This commit is contained in:
Mikael Vidstedt 2020-07-14 23:29:45 -07:00
commit 1982432db4
992 changed files with 2142 additions and 2081 deletions

View file

@ -49,6 +49,7 @@ import static java.io.ObjectStreamClass.processQueue;
import jdk.internal.access.SharedSecrets;
import jdk.internal.misc.Unsafe;
import sun.reflect.misc.ReflectUtil;
import sun.security.action.GetBooleanAction;
/**
* An ObjectInputStream deserializes primitive data and objects previously
@ -294,6 +295,14 @@ public class ObjectInputStream
/** queue for WeakReferences to audited subclasses */
static final ReferenceQueue<Class<?>> subclassAuditsQueue =
new ReferenceQueue<>();
/**
* Property to permit setting a filter after objects
* have been read.
* See {@link #setObjectInputFilter(ObjectInputFilter)}
*/
static final boolean SET_FILTER_AFTER_READ = GetBooleanAction
.privilegedGetProperty("jdk.serialSetFilterAfterRead");
}
/*
@ -1260,6 +1269,8 @@ public class ObjectInputStream
* {@link ObjectInputFilter.Config#getSerialFilter() ObjectInputFilter.Config.getSerialFilter}
* when the {@code ObjectInputStream} is constructed and can be set
* to a custom filter only once.
* The filter must be set before reading any objects from the stream;
* for example, by calling {@link #readObject} or {@link #readUnshared}.
*
* @implSpec
* The filter, when not {@code null}, is invoked during {@link #readObject readObject}
@ -1302,7 +1313,8 @@ public class ObjectInputStream
* @throws SecurityException if there is security manager and the
* {@code SerializablePermission("serialFilter")} is not granted
* @throws IllegalStateException if the {@linkplain #getObjectInputFilter() current filter}
* is not {@code null} and is not the system-wide filter
* is not {@code null} and is not the system-wide filter, or
* if an object has been read
* @since 9
*/
public final void setObjectInputFilter(ObjectInputFilter filter) {
@ -1315,6 +1327,10 @@ public class ObjectInputStream
serialFilter != ObjectInputFilter.Config.getSerialFilter()) {
throw new IllegalStateException("filter can not be set more than once");
}
if (totalObjectRefs > 0 && !Caches.SET_FILTER_AFTER_READ) {
throw new IllegalStateException(
"filter can not be set after an object has been read");
}
this.serialFilter = filter;
}

View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -364,8 +364,8 @@ public abstract class Buffer {
if (newLimit > capacity | newLimit < 0)
throw createLimitException(newLimit);
limit = newLimit;
if (position > limit) position = limit;
if (mark > limit) mark = -1;
if (position > newLimit) position = newLimit;
if (mark > newLimit) mark = -1;
return this;
}
@ -689,16 +689,18 @@ public abstract class Buffer {
* @return The current position value, before it is incremented
*/
final int nextGetIndex() { // package-private
if (position >= limit)
int p = position;
if (p >= limit)
throw new BufferUnderflowException();
return position++;
position = p + 1;
return p;
}
final int nextGetIndex(int nb) { // package-private
if (limit - position < nb)
throw new BufferUnderflowException();
int p = position;
position += nb;
if (limit - p < nb)
throw new BufferUnderflowException();
position = p + nb;
return p;
}
@ -710,16 +712,18 @@ public abstract class Buffer {
* @return The current position value, before it is incremented
*/
final int nextPutIndex() { // package-private
if (position >= limit)
int p = position;
if (p >= limit)
throw new BufferOverflowException();
return position++;
position = p + 1;
return p;
}
final int nextPutIndex(int nb) { // package-private
if (limit - position < nb)
throw new BufferOverflowException();
int p = position;
position += nb;
if (limit - p < nb)
throw new BufferOverflowException();
position = p + nb;
return p;
}

View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2007, 2019, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2007, 2020, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -3702,6 +3702,8 @@ public final class Files {
Objects.requireNonNull(cs);
byte[] bytes = JLA.getBytesNoRepl(String.valueOf(csq), cs);
if (path.getClass().getModule() != Object.class.getModule())
bytes = bytes.clone();
write(path, bytes, options);
return path;

View file

@ -465,8 +465,10 @@ public abstract class MessageDigest extends MessageDigestSpi {
* the same length and all bytes at corresponding positions are equal.
*
* @implNote
* If the digests are the same length, all bytes are examined to
* determine equality.
* All bytes in {@code digesta} are examined to determine equality.
* The calculation time depends only on the length of {@code digesta}.
* It does not depend on the length of {@code digestb} or the contents
* of {@code digesta} and {@code digestb}.
*
* @param digesta one of the digests to compare.
*
@ -479,14 +481,22 @@ public abstract class MessageDigest extends MessageDigestSpi {
if (digesta == null || digestb == null) {
return false;
}
if (digesta.length != digestb.length) {
return false;
int lenA = digesta.length;
int lenB = digestb.length;
if (lenB == 0) {
return lenA == 0;
}
int result = 0;
result |= lenA - lenB;
// time-constant comparison
for (int i = 0; i < digesta.length; i++) {
result |= digesta[i] ^ digestb[i];
for (int i = 0; i < lenA; i++) {
// If i >= lenB, indexB is 0; otherwise, i.
int indexB = ((i - lenB) >>> 31) * i;
result |= digesta[i] ^ digestb[indexB];
}
return result == 0;
}

View file

@ -254,6 +254,9 @@ public final class PKCS12Attribute implements KeyStore.Entry.Attribute {
private void parse(byte[] encoded) throws IOException {
DerInputStream attributeValue = new DerInputStream(encoded);
DerValue[] attrSeq = attributeValue.getSequence(2);
if (attrSeq.length != 2) {
throw new IOException("Invalid length for PKCS12Attribute");
}
ObjectIdentifier type = attrSeq[0].getOID();
DerInputStream attrContent =
new DerInputStream(attrSeq[1].toByteArray());

View file

@ -178,15 +178,16 @@ public class ArrayList<E> extends AbstractList<E>
* @throws NullPointerException if the specified collection is null
*/
public ArrayList(Collection<? extends E> c) {
elementData = c.toArray();
if ((size = elementData.length) != 0) {
// defend against c.toArray (incorrectly) not returning Object[]
// (see e.g. https://bugs.openjdk.java.net/browse/JDK-6260652)
if (elementData.getClass() != Object[].class)
elementData = Arrays.copyOf(elementData, size, Object[].class);
Object[] a = c.toArray();
if ((size = a.length) != 0) {
if (c.getClass() == ArrayList.class) {
elementData = a;
} else {
elementData = Arrays.copyOf(a, size, Object[].class);
}
} else {
// replace with empty array.
this.elementData = EMPTY_ELEMENTDATA;
elementData = EMPTY_ELEMENTDATA;
}
}

View file

@ -263,8 +263,7 @@ public class PriorityQueue<E> extends AbstractQueue<E>
private void initElementsFromCollection(Collection<? extends E> c) {
Object[] es = c.toArray();
int len = es.length;
// If c.toArray incorrectly doesn't return Object[], copy it.
if (es.getClass() != Object[].class)
if (c.getClass() != ArrayList.class)
es = Arrays.copyOf(es, len, Object[].class);
if (len == 1 || this.comparator != null)
for (Object e : es)

View file

@ -179,12 +179,13 @@ public class Vector<E>
* @since 1.2
*/
public Vector(Collection<? extends E> c) {
elementData = c.toArray();
elementCount = elementData.length;
// defend against c.toArray (incorrectly) not returning Object[]
// (see e.g. https://bugs.openjdk.java.net/browse/JDK-6260652)
if (elementData.getClass() != Object[].class)
elementData = Arrays.copyOf(elementData, elementCount, Object[].class);
Object[] a = c.toArray();
elementCount = a.length;
if (c.getClass() == ArrayList.class) {
elementData = a;
} else {
elementData = Arrays.copyOf(a, elementCount, Object[].class);
}
}
/**

View file

@ -36,6 +36,7 @@ package java.util.concurrent;
import java.lang.invoke.VarHandle;
import java.lang.reflect.Field;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import java.util.Comparator;
@ -139,9 +140,7 @@ public class CopyOnWriteArrayList<E>
es = ((CopyOnWriteArrayList<?>)c).getArray();
else {
es = c.toArray();
// defend against c.toArray (incorrectly) not returning Object[]
// (see e.g. https://bugs.openjdk.java.net/browse/JDK-6260652)
if (es.getClass() != Object[].class)
if (c.getClass() != java.util.ArrayList.class)
es = Arrays.copyOf(es, es.length, Object[].class);
}
setArray(es);
@ -690,6 +689,9 @@ public class CopyOnWriteArrayList<E>
*/
public int addAllAbsent(Collection<? extends E> c) {
Object[] cs = c.toArray();
if (c.getClass() != ArrayList.class) {
cs = cs.clone();
}
if (cs.length == 0)
return 0;
synchronized (lock) {
@ -741,9 +743,10 @@ public class CopyOnWriteArrayList<E>
Object[] es = getArray();
int len = es.length;
Object[] newElements;
if (len == 0 && cs.getClass() == Object[].class)
if (len == 0 && (c.getClass() == CopyOnWriteArrayList.class ||
c.getClass() == ArrayList.class)) {
newElements = cs;
else {
} else {
newElements = Arrays.copyOf(es, len + cs.length);
System.arraycopy(cs, 0, newElements, len, cs.length);
}

View file

@ -78,6 +78,11 @@ public class ForkJoinWorkerThread extends Thread {
final ForkJoinPool pool; // the pool this thread works in
final ForkJoinPool.WorkQueue workQueue; // work-stealing mechanics
/** An AccessControlContext supporting no privileges */
private static final AccessControlContext INNOCUOUS_ACC =
new AccessControlContext(
new ProtectionDomain[] { new ProtectionDomain(null, null) });
/**
* Creates a ForkJoinWorkerThread operating in the given pool.
*
@ -99,6 +104,7 @@ public class ForkJoinWorkerThread extends Thread {
ForkJoinWorkerThread(ForkJoinPool pool, ClassLoader ccl) {
super("aForkJoinWorkerThread");
super.setContextClassLoader(ccl);
ThreadLocalRandom.setInheritedAccessControlContext(this, INNOCUOUS_ACC);
this.pool = pool;
this.workQueue = pool.registerWorker(this);
}
@ -214,11 +220,6 @@ public class ForkJoinWorkerThread extends Thread {
group, "InnocuousForkJoinWorkerThreadGroup");
}});
/** An AccessControlContext supporting no privileges */
private static final AccessControlContext INNOCUOUS_ACC =
new AccessControlContext(
new ProtectionDomain[] { new ProtectionDomain(null, null) });
InnocuousForkJoinWorkerThread(ForkJoinPool pool) {
super(pool,
ClassLoader.getSystemClassLoader(),

View file

@ -257,8 +257,7 @@ public class PriorityBlockingQueue<E> extends AbstractQueue<E>
}
Object[] es = c.toArray();
int n = es.length;
// If c.toArray incorrectly doesn't return Object[], copy it.
if (es.getClass() != Object[].class)
if (c.getClass() != java.util.ArrayList.class)
es = Arrays.copyOf(es, n, Object[].class);
if (screen && (n == 1 || this.comparator != null)) {
for (Object e : es)

View file

@ -86,10 +86,14 @@ class ZipCoder {
}
}
String toStringUTF8(byte[] ba, int len) {
static String toStringUTF8(byte[] ba, int len) {
return UTF8.toString(ba, 0, len);
}
static String toStringUTF8(byte[] ba, int off, int len) {
return UTF8.toString(ba, off, len);
}
boolean isUTF8() {
return false;
}

View file

@ -795,7 +795,6 @@ public class ZipFile implements ZipConstants, Closeable {
throw new UncheckedIOException(ioe);
}
}
}
/**
@ -1311,6 +1310,44 @@ public class ZipFile implements ZipConstants, Closeable {
}
}
private static final void checkUTF8(byte[] a, int pos, int len) throws ZipException {
try {
int end = pos + len;
while (pos < end) {
// ASCII fast-path: When checking that a range of bytes is
// valid UTF-8, we can avoid some allocation by skipping
// past bytes in the 0-127 range
if (a[pos] < 0) {
ZipCoder.toStringUTF8(a, pos, end - pos);
break;
}
pos++;
}
} catch(Exception e) {
zerror("invalid CEN header (bad entry name)");
}
}
private final void checkEncoding(ZipCoder zc, byte[] a, int pos, int nlen) throws ZipException {
try {
zc.toString(a, pos, nlen);
} catch(Exception e) {
zerror("invalid CEN header (bad entry name)");
}
}
private static final int hashN(byte[] a, int off, int len) {
int h = 1;
while (len-- > 0) {
h = 31 * h + a[off++];
}
return h;
}
private static final int hash_append(int hash, byte b) {
return hash * 31 + b;
}
private static class End {
int centot; // 4 bytes
long cenlen; // 4 bytes
@ -1489,12 +1526,18 @@ public class ZipFile implements ZipConstants, Closeable {
int nlen = CENNAM(cen, pos);
int elen = CENEXT(cen, pos);
int clen = CENCOM(cen, pos);
if ((CENFLG(cen, pos) & 1) != 0)
int flag = CENFLG(cen, pos);
if ((flag & 1) != 0)
zerror("invalid CEN header (encrypted entry)");
if (method != STORED && method != DEFLATED)
zerror("invalid CEN header (bad compression method: " + method + ")");
if (entryPos + nlen > limit)
zerror("invalid CEN header (bad header size)");
if (zc.isUTF8() || (flag & USE_UTF8) != 0) {
checkUTF8(cen, pos + CENHDR, nlen);
} else {
checkEncoding(zc, cen, pos + CENHDR, nlen);
}
// Record the CEN offset and the name hash in our hash cell.
hash = zipCoderForPos(pos).normalizedHash(cen, entryPos, nlen);
hsh = (hash & 0x7fffffff) % tablelen;

View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 1996, 2019, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 1996, 2020, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -298,7 +298,7 @@ public class ZipInputStream extends InflaterInputStream implements ZipConstants
readFully(b, 0, len);
// Force to use UTF-8 if the USE_UTF8 bit is ON
ZipEntry e = createZipEntry(((flag & USE_UTF8) != 0)
? zc.toStringUTF8(b, len)
? ZipCoder.toStringUTF8(b, len)
: zc.toString(b, len));
// now get the remaining fields for the entry
if ((flag & 1) == 1) {