openjdk team mailing list archive

Thread
Date
[Bug 561124] Re: firefox sets LD_LIBRARY_PATH which breaks the icedtea6-plugin

To: openjdk@xxxxxxxxxxxxxxxxxxx
From: Bug Watch Updater <561124@xxxxxxxxxxxxxxxxxx>
Date: Fri, 30 Nov 2012 18:17:13 -0000
Reply-to: Bug 561124 <561124@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx
Launchpad has imported 9 comments from the remote bug at
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=461.

If you reply to an imported comment from within Launchpad, your comment
will be sent to the remote bug automatically. Read more about
Launchpad's inter-bugtracker facilities at
https://help.launchpad.net/InterBugTracking.

------------------------------------------------------------------------
On 2010-03-22T20:15:55+00:00 Matthias Klose wrote:

Icedtea dont load/runs/works with applets. One example are geogebra applet.
Trying to load any applets from this page would fail. http://www.slu.edu/classes/maymk/GeoGebra/

One applet that fail:
http://www.slu.edu/classes/maymk/GeoGebra/SecantToTangent.html

Reply at:
https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/561124/comments/0

------------------------------------------------------------------------
On 2010-03-22T20:16:15+00:00 Matthias Klose wrote:

Created attachment 317
error log

Reply at:
https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/561124/comments/1

------------------------------------------------------------------------
On 2010-03-22T20:16:37+00:00 Matthias Klose wrote:

Created attachment 318
plugin debug log

Reply at:
https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/561124/comments/2

------------------------------------------------------------------------
On 2010-04-11T21:06:54+00:00 Matthias Klose wrote:

with a build from 20100411 head/1.8-branch I only see these hangs if
security.provider.9 in java.security is uncommented.

a simpler applet showing the same behaviour:
http://www.gurusheaven.de/security/anonymitaets_test.shtml

visiting the page with security.provider.9 commented:

Looking for 0xb5f9a90c 0xb3f3cfb0 0xb5fb6bdc (document)
java version "1.6.0_18"
OpenJDK Runtime Environment (IcedTea6 1.8) (6b18~pre4-1ubuntu4~ppa1)
OpenJDK Server VM (build 16.0-b13, mixed mode)
java.lang.InterruptedException: sleep interrupted
        at java.lang.Thread.sleep(Native Method)
        at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:674)
        at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:649)
        at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:270)
        at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
java.lang.InterruptedException: sleep interrupted
        at java.lang.Thread.sleep(Native Method)
        at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:629)
        at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:270)
        at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
java.lang.InterruptedException: sleep interrupted
        at java.lang.Thread.sleep(Native Method)
        at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:735)
        at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:649)
        at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:270)
        at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)

visiting the page with security.provider.9 uncommented:
Looking for 0xb4178f4c 0xb3a58b20 0xb59fdbcc (document)
java version "1.6.0_18"
OpenJDK Runtime Environment (IcedTea6 1.8) (6b18~pre4-1ubuntu4~ppa1)
OpenJDK Server VM (build 16.0-b13, mixed mode)
java.security.ProviderException: Could not initialize NSS
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:201)
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:103)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:532)
        at sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:262)
        at sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:244)
        at java.security.AccessController.doPrivileged(Native Method)
        at sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:244)
        at sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:224)
        at sun.security.jca.ProviderList.getProvider(ProviderList.java:232)
        at sun.security.jca.ProviderList.getService(ProviderList.java:330)
        at sun.security.jca.GetInstance.getInstance(GetInstance.java:157)
        at java.security.Security.getImpl(Security.java:696)
        at java.security.AlgorithmParameters.getInstance(AlgorithmParameters.java:130)
        at sun.security.x509.AlgorithmId.decodeParams(AlgorithmId.java:121)
        at sun.security.x509.AlgorithmId.<init>(AlgorithmId.java:114)
        at sun.security.x509.AlgorithmId.parse(AlgorithmId.java:381)
        at sun.security.x509.X509Key.parse(X509Key.java:168)
        at sun.security.x509.CertificateX509Key.<init>(CertificateX509Key.java:75)
        at sun.security.x509.X509CertInfo.parse(X509CertInfo.java:705)
        at sun.security.x509.X509CertInfo.<init>(X509CertInfo.java:169)
        at sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1747)
        at sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:196)
        at sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:107)
        at java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:322)
        at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:763)
        at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:55)
        at java.security.KeyStore.load(KeyStore.java:1201)
        at sun.security.ssl.TrustManagerFactoryImpl.getCacertsKeyStore(TrustManagerFactoryImpl.java:221)
        at sun.security.ssl.TrustManagerFactoryImpl.engineInit(TrustManagerFactoryImpl.java:51)
        at javax.net.ssl.TrustManagerFactory.init(TrustManagerFactory.java:247)
        at net.sourceforge.jnlp.security.VariableX509TrustManager.<init>(VariableX509TrustManager.java:100)
        at net.sourceforge.jnlp.security.VariableX509TrustManager.getInstance(VariableX509TrustManager.java:282)
        at sun.applet.PluginMain.init(PluginMain.java:217)
        at sun.applet.PluginMain.<init>(PluginMain.java:147)
        at sun.applet.PluginMain.main(PluginMain.java:116)
Caused by: java.io.IOException: An incompatible version of NSS is already loaded, 3.7 or later required
        at sun.security.pkcs11.Secmod.isInitialized(Secmod.java:130)
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:168)
        ... 37 more

NSS version on the system is 3.12.6.
Importing an SHA384withECDSA certificate with the same configuration does work, so the NSS security provider gets recognized in this case.

running the applet in appletviewer works:

appletviewer -J-Djava.security.policy=polfile
http://www.gurusheaven.de/security/anonymitaets_test.shtml

with polfile:
grant {
	permission java.lang.RuntimePermission "getenv.*";
};


Reply at: https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/561124/comments/3

------------------------------------------------------------------------
On 2010-04-12T01:39:20+00:00 Matthias Klose wrote:

proposed workaround:
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2010-April/008918.html


Reply at: https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/561124/comments/7

------------------------------------------------------------------------
On 2010-04-12T16:59:51+00:00 Matthias Klose wrote:

The firefox start script in MOZILLA_FIVE_HOME sets LD_LIBRARY_PATH to include 
MOZILLA_FIVE_HOME and a number of subdirectories of MOZILLA_FIVE_HOME. The 
current NSS provider does open libnss3.so in the path which is configured in nss.cfg, but the dlopen call doesn't the depending libraries of libnss3.so in the same directory.

$ LD_LIBRARY_PATH=/usr/lib/firefox-3.6.3 ldd /usr/lib/libnss3.so
	linux-gate.so.1 =>  (0x0068d000)
	libnssutil3.so => /usr/lib/firefox-3.6.3/libnssutil3.so (0x006a8000)
	libplc4.so => /usr/lib/firefox-3.6.3/libplc4.so (0x00f93000)
	libplds4.so => /usr/lib/firefox-3.6.3/libplds4.so (0x003bb000)
	libnspr4.so => /usr/lib/firefox-3.6.3/libnspr4.so (0x00f40000)
	libpthread.so.0 => /lib/tls/i686/cmov/libpthread.so.0 (0x00252000)
	libdl.so.2 => /lib/tls/i686/cmov/libdl.so.2 (0x0062d000)
	libc.so.6 => /lib/tls/i686/cmov/libc.so.6 (0x0090b000)
	/lib/ld-linux.so.2 (0x002af000)

This happens as well with the firefox binaries which are downloadable
from mozilla.org.

The security provider should prepend nssLibraryDirectory to the
LD_LIBRARY_PATH before dlopening libnss3, and after that restore the
path.

The workaround looks ok, just ignoring the libs provided by firefox, and
using the libs detected at build time.


