InvalidClassException {
                if (arrayType == null) {
                    throw new NullPointerException();
                }
                if (!arrayType.isArray()) {
                    throw new IllegalArgumentException("not an array type");
                }
                if (arrayLength < 0) {
                    throw new NegativeArraySizeException();
                }
                if (filterCheckMethod.isSupported()) {
                    filterCheckMethod.call(s, arrayType, arrayLength);
                }
            }
        endcode
    endpatch

    patch("CVE-2018-2815 :03"):
        function("com/sun/corba/se/impl/ior/StubIORImpl.doRead(Ljava/io/ObjectInputStream;)V",
            checksums: ["d6e1b118bb"])  // 6u0 - 6u181, 7u0 - 7u171, 8u0 - 8u162
        callreturn("java/io/ObjectInputStream.readInt()I",
            occurrences: [4])

        code(language: java,   import: ["java.io.ObjectInputStream",
                                        "java.io.InvalidClassException",
                                        "java.io.IOException"]):
            private static JavaMethod filterCheckMethod;

            public void load() {
                filterCheckMethod =
                    JavaMethod.load("java/io/ObjectInputStream.filterCheck(Ljava/lang/Class;I)V");
            }

            public void patch(JavaFrame frame) {
                Object self = frame.loadThisVariable();
                ObjectInputStream stream = (ObjectInputStream) frame.loadObjectVariable(1);
                int dataSize = frame.loadIntOperand(0);

                try {
                    checkArray(stream, byte[].class, dataSize);
                } catch (Throwable t) {
                    if (t instanceof NullPointerException ||
                        t instanceof IllegalArgumentException ||
                        t instanceof NegativeArraySizeException ||
                        t instanceof InvalidClassException) {
                        frame.raiseException(t);
                    } else {
                        throw new RuntimeException(t);
                    }
                }
            }

            private void checkArray(ObjectInputStream s, Class<?> arrayType, int arrayLength)
                    throws InvalidClassException {
                if (arrayType == null) {
                    throw new NullPointerException();
                }
                if (!arrayType.isArray()) {
                    throw new IllegalArgumentException("not an array type");
                }
                if (arrayLength < 0) {
                    throw new NegativeArraySizeException();
                }
                if (filterCheckMethod.isSupported()) {
                    filterCheckMethod.call(s, arrayType, arrayLength);
                }
            }
        endcode
    endpatch

endapp