...
This noncompliant code example shows an example where a direct pointer to a Java object is used with erroneous results.
| Code Block | ||
|---|---|---|
| ||
|
Compliant Solution
In this compliant solution ...
| Code Block | ||||
|---|---|---|---|---|
| ||||
Risk Assessment
If a direct pointer to a Java object is used then erroneous results may be obtained that could lead to the code crashing. This, in turn, could be used to mount a denial of service attack. In some circumstances, the direct pointer could become a "dangling pointer" which could result in sensitive information being leaked or malicious execution of arbitrary code.
Rule | Severity | Likelihood | Detectable |
|---|
Repairable | Priority | Level |
|---|---|---|
JNI02-J | High | Probable |
No | No |
P6 |
L2 |
Automated Detection
Direct pointers to Java objects can be detected and replaced by indirect handles automatically.
...
Applies to Android API versions 14 (ICE_CREAM_SANDWICH) and above, with Native Development Kit (NDK) 7.
API Levels |
|---|
| 14 and above |
Bibliography
| JNISpec 2014 | Java Native Interface Specification |
| Verify | Preventing JNI Issues |
| Hughes 2011 | JNI Local Reference Changes in ICS |
...