Reply at: https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/561124/comments/12

------------------------------------------------------------------------
On 2010-04-13T11:07:14+00:00 Matthias Klose wrote:

fixed in 1.8


Reply at: https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/561124/comments/14

------------------------------------------------------------------------
On 2011-05-30T10:04:09+00:00 Puntogil wrote:

hello
I have this problem with the openjdk plugin (icedtea-web 1.0.2).
thanks


$ firefox --version
Mozilla Firefox 4.0.1
$ firefox
java version "1.6.0_22"
OpenJDK Runtime Environment (IcedTea6 1.10) (mageia-14.b22.5.mga1-i386)
OpenJDK Server VM (build 20.0-b10, mixed mode)
OFS Webchat Applet Running bld 2096 - (C) Icona spa http://www.icona.it
Java version 1.6.0_22
Trying connecting to 195.210.93.109:4800
**OFSCmdLogon :: encodeItems() :: getCli() = NULL !!
Exception in thread "AWT-EventQueue-2" java.lang.NullPointerException
        at javax.swing.text.PlainView.updateMetrics(PlainView.java:205)
        at javax.swing.text.PlainView.getPreferredSpan(PlainView.java:228)
        at javax.swing.text.FieldView.getPreferredSpan(FieldView.java:235)
        at javax.swing.text.PasswordView.getPreferredSpan(PasswordView.java:232)
        at javax.swing.text.FieldView.adjustAllocation(FieldView.java:82)
        at javax.swing.text.FieldView.adjustPaintRegion(FieldView.java:195)
        at javax.swing.text.PlainView.paint(PlainView.java:251)
        at javax.swing.text.FieldView.paint(FieldView.java:188)
        at javax.swing.plaf.basic.BasicTextUI$RootView.paint(BasicTextUI.java:1439)
        at javax.swing.plaf.basic.BasicTextUI.paintSafely(BasicTextUI.java:739)
        at javax.swing.plaf.basic.BasicTextUI.paint(BasicTextUI.java:886)
        at javax.swing.plaf.basic.BasicTextUI.update(BasicTextUI.java:865)
        at javax.swing.JComponent.paintComponent(JComponent.java:765)
        at javax.swing.JComponent.paint(JComponent.java:1029)
        at javax.swing.JComponent.paintToOffscreen(JComponent.java:5138)
        at javax.swing.RepaintManager$PaintManager.paintDoubleBuffered(RepaintManager.java:1454)
        at javax.swing.RepaintManager$PaintManager.paint(RepaintManager.java:1385)
        at javax.swing.BufferStrategyPaintManager.paint(BufferStrategyPaintManager.java:318)
        at javax.swing.RepaintManager.paint(RepaintManager.java:1188)
        at javax.swing.JComponent._paintImmediately(JComponent.java:5086)
        at javax.swing.JComponent.paintImmediately(JComponent.java:4896)
        at javax.swing.RepaintManager.paintDirtyRegions(RepaintManager.java:783)
        at javax.swing.RepaintManager.paintDirtyRegions(RepaintManager.java:735)
        at javax.swing.RepaintManager.prePaintDirtyRegions(RepaintManager.java:677)
        at javax.swing.RepaintManager.access$700(RepaintManager.java:58)
        at javax.swing.RepaintManager$ProcessingRunnable.run(RepaintManager.java:1593)
        at java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:226)
        at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:647)
        at java.awt.EventQueue.access$000(EventQueue.java:96)
        at java.awt.EventQueue$1.run(EventQueue.java:608)
        at java.awt.EventQueue$1.run(EventQueue.java:606)
        at java.security.AccessController.doPrivileged(Native Method)
        at java.security.AccessControlContext$1.doIntersectionPrivilege(AccessControlContext.java:105)
        at java.awt.EventQueue.dispatchEvent(EventQueue.java:617)
        at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:275)
        at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:200)
        at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:190)
        at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:185)
        at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:177)
        at java.awt.EventDispatchThread.run(EventDispatchThread.java:138)
Handle:
java.lang.NullPointerException
        at a.a.d.c.g(Unknown Source)
        at a.a.d.l.a(Unknown Source)
        at a.a.d.l.a(Unknown Source)
        at a.a.a.c.a.y.c(Unknown Source)
        at a.a.a.c.a.u.run(Unknown Source)
        at java.lang.Thread.run(Thread.java:679)
error: line 5: bad flagvector
error: line 7: bad flagvector
error: line 9: bad flagvector
error: line 11: bad flagvector
error: line 13: bad flagvector
error: line 18: bad flagvector
error: line 23: bad flagvector
error: line 28: bad flagvector
Error: Unable to fetch applet instance id from Java side.
Error: Unable to fetch applet instance id from Java side.
Closing the socket ...
WebChatApplet: stop
Exception in thread "Thread-15" java.lang.NullPointerException
        at a.a.d.c.n(Unknown Source)
        at a.a.d.u.run(Unknown Source)
        at java.lang.Thread.run(Thread.java:679)
Error: Unable to fetch applet instance id from Java side.
WARNING: pipe error (3): Demolished by the corresponding connection: file ./src/chrome/common/ipc_channel_posix.cc, line 404
Segmentation fault 

Reply at:
https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/561124/comments/18

------------------------------------------------------------------------
On 2011-05-30T10:06:19+00:00 Puntogil wrote:

hello
I have this problem with the openjdk plugin (icedtea-web 1.0.2).
thanks


$ firefox --version
Mozilla Firefox 4.0.1
$ firefox
java version "1.6.0_22"
OpenJDK Runtime Environment (IcedTea6 1.10) (mageia-14.b22.5.mga1-i386)
OpenJDK Server VM (build 20.0-b10, mixed mode)
OFS Webchat Applet Running bld 2096 - (C) Icona spa http://www.icona.it
Java version 1.6.0_22
Trying connecting to 195.210.93.109:4800
**OFSCmdLogon :: encodeItems() :: getCli() = NULL !!
Exception in thread "AWT-EventQueue-2" java.lang.NullPointerException
        at javax.swing.text.PlainView.updateMetrics(PlainView.java:205)
        at javax.swing.text.PlainView.getPreferredSpan(PlainView.java:228)
        at javax.swing.text.FieldView.getPreferredSpan(FieldView.java:235)
        at javax.swing.text.PasswordView.getPreferredSpan(PasswordView.java:232)
        at javax.swing.text.FieldView.adjustAllocation(FieldView.java:82)
        at javax.swing.text.FieldView.adjustPaintRegion(FieldView.java:195)
        at javax.swing.text.PlainView.paint(PlainView.java:251)
        at javax.swing.text.FieldView.paint(FieldView.java:188)
        at javax.swing.plaf.basic.BasicTextUI$RootView.paint(BasicTextUI.java:1439)
        at javax.swing.plaf.basic.BasicTextUI.paintSafely(BasicTextUI.java:739)
        at javax.swing.plaf.basic.BasicTextUI.paint(BasicTextUI.java:886)
        at javax.swing.plaf.basic.BasicTextUI.update(BasicTextUI.java:865)
        at javax.swing.JComponent.paintComponent(JComponent.java:765)
        at javax.swing.JComponent.paint(JComponent.java:1029)
        at javax.swing.JComponent.paintToOffscreen(JComponent.java:5138)
        at javax.swing.RepaintManager$PaintManager.paintDoubleBuffered(RepaintManager.java:1454)
        at javax.swing.RepaintManager$PaintManager.paint(RepaintManager.java:1385)
        at javax.swing.BufferStrategyPaintManager.paint(BufferStrategyPaintManager.java:318)
        at javax.swing.RepaintManager.paint(RepaintManager.java:1188)
        at javax.swing.JComponent._paintImmediately(JComponent.java:5086)
        at javax.swing.JComponent.paintImmediately(JComponent.java:4896)
        at javax.swing.RepaintManager.paintDirtyRegions(RepaintManager.java:783)
        at javax.swing.RepaintManager.paintDirtyRegions(RepaintManager.java:735)
        at javax.swing.RepaintManager.prePaintDirtyRegions(RepaintManager.java:677)
        at javax.swing.RepaintManager.access$700(RepaintManager.java:58)
        at javax.swing.RepaintManager$ProcessingRunnable.run(RepaintManager.java:1593)
        at java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:226)
        at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:647)
        at java.awt.EventQueue.access$000(EventQueue.java:96)
        at java.awt.EventQueue$1.run(EventQueue.java:608)
        at java.awt.EventQueue$1.run(EventQueue.java:606)
        at java.security.AccessController.doPrivileged(Native Method)
        at java.security.AccessControlContext$1.doIntersectionPrivilege(AccessControlContext.java:105)
        at java.awt.EventQueue.dispatchEvent(EventQueue.java:617)
        at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:275)
        at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:200)
        at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:190)
        at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:185)
        at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:177)
        at java.awt.EventDispatchThread.run(EventDispatchThread.java:138)
Handle:
java.lang.NullPointerException
        at a.a.d.c.g(Unknown Source)
        at a.a.d.l.a(Unknown Source)
        at a.a.d.l.a(Unknown Source)
        at a.a.a.c.a.y.c(Unknown Source)
        at a.a.a.c.a.u.run(Unknown Source)
        at java.lang.Thread.run(Thread.java:679)
error: line 5: bad flagvector
error: line 7: bad flagvector
error: line 9: bad flagvector
error: line 11: bad flagvector
error: line 13: bad flagvector
error: line 18: bad flagvector
error: line 23: bad flagvector
error: line 28: bad flagvector
Error: Unable to fetch applet instance id from Java side.
Error: Unable to fetch applet instance id from Java side.
Closing the socket ...
WebChatApplet: stop
Exception in thread "Thread-15" java.lang.NullPointerException
        at a.a.d.c.n(Unknown Source)
        at a.a.d.u.run(Unknown Source)
        at java.lang.Thread.run(Thread.java:679)
Error: Unable to fetch applet instance id from Java side.
WARNING: pipe error (3): Demolished by the corresponding connection: file ./src/chrome/common/ipc_channel_posix.cc, line 404
Segmentation fault 

