[jcifs] OOM Issue in eventlog patch

[Michael B Allen]

Hi Vianney,

That code is generated by the midlc compiler. So to fix your issue
properly you would actually need to trace it to the event log IDL or
midlc code. This requires some understanding of MS-RPC and possibly
the midlc code which is written in C. Suffice it to say, this is not a
simple exercise. But if you post the IDL, the generated function and
described why the code is errant it would at least create the
potential for a proper fix by someone in the future.

Mike

-- 
Michael B Allen
Java Active Directory Integration
http://www.ioplex.com/

On Wed, Mar 2, 2011 at 4:34 PM, Vianney <vianney+smb at gmail.com> wrote:
> Hello,
>
> I'm not sure exactly how this works, but i have a makeshift patch for a patch?
> The problem I had was that due to some corrupted/unexpected response from a
> remote windows event viewer host, eventlog.decode_out() would get stuck in an
> infinite loop of memory allocation, until the JVM runs out of memory.
>
> The culprit can be seen here:
>
>       public void decode_out(NdrBuffer _src) throws NdrException {
>           ...
>           while (bytesTotal < sent_size) {
>                  if (entries == null) {
>                         entries = new ArrayList();
>                  }
>                  EventlogRecord entry = new EventlogRecord();
>                  entry.decode(_src);
>                  entries.add(entry);
>                  bytesTotal += entry.size;
>           }
>       }
>
>
>
> which i avoid by replacing with the following:
>
>       public void decode_out(NdrBuffer _src) throws NdrException {
>           ...
>           int size=-1;
>           while (size != 0 && bytesTotal < sent_size) {
>               if (entries == null) {
>                   entries = new ArrayList();
>               }
>               EventlogRecord entry = new EventlogRecord();
>               entry.decode(_src);
>               entries.add(entry);
>               size = entry.size;
>               bytesTotal += size;
>           }
>       }
>
> Not the most elegant of solutions but it works as an alert mechanism. I'd have
> thrown an exception instead but it looks like it would only get ignored one
> level up.
>
>