8258915: Temporary buffer cleanup

Reviewed-by: valeriep

src/java.base/share/classes/java/math/BigInteger.java

@@ -688,7 +688,23 @@ public class BigInteger extends Number implements Comparable<BigInteger> {
      * @see #bitLength()
      */
     public BigInteger(int numBits, Random rnd) {
-        this(1, randomBits(numBits, rnd));
+        byte[] magnitude = randomBits(numBits, rnd);
+
+        try {
+            // stripLeadingZeroBytes() returns a zero length array if len == 0
+            this.mag = stripLeadingZeroBytes(magnitude, 0, magnitude.length);
+
+            if (this.mag.length == 0) {
+                this.signum = 0;
+            } else {
+                this.signum = 1;
+            }
+            if (mag.length >= MAX_MAG_LENGTH) {
+                checkRange();
+            }
+        } finally {
+            Arrays.fill(magnitude, (byte)0);
+        }
     }
 
     private static byte[] randomBits(int numBits, Random rnd) {

src/java.base/share/classes/java/math/MutableBigInteger.java

@@ -159,8 +159,14 @@ class MutableBigInteger {
      * supposed to modify the returned array.
      */
     private int[] getMagnitudeArray() {
-        if (offset > 0 || value.length != intLen)
-            return Arrays.copyOfRange(value, offset, offset + intLen);
+        if (offset > 0 || value.length != intLen) {
+            // Shrink value to be the total magnitude
+            int[] tmp = Arrays.copyOfRange(value, offset, offset + intLen);
+            Arrays.fill(value, 0);
+            offset = 0;
+            intLen = tmp.length;
+            value = tmp;
+        }
         return value;
     }
 

src/java.base/share/classes/java/security/spec/EncodedKeySpec.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2021, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,11 @@
 
 package java.security.spec;
 
+import jdk.internal.access.JavaSecuritySpecAccess;
+import jdk.internal.access.SharedSecrets;
+
+import java.util.Arrays;
+
 /**
  * This class represents a public or private key in encoded format.
  *
@@ -45,7 +50,17 @@ public abstract class EncodedKeySpec implements KeySpec {
     private byte[] encodedKey;
     private String algorithmName;
 
-    /**
+    static {
+        SharedSecrets.setJavaSecuritySpecAccess(
+                new JavaSecuritySpecAccess() {
+                    @Override
+                    public void clearEncodedKeySpec(EncodedKeySpec keySpec) {
+                        keySpec.clear();
+                    }
+                });
+    }
+
+                    /**
      * Creates a new {@code EncodedKeySpec} with the given encoded key.
      *
      * @param encodedKey the encoded key. The contents of the
@@ -125,4 +140,11 @@ public abstract class EncodedKeySpec implements KeySpec {
      * @return a string representation of the encoding format.
      */
     public abstract String getFormat();
+
+    /**
+     * Clear the encoding inside.
+     */
+    void clear() {
+        Arrays.fill(encodedKey, (byte)0);
+    }
 }