archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-27 14:54:52 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8300596: Enhance Jar Signature validation

Browse source 
Reviewed-by: mullan, rhalade, mschoene, weijun
This commit is contained in:
Hai-May Chao 2023-03-29 20:24:13 +00:00 • committed by Henry Jen
parent fff7e1ad00
commit ecd0bc1d62
3 changed files with 40 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/java.base/share/classes/java/util/jar/JarFile.java
View file

@ -30,6 +30,7 @@ import jdk.internal.access.JavaUtilZipFileAccess;
import jdk.internal.misc.ThreadTracker;
import sun.security.action.GetPropertyAction;
import sun.security.util.ManifestEntryVerifier;
import sun.security.util.SignatureFileVerifier;
import java.io.ByteArrayInputStream;
import java.io.EOFException;
@ -144,8 +145,6 @@ public class JarFile extends ZipFile {
private static final Runtime.Version RUNTIME_VERSION;
private static final boolean MULTI_RELEASE_ENABLED;
private static final boolean MULTI_RELEASE_FORCED;
// The maximum size of array to allocate. Some VMs reserve some header words in an array.
private static final int MAX_ARRAY_SIZE = Integer.MAX_VALUE - 8;
private SoftReference<Manifest> manRef;
private JarEntry manEntry;
@ -799,8 +798,11 @@ public class JarFile extends ZipFile {
private byte[] getBytes(ZipEntry ze) throws IOException {
try (InputStream is = super.getInputStream(ze)) {
long uncompressedSize = ze.getSize();
if (uncompressedSize > MAX_ARRAY_SIZE) {
throw new IOException("Unsupported size: " + uncompressedSize);
if (uncompressedSize > SignatureFileVerifier.MAX_SIG_FILE_SIZE) {
throw new IOException("Unsupported size: " + uncompressedSize +
" for JarEntry " + ze.getName() +
". Allowed max size: " +
SignatureFileVerifier.MAX_SIG_FILE_SIZE + " bytes");
}
int len = (int)uncompressedSize;
int bytesRead;