engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undefect. CWE-407 — 63 sites patched across 27 ecosystems

Browse source 
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

0
test/failure_handler/test/TEST.ROOT Normal file
View file

39
test/failure_handler/test/sanity/Crash.java Normal file
View file

@ -0,0 +1,39 @@
/*
* Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import sun.misc.Unsafe;
import java.lang.reflect.Field;
/*
* @test
* @run main/othervm Crash
*/
public class Crash {
public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException {
Field f = Unsafe.class.getDeclaredField("theUnsafe");
f.setAccessible(true);
Unsafe u = (Unsafe) f.get(null);
u.setMemory(0, 42, (byte) 0xFF);
}
}

63
test/failure_handler/test/sanity/Deadlock.java Normal file
View file

@ -0,0 +1,63 @@
/*
* Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @summary Deadlocked client
*/
public class Deadlock {
public double e;
private volatile int i;
public static void main(String[] args) {
new Deadlock().test();
}
private void test() {
final Object a = new Object();
final Object b = new Object();
new Thread(new Runnable() {
@Override
public void run() {
synchronized (a) {
do {
i |= 1;
} while (i != 3);
synchronized (b) {
e = 1;
}
}
}}).start();
synchronized (b) {
do {
i |= 2;
} while (i != 3);
synchronized (a) {
e = 2;
}
}
}
}

55
test/failure_handler/test/sanity/Livelock.java Normal file
View file

@ -0,0 +1,55 @@
/*
* Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @summary Busy infinite loop client, calculating E number
*/
public class Livelock {
public static double elim;
public static void main(String[] args) {
System.out.printf(
"%24s %24s %24s %24s %24s %24s%n",
"n", "n!", "e = lim(...)", "e = taylor series",
"err e-lim", "err e-taylor");
while (true) {
double esum = 2;
double nfac = 1;
double iter = 1;
for (double n = 1; !Double.isInfinite(n) && !Double.isNaN(n) ; n = n * 2) {
elim = Math.pow(1 + 1 / n, n);
iter += 1;
nfac *= iter;
esum += 1 / nfac;
System.out.printf("% 24.16e % 24.16e % 24.16e % 24.16e"
+ "%- 24.16e %- 24.16e%n",
n, nfac, elim, esum, (Math.E - elim), (Math.E - esum));
}
}
}
}

49
test/failure_handler/test/sanity/OOME.java Normal file
View file

@ -0,0 +1,49 @@
/*
* Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.util.LinkedList;
/*
* @test
* @summary Slowly eat all memory in an infinite loop
* @run main/othervm Crash
*/
public class OOME {
@SuppressWarnings ("UnusedDeclaration")
private static Object garbage;
public static void main(String args[]) {
int chunkSize = 0x8000;
LinkedList<int[]> list = new LinkedList<>();
garbage = list;
while (true) {
try {
list.add(new int[chunkSize]);
} catch (OutOfMemoryError e) {
chunkSize >>= 1;
}
}
}
}

50
test/failure_handler/test/sanity/Suicide.java Normal file
View file

@ -0,0 +1,50 @@
/*
* Copyright (c) 2015, 2020, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @summary Suicide test
* @run main/othervm Suicide
*/
public class Suicide {
public static void main(String[] args) {
String cmd = null;
try {
long pid = ProcessHandle.current().pid();
String osName = System.getProperty("os.name");
if (osName.contains("Windows")) {
cmd = "taskkill.exe /F /PID " + pid;
} else {
cmd = "kill -9 " + pid;
}
System.out.printf("executing `%s'%n", cmd);
Runtime.getRuntime().exec(cmd);
Thread.sleep(2000);
} catch (Exception e) {
e.printStackTrace();
}
System.err.printf("TEST/ENV BUG: %s didn't kill JVM%n", cmd);
System.exit(1);
}
}

32
test/failure_handler/test/sanity/SystemExit.java Normal file
View file

@ -0,0 +1,32 @@
/*
* Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @run main/othervm SystemExit
*/
public class SystemExit {
public static void main(String[] args) {
System.exit(1);
}
}

31
test/failure_handler/test/sanity/ThrowError.java Normal file
View file

@ -0,0 +1,31 @@
/*
* Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
*/
public class ThrowError {
public static void main(String[] args) {
throw new Error("TEST FAIL");
}
}

44
test/failure_handler/test/sanity/WaitForDeadlock.java Normal file
View file

@ -0,0 +1,44 @@
/*
* Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.io.IOException;
import java.nio.file.Paths;
/*
* @test
* @build Deadlock
* @run driver WaitForDeadlock
*/
public class WaitForDeadlock {
public static void main(String[] args) throws Exception {
System.out.println("START");
ProcessBuilder pb = new ProcessBuilder(Paths.get(
System.getProperty("test.jdk"), "bin", "java").toString(),
"-cp", System.getProperty("java.class.path"),
Deadlock.class.getName());
pb.redirectError(ProcessBuilder.Redirect.to(Paths.get("out").toFile()));
pb.redirectOutput(ProcessBuilder.Redirect.to(Paths.get("err").toFile()));
int r = pb.start().waitFor();
System.out.println("END. " + r);
}
}

118
test/failure_handler/test/unit/jdk/test/failurehandler/value/DefaultParserTest.java Normal file
View file

@ -0,0 +1,118 @@
/*
* Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package jdk.test.failurehandler.value;
import org.junit.Assert;
import org.junit.Test;
public class DefaultParserTest {
@Test
public void testParseStringArray() throws Exception {
DefaultParser parser = new DefaultParser();
String line = "a aa aaa";
String[] result = {"a", "aa", "", "", "aaa"};
Assert.assertArrayEquals(result,
(Object[]) parser.parse(result.getClass(), line, " "));
line = null;
result = new String[]{};
Assert.assertArrayEquals(result,
(Object[]) parser.parse(result.getClass(), line, " "));
}
@Test
public void testParseObjectArray() throws Exception {
DefaultParser parser = new DefaultParser();
String line = "a aa aaa";
String[] result = {"a", "aa", "", "", "aaa"};
Assert.assertArrayEquals(result,
(String[]) parser.parse(result.getClass(), line, " "));
Object[] result2 = {"a", "aa", "", "", "aaa"};
Assert.assertArrayEquals(result2,
(Object[]) parser.parse(result.getClass(), line, " "));
}
@Test
public void testParseCharArray() throws Exception {
DefaultParser parser = new DefaultParser();
String line = "a b c a";
char[] result = {'a', 'b', 'c', 'a'};
Assert.assertArrayEquals(result,
(char[]) parser.parse(result.getClass(), line, " "));
Character[] result2 = {'a', 'b', 'c', 'a'};
Assert.assertArrayEquals(result2,
(Character[]) parser.parse(result2.getClass(), line, " "));
}
@Test
public void testParseBoolean() throws Exception {
DefaultParser parser = new DefaultParser();
String line = "a b c a";
Assert.assertEquals(false,
(boolean) parser.parse(boolean.class, line, " "));
Assert.assertEquals(Boolean.FALSE,
parser.parse(Boolean.class, line, " "));
line = "trUe";
Assert.assertEquals(true,
(boolean) parser.parse(boolean.class, line, " "));
Assert.assertEquals(Boolean.TRUE,
parser.parse(Boolean.class, line, " "));
}
@Test
public void testParseShort() throws Exception {
DefaultParser parser = new DefaultParser();
Assert.assertSame("10", (short) 10,
parser.parse(short.class, "10", " "));
Assert.assertSame("010", (short) 8,
parser.parse(short.class, "010", " "));
Assert.assertSame("0x10", (short) 16,
parser.parse(short.class, "0x10", " "));
}
@Test
public void testParseByte() throws Exception {
DefaultParser parser = new DefaultParser();
Assert.assertSame("11", (byte) 11,
parser.parse(byte.class, "11", " "));
Assert.assertSame("011", (byte) 9,
parser.parse(byte.class, "011", " "));
Assert.assertSame("0x11", (byte) 17,
parser.parse(byte.class, "0x11", " "));
}
@Test
public void testParseInt() throws Exception {
DefaultParser parser = new DefaultParser();
Assert.assertEquals("20", (int) 20,
parser.parse(int.class, "20", " "));
Assert.assertEquals("020", (int) 16,
parser.parse(int.class, "020", " "));
Assert.assertEquals("0x20", (int) 32,
parser.parse(int.class, "0x20", " "));
}
}

110
test/failure_handler/test/unit/jdk/test/failurehandler/value/ValueHandlerTest.java Normal file
View file

@ -0,0 +1,110 @@
/*
* Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package jdk.test.failurehandler.value;
import org.junit.Assert;
import org.junit.Test;
import java.lang.reflect.Field;
import java.util.Properties;
public class ValueHandlerTest {
@Test
public void testApplyAnonymousPrivateFinalInt() throws Exception {
Properties p = new Properties();
p.put("int", "010");
Object o = new Object() {
@Value (name = "int")
private final int i1 = -1;
};
Field f = o.getClass().getDeclaredField("i1");
f.setAccessible(true);
int value = f.getInt(o);
Assert.assertEquals(value, -1);
f.setAccessible(false);
ValueHandler.apply(o, p, null);
f.setAccessible(true);
value = f.getInt(o);
Assert.assertEquals(value, 8);
f.setAccessible(false);
}
@Test
public void testApplyPublicStaticWithDefault() throws Exception {
Assert.assertEquals(StaticDefaultCase.s, null);
Properties p = new Properties();
StaticDefaultCase o = new StaticDefaultCase();
ValueHandler.apply(o, p, "prefix");
Assert.assertEquals(StaticDefaultCase.s, "default");
p.put("s", "new2");
ValueHandler.apply(o, p, "prefix");
Assert.assertEquals(StaticDefaultCase.s, "new2");
p.put("prefix.s", "new");
ValueHandler.apply(o, p, "prefix");
Assert.assertEquals(StaticDefaultCase.s, "new");
ValueHandler.apply(o, p, null);
Assert.assertEquals(StaticDefaultCase.s, "new2");
}
protected class InnerClass1 {
@Value (name = "innerClass")
String[] arr = null;
}
public class InnerClass2 extends InnerClass1 {
@Value (name = "float")
float f = 0.0f;
@SubValues (prefix = "inner")
InnerClass1 inner1 = new InnerClass1();
@SubValues (prefix = "")
InnerClass1 inner2 = new InnerClass1();
}
@Test
public void testApplySub() throws Exception {
InnerClass2 o = new InnerClass2();
Assert.assertArrayEquals(o.arr, null);
Assert.assertArrayEquals(o.inner1.arr, null);
Assert.assertArrayEquals(o.inner2.arr, null);
Assert.assertEquals(o.f, 0.0f, Float.MIN_VALUE);
Properties p = new Properties();
p.put("float", "1.f");
p.put("innerClass", "a b");
p.put("inner.innerClass", "a b c");
ValueHandler.apply(o, p, "");
Assert.assertArrayEquals(o.arr, new String[]{"a", "b"});
Assert.assertArrayEquals(o.inner1.arr, new String[]{"a", "b", "c"});
Assert.assertArrayEquals(o.inner2.arr, new String[]{"a", "b"});
Assert.assertEquals(o.f, 1.0f, Float.MIN_VALUE);
}
}
class StaticDefaultCase {
@Value (name = "s")
@DefaultValue (value = "default")
public static String s;
}