Eclipse OMR Compiler Buffer Over-Read Vulnerability in Charset Translation Optimization for OpenJ9 on Z Processors

A buffer over-read vulnerability has been identified in the Eclipse OMR compiler component, affecting versions since 0.7.0. The issue arises in an optimization intended for Eclipse OpenJ9 users on Z processors, where NUL (0x00) characters are improperly managed during the translation from Latin-compatible charsets (such as UTF-8, ISO8859-1, and ASCII) to IBM-1047/037. This mismanagement can lead to the output byte array being truncated, omitting the first NUL byte and all following characters, which may result in a buffer over-read condition.

Impact

Exploitation of this vulnerability could lead to a buffer over-read, potentially allowing for the unintended disclosure of memory contents.

Remediation

Users can upgrade to Eclipse OMR version 0.8.0 to address this vulnerability.