[jira] [Created] (LOG4J2-2650) ArrayIndexOutOfBoundsException in the initialization of UuidUtil

["Mattia Bertorello (JIRA)" <ji...@apache.org>]

Mattia Bertorello created LOG4J2-2650:
-----------------------------------------

             Summary: ArrayIndexOutOfBoundsException in the initialization of UuidUtil
                 Key: LOG4J2-2650
                 URL: https://issues.apache.org/jira/browse/LOG4J2-2650
             Project: Log4j 2
          Issue Type: Bug
          Components: Core
    Affects Versions: 2.12.0
         Environment: os : Mac OS

java: 1.8 (jdk1.8.0_172.jdk)

none network interface connected
            Reporter: Mattia Bertorello


Hi, 

I found a problem in the UuidUtil initialization.

The code that generate the exception
{code:java}
  private static Logger log = LogManager.getLogger(MyClass.class);
{code}
This code return a ip address of localhost and when the stack is IPv4 return 4 bytes but when the default stack is IPv6 it's going to return 16 bytes.
  [NetUtils.java#L108|https://github.com/apache/logging-log4j2/blob/da539329d528d979f4dd385a6ebb639793ef37bd/log4j-core/src/main/java/org/apache/logging/log4j/core/util/NetUtils.java#L108]
{code:java}
if (mac == null || mac.length == 0) { 
   mac = localHost.getAddress(); 
}
{code}
This is the part that generate the ArrayIndexOutOfBoundsException

 [UuidUtil.java#L81|https://github.com/apache/logging-log4j2/blob/da539329d528d979f4dd385a6ebb639793ef37bd/log4j-core/src/main/java/org/apache/logging/log4j/core/util/UuidUtil.java#L81]
{code:java}
System.arraycopy(mac, index, node, index + 2, length);{code}
These 16 bytes will generate a wrong destination index that exceed the length of the node array.
{noformat}
mac = {byte[16]@3217} 
length = 6 
index = 10 
node = {byte[8]@3222}
{noformat}
This is the complete exception  
{noformat}
java.lang.ExceptionInInitializerError at org.apache.logging.log4j.core.util.WatchManager.<init>(WatchManager.java:53) at org.apache.logging.log4j.core.config.AbstractConfiguration.<init>(AbstractConfiguration.java:135) at org.apache.logging.log4j.core.config.NullConfiguration.<init>(NullConfiguration.java:32) at org.apache.logging.log4j.core.LoggerContext.<clinit>(LoggerContext.java:79) at org.apache.logging.log4j.core.selector.ClassLoaderContextSelector.createContext(ClassLoaderContextSelector.java:171) at org.apache.logging.log4j.core.selector.ClassLoaderContextSelector.locateContext(ClassLoaderContextSelector.java:145) at org.apache.logging.log4j.core.selector.ClassLoaderContextSelector.getContext(ClassLoaderContextSelector.java:70) at org.apache.logging.log4j.core.selector.ClassLoaderContextSelector.getContext(ClassLoaderContextSelector.java:57) at org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContextFactory.java:148) at org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContextFactory.java:45) at org.apache.logging.log4j.LogManager.getContext(LogManager.java:194) at org.apache.logging.log4j.LogManager.getLogger(LogManager.java:581) at cc.arduino.contributions.packages.ContributionInstaller.<clinit>(ContributionInstaller.java:66) at processing.app.Base.<init>(Base.java:291) at processing.app.Base.main(Base.java:150) Caused by: java.lang.ArrayIndexOutOfBoundsException at java.lang.System.arraycopy(Native Method) at org.apache.logging.log4j.core.util.UuidUtil.<clinit>(UuidUtil.java:81) ... 15 more
{noformat}
To reproduce the exception you need
 * disconnect every network interface
 * verify that java will use the IPv6 stack -Djava.net.preferIPv4Stack=false -Djava.net.preferIPv6Addresses=true
 * Initialize a log of log4j

I suggest different solution:
 - Remove  [NetUtils.java#L108|https://github.com/apache/logging-log4j2/blob/da539329d528d979f4dd385a6ebb639793ef37bd/log4j-core/src/main/java/org/apache/logging/log4j/core/util/NetUtils.java#L108] and return always null (when the other code fail to init the mac variable ) because in general the method is called getMacAddress but in that particular case will return and IP address 
 - Mange the IPv6 case in the static part of the class UuidUtil [UuidUtil.java#L81|https://github.com/apache/logging-log4j2/blob/da539329d528d979f4dd385a6ebb639793ef37bd/log4j-core/src/main/java/org/apache/logging/log4j/core/util/UuidUtil.java#L81]



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)