undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.

test/jdk/java/io/ByteArrayInputStream/ChunkedTransferTo.java

@@ -0,0 +1,72 @@
+/*
+ * Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+ * @bug 8316156
+ * @summary Ensure ByteArrayInputStream.transferTo does not cause direct memory
+ *          to overflow MaxDirectMemorySize
+ * @run junit/othervm -XX:MaxDirectMemorySize=5M ChunkedTransferTo
+ */
+
+import java.io.ByteArrayInputStream;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.nio.channels.Channels;
+import java.nio.channels.FileChannel;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Arrays;
+import java.util.Random;
+
+import static java.nio.file.StandardCopyOption.REