undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions

View file

@ -0,0 +1,39 @@
/*
* Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* @test
* @bug 8130266
* @summary verify the GraphicsEnvironmement implementation class name is not
* polluting system properties
*/
public class CheckGraphicsEnvSystemProperty {
public static void main(String[] args) {
String geProp = System.getProperty("java.awt.graphicsenv");
if (geProp != null) {
throw new RuntimeException("geProp = " + geProp);
}
}
}

View file

@ -0,0 +1,116 @@
/*
* Copyright (c) 2001, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.awt.BorderLayout;
import java.awt.Button;
import java.awt.Color;
import java.awt.Frame;
import java.awt.GraphicsConfiguration;
import java.awt.GraphicsDevice;
import java.awt.GraphicsEnvironment;
import java.awt.Label;
import java.awt.Rectangle;
import java.awt.event.WindowAdapter;
import java.awt.event.WindowEvent;
import java.util.List;
/*
* @test
* @bug 4473671
* @summary Test to verify GraphicsEnvironment.getDefaultScreenDevice always
* returning first screen
* @requires (os.family == "windows")
* @library /java/awt/regtesthelpers
* @build PassFailJFrame
* @run main/manual DefaultScreenDeviceTest
*/
public class DefaultScreenDeviceTest {
private static Frame testFrame;
public static void main(String[] args) throws Exception {
GraphicsEnvironment ge = GraphicsEnvironment.
getLocalGraphicsEnvironment();
GraphicsDevice[] gds = ge.getScreenDevices();
if (gds.length < 2) {
System.out.println("Test requires at least 2 displays");
return;
}
String INSTRUCTIONS = """
1. The test is for systems which allows primary display
selection in multiscreen systems.
Set the system primary screen to be the rightmost
(i.e. the right screen in two screen configuration)
This can be done by going to OS Display Settings
selecting the screen and checking the 'Use this device
as primary monitor' checkbox.
2. When done, click on 'Frame on Primary Screen' button and
see where the frame will pop up
3. If Primary Frame pops up on the primary display,
the test passed, otherwise it failed
""";
PassFailJFrame.builder()
.title("Test Instructions")
.instructions(INSTRUCTIONS)
.rows((int) INSTRUCTIONS.lines().count() + 2)
.columns(35)
.testUI(initialize())
.build()
.awaitAndCheck();
}
private static List<Frame> initialize() {
Frame frame = new Frame("Default screen device test");
GraphicsConfiguration gc =
GraphicsEnvironment.getLocalGraphicsEnvironment().
getDefaultScreenDevice().getDefaultConfiguration();
testFrame = new Frame("Primary screen frame", gc);
frame.setLayout(new BorderLayout());
frame.setSize(200, 200);
Button b = new Button("Frame on Primary Screen");
b.addActionListener(e -> {
if (testFrame != null) {
testFrame.setVisible(false);
testFrame.dispose();
}
testFrame.addWindowListener(new WindowAdapter() {
public void windowClosing(WindowEvent e1) {
testFrame.setVisible(false);
testFrame.dispose();
}
});
testFrame.add(new Label("This frame should be on the primary screen"));
testFrame.setBackground(Color.red);
testFrame.pack();
Rectangle rect = gc.getBounds();
testFrame.setLocation(rect.x + 100, rect.y + 100);
testFrame.setVisible(true);
});
frame.add(b);
return List.of(testFrame, frame);
}
}

View file

@ -0,0 +1,76 @@
/*
* Copyright (c) 2007, 2014, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.awt.*;
import java.awt.image.BufferedImage;
/*
* @test
* @summary Check that GraphicsEnvironment methods do not throw unexpected
* exceptions in headless mode
* @run main/othervm -Djava.awt.headless=true HeadlessGraphicsEnvironment
*/
public class HeadlessGraphicsEnvironment {
public static void main(String args[]) {
GraphicsEnvironment ge = GraphicsEnvironment.getLocalGraphicsEnvironment();
if (!GraphicsEnvironment.isHeadless())
throw new RuntimeException("GraphicsEnvironment.isHeadless says it's not headless mode when it is");
boolean exceptions = false;
try {
GraphicsDevice[] gdl = ge.getScreenDevices();
} catch (HeadlessException e) {
exceptions = true;
}
if (!exceptions)
throw new RuntimeException("HeadlessException did not occur when excepted");
exceptions = false;
try {
GraphicsDevice gdl = ge.getDefaultScreenDevice();
} catch (HeadlessException e) {
exceptions = true;
}
if (!exceptions)
throw new RuntimeException("HeadlessException did not occur when excepted");
Graphics2D gd = ge.createGraphics(new BufferedImage(100, 100, BufferedImage.TYPE_4BYTE_ABGR));
for (Font font : ge.getAllFonts()) {
for (float j = 8; j < 17; j++) {
Font f1 = font.deriveFont(Font.PLAIN, j);
Font f2 = font.deriveFont(Font.BOLD, j);
Font f3 = font.deriveFont(Font.ITALIC, j);
Font f4 = font.deriveFont(Font.BOLD | Font.ITALIC, j);
f1.hasUniformLineMetrics();
f2.hasUniformLineMetrics();
f3.hasUniformLineMetrics();
f4.hasUniformLineMetrics();
}
}
String[] fNames = ge.getAvailableFontFamilyNames();
}
}

View file

@ -0,0 +1,37 @@
/*
* Copyright (c) 2011, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 7002839
* @summary Static init deadlock Win32GraphicsEnvironment and WToolkit
* @run main GE_init1
*/
import java.awt.Toolkit;
public class GE_init1 {
public static void main(String[] args) {
Toolkit.getDefaultToolkit();
}
}

View file

@ -0,0 +1,38 @@
/*
* Copyright (c) 2011, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 7002839
* @summary Static init deadlock Win32GraphicsEnvironment and WToolkit
* @run main GE_init2
*/
import java.awt.GraphicsEnvironment;
public class GE_init2 {
public static void main(String[] args) {
GraphicsEnvironment.getLocalGraphicsEnvironment();
}
}

View file

@ -0,0 +1,39 @@
/*
* Copyright (c) 2011, 2016, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @key headful
* @bug 7002839
* @summary Static init deadlock Win32GraphicsEnvironment and WToolkit
* @run main GE_init3
*/
import java.awt.Frame;
public class GE_init3 {
public static void main(String[] args) {
new Frame("Test3").setVisible(true);
}
}

View file

@ -0,0 +1,37 @@
/*
* Copyright (c) 2011, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 7002839
* @summary Static init deadlock Win32GraphicsEnvironment and WToolkit
* @run main/othervm -Djava.awt.headless=true GE_init4
*/
import java.awt.Toolkit;
public class GE_init4 {
public static void main(String[] args) {
Toolkit.getDefaultToolkit();
}
}

View file

@ -0,0 +1,37 @@
/*
* Copyright (c) 2011, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 7002839
* @summary Static init deadlock Win32GraphicsEnvironment and WToolkit
* @run main/othervm -Djava.awt.headless=true GE_init5
*/
import java.awt.GraphicsEnvironment;
public class GE_init5 {
public static void main(String[] args) {
GraphicsEnvironment.getLocalGraphicsEnvironment();
}
}

View file

@ -0,0 +1,45 @@
/*
* Copyright (c) 2011, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 7002839
* @summary Static init deadlock Win32GraphicsEnvironment and WToolkit
* @run main/othervm -Djava.awt.headless=true GE_init6
*/
import java.awt.*;
public class GE_init6 {
private static boolean passed = false;
public static void main(String[] args) {
try {
new Frame("Test3").setVisible(true);
} catch (HeadlessException e){
passed = true;
}
if (!passed){
throw new RuntimeException("Should have thrown HE but it either didn't throw any or just passed through.");
}
}
}

View file

@ -0,0 +1,62 @@
/*
* Copyright (c) 2008, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 6752638
* @summary Test no NPE calling preferLocaleFonts() on custom GE.
* @run main PreferLocaleFonts
*/
import java.util.*;
import java.awt.*;
import java.awt.image.*;
public class PreferLocaleFonts extends GraphicsEnvironment {
public static void main(String args[]) {
(new PreferLocaleFonts()).preferLocaleFonts();
}
public PreferLocaleFonts() {
super();
}
public Graphics2D createGraphics(BufferedImage image) {
return null;
}
public String[] getAvailableFontFamilyNames(Locale locale) {
return null;
}
public String[] getAvailableFontFamilyNames() {
return null;
}
public Font[] getAllFonts() {
return null;
}
public GraphicsDevice getDefaultScreenDevice() throws HeadlessException {
return null;
}
public GraphicsDevice[] getScreenDevices() throws HeadlessException {
return null;
}
}

View file

@ -0,0 +1,32 @@
/*
* Copyright (c) 2014, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* Portions Copyright (c) 2014 IBM Corporation
*/
public class TestDetectHeadless {
public static void main(String[] args) throws Exception {
Class.forName("javax.swing.plaf.basic.BasicInternalFrameTitlePane");
}
}

View file

@ -0,0 +1,57 @@
#!/bin/sh
#
# Copyright (c) 2014, Oracle and/or its affiliates. All rights reserved.
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
#
# This code is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License version 2 only, as
# published by the Free Software Foundation.
#
# This code is distributed in the hope that it will be useful, but WITHOUT
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
# version 2 for more details (a copy is included in the LICENSE file that
# accompanied this code).
#
# You should have received a copy of the GNU General Public License version
# 2 along with this work; if not, write to the Free Software Foundation,
# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
#
# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
# or visit www.oracle.com if you need additional information or have any
# questions.
#
#
# Portions Copyright (c) 2014 IBM Corporation
#
# @test
# @bug 8058930 7077826
# @summary java.awt.GraphicsEnvironment.getHeadlessProperty() does not work for AIX
#
# @build TestDetectHeadless
# @run shell TestDetectHeadless.sh
OS=`uname -s`
case "$OS" in
Windows* | CYGWIN* | Darwin)
echo "Passed"; exit 0 ;;
* ) unset DISPLAY ;;
esac
${TESTJAVA}/bin/java ${TESTVMOPTS} \
-cp ${TESTCLASSES} TestDetectHeadless
if [ $? -ne 0 ]; then
exit 1;
fi
DISPLAY=
export DISPLAY
${TESTJAVA}/bin/java ${TESTVMOPTS} \
-cp ${TESTCLASSES} TestDetectHeadless
exit $?

View file

@ -0,0 +1,43 @@
/*
* Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 6896335
* @summary Test GraphicsEnvironment.getDefaultScreenDevice() in headless mode
* @run main/othervm -Djava.awt.headless=true TestGetDefScreenDevice
*/
import java.awt.*;
public class TestGetDefScreenDevice {
public static void main(String[] args) throws Exception {
GraphicsEnvironment ge = GraphicsEnvironment.getLocalGraphicsEnvironment();
try {
ge.getDefaultScreenDevice();
throw new Exception("Failed. HeadlessException not thrown");
} catch (HeadlessException he) {
// OK, test passed.
}
}
}