Reply at:
https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/561124/comments/19

-- 
You received this bug notification because you are a member of OpenJDK,
which is subscribed to openjdk-6 in Ubuntu.
https://bugs.launchpad.net/bugs/561124

Title:
  firefox sets LD_LIBRARY_PATH which breaks the icedtea6-plugin

Status in OpenJDK:
  Won't Fix
Status in “firefox” package in Ubuntu:
  Fix Released
Status in “openjdk-6” package in Ubuntu:
  Fix Released
Status in “firefox” source package in Lucid:
  Fix Released
Status in “openjdk-6” source package in Lucid:
  Fix Released

Bug description:
  Binary package hint: firefox

  starting with openjdk/icedtea-1.7, a NSS based security provider is
  supported by icedtea.

  The firefox start script in MOZILLA_FIVE_HOME sets LD_LIBRARY_PATH to
  include MOZILLA_FIVE_HOME and a number of subdirectories of
  MOZILLA_FIVE_HOME. The current NSS provider code seems to honor
  LD_LIBRARY_PATH, and loads the libnss3.so provided by the browser.

  Caused by: java.io.IOException: An incompatible version of NSS is already loaded, 3.7 or later required
          at sun.security.pkcs11.Secmod.isInitialized(Secmod.java:130)
          at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:168)

  (wondering why the nss version shipped with firefox 3.6.3 identifies
  itself as 3.7).

  However the openjdk build is configured for the nss version configured
  at build time, and you can run it with more than one browser, so it
  makes sense to use the libnss version which was detected at openjdk
  build time.

  My current solution/workaround is to pass a modified LD_LIBRARY_PATH
  to the subprocess such that the libnss3.so which was configured at
  build time is always used.

  The setting of LD_LIBRARY_PATH in the run-mozilla.sh start script may
  be convenient, but it does break plugins which are built to be
  independent of the browser used.

  Things to do on the browser side:

   - why does firefox use it's own outdated libnss copy, and doesn't use the system nss3?
   - why does the nss shipped with firefox identifies itself with 3.7?
   - the firefox startup script should not set LD_LIBRARY_PATH, but search itself for libs
     in known places.

  for a proposed workaround for the icedtea6-plugin to work with this
  broken plugin, see
  http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=461

To manage notifications about this bug go to:
https://bugs.launchpad.net/openjdk/+bug/561124/+subscriptions
References

[Bug 561124] [NEW] firefox sets LD_LIBRARY_PATH which breaks the icedtea6-plugin
From: Matthias Klose, 2010-04-12