From 5e8f64e50f97d39e83a3358697be14db03566878 Mon Sep 17 00:00:00 2001 From: Stephan...

Libreoffice may be configured to add an empty entry to the Java class path.
This may lead to run arbitrary Java code from the current directory.

Debian-backport: use char szSep[] = {SAL_PATHSEPARATOR,0}; for building Ostring
path separator.

Change-Id: Idcfe7321077b60381c0273910b1faeb444ef1fd8
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130242
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
bug: https://www.libreoffice.org/about-us/security/advisories/CVE-2022-38745
debian-bug-security: https://security-tracker.debian.org/tracker/CVE-2022-38745

Gbp-Pq: Name 0075-From-5e8f64e50f97d39e83a3358697be14db03566878-Mon-Se.patch

diff --git a/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx b/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx
index d02a43edacbc3ff3841c86849b1f3d549296d64e..201ce3e6ba3a2be6826dc1d776eed817718031e0 100644 (file)
--- a/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx
+++ b/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx
@@ -717,17 +717,23 @@ javaPluginError jfw_plugin_startJavaVirtualMachine(
     // all versions below 1.5.1
     options.emplace_back("abort", reinterpret_cast<void*>(abort_handler));
     bool hasStackSize = false;
+#ifdef UNX
+    // Until java 1.5 we need to put a plugin.jar or javaplugin.jar (<1.4.2)
+    // in the class path in order to have applet support:
+    OString sAddPath = getPluginJarPath(pInfo->sVendor, pInfo->sLocation,pInfo->sVersion);
+#endif
     for (int i = 0; i < cOptions; i++)
     {
         OString opt(arOptions[i].optionString);
+        const char szSep[] = {SAL_PATHSEPARATOR,0};
 #ifdef UNX
-        // Until java 1.5 we need to put a plugin.jar or javaplugin.jar (<1.4.2)
-        // in the class path in order to have applet support:
         if (opt.startsWith("-Djava.class.path="))
         {
-            OString sAddPath = getPluginJarPath(pInfo->sVendor, pInfo->sLocation,pInfo->sVersion);
             if (!sAddPath.isEmpty())
-                opt += OString(SAL_PATHSEPARATOR) + sAddPath;
+            {
+                opt += OString(szSep) + sAddPath;
+                sAddPath.clear();
+            }
         }
 #endif
         if (opt == "-Xint") {
@@ -772,6 +778,11 @@ javaPluginError jfw_plugin_startJavaVirtualMachine(
         }
 #endif
     }
+#ifdef UNX
+    if (!sAddPath.isEmpty()) {
+        options.emplace_back("-Djava.class.path=" + sAddPath, nullptr);
+    }
+#endif
 
     std::unique_ptr<JavaVMOption[]> sarOptions(new JavaVMOption[options.size()]);
     for (std::vector<Option>::size_type i = 0; i != options.size(); ++i) {

diff --git a/jvmfwk/source/framework.cxx b/jvmfwk/source/framework.cxx
index 3eceabe99d427db51e550a6e45b42faf4e9e249a..9ef99adb4ed4c86669842766bd132b86fe684680 100644 (file)
--- a/jvmfwk/source/framework.cxx
+++ b/jvmfwk/source/framework.cxx
@@ -234,8 +234,12 @@ javaFrameworkError jfw_startVM(
                 //In direct mode the options are specified by bootstrap variables
                 //of the form UNO_JAVA_JFW_PARAMETER_1 .. UNO_JAVA_JFW_PARAMETER_n
                 vmParams = jfw::BootParams::getVMParameters();
-                sUserClassPath =
-                    "-Djava.class.path=" + jfw::BootParams::getClasspath();
+                auto const cp = jfw::BootParams::getClasspath();
+                if (!cp.isEmpty())
+                {
+                    sUserClassPath =
+                        "-Djava.class.path=" + cp;
+                }
             }
             else
                 OSL_ASSERT(false);

diff --git a/jvmfwk/source/fwkbase.cxx b/jvmfwk/source/fwkbase.cxx
index b7044217edc15a170d61933140d5f948ecee0370..bda3df9df44c5052fdf476d17679985bb864de4a 100644 (file)
--- a/jvmfwk/source/fwkbase.cxx
+++ b/jvmfwk/source/fwkbase.cxx
@@ -486,6 +486,9 @@ OString makeClassPathOption(OUString const & sUserClassPath)
 
     sPaths = OUStringToOString(
         sBufCP.makeStringAndClear(), osl_getThreadTextEncoding());
+    if (sPaths.isEmpty()) {
+        return "";
+    }
 
     OString sOptionClassPath("-Djava.class.path=");
     sOptionClassPath += sPaths;