Monday, May 01, 2006

The Java Bytecode Verifier [Info Blog]

Even though the Java compiler ensures that Java source code does not violate any safety rule, how can we be sure that the bytecode running in our JVM was not created by malicious compiler?

If the code we run was compiled by us or trusted third parties, then we can be sure, but that is not the case with Applets. When we run an Applet, we run untrusted code. We have no way of knowing if it was created using a malicious compiler. Such code could potentially snoop into our computer's memory, or cause programs to fail by corruppting data structures in memory. This is why the JVM looks at every class with suspicion. The class is subjected to a bytecode verification process before it is loaded.

The bytecode is verified by the Bytecode Verifier. It checks the code for the following violations:

* forging of pointers
* violation of access restrictions
* usage of objects in ways that they were not meant to be used (eg: calling a method on an object, which is not a part of that object)

Through the Bytecode verifier, Java adds security checks at runtime to ensure that safety rules are not violated.

No comments: