archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-28 07:14:30 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8300596: Enhance Jar Signature validation

Browse source 
Reviewed-by: mullan, rhalade, mschoene, weijun
This commit is contained in:
Hai-May Chao 2023-03-29 20:24:13 +00:00 • committed by Henry Jen
parent fff7e1ad00
commit ecd0bc1d62
3 changed files with 40 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

27
src/java.base/share/classes/sun/security/util/SignatureFileVerifier.java
View file

@ -36,6 +36,7 @@ import java.util.*;
import java.util.jar.Attributes;
import java.util.jar.Manifest;
import sun.security.action.GetIntegerAction;
import sun.security.jca.Providers;
import sun.security.pkcs.PKCS7;
import sun.security.pkcs.SignerInfo;
@ -83,6 +84,12 @@ public class SignatureFileVerifier {
private static final String META_INF = "META-INF/";
// the maximum allowed size in bytes for the signature-related files
public static final int MAX_SIG_FILE_SIZE = initializeMaxSigFileSize();
// The maximum size of array to allocate. Some VMs reserve some header words in an array.
private static final int MAX_ARRAY_SIZE = Integer.MAX_VALUE - 8;
/**
* Create the named SignatureFileVerifier.
*
@ -833,4 +840,24 @@ public class SignatureFileVerifier {
signerCache.add(cachedSigners);
signers.put(name, cachedSigners);
}
private static int initializeMaxSigFileSize() {
/*
* System property "jdk.jar.maxSignatureFileSize" used to configure
* the maximum allowed number of bytes for the signature-related files
* in a JAR file.
*/
Integer tmp = GetIntegerAction.privilegedGetProperty(
"jdk.jar.maxSignatureFileSize", 8000000);
if (tmp < 0 || tmp > MAX_ARRAY_SIZE) {
if (debug != null) {
debug.println("Default signature file size 8000000 bytes " +
"is used as the specified size for the " +
"jdk.jar.maxSignatureFileSize system property " +
"is out of range: " + tmp);
}
tmp = 8000000;
}
return tmp;
}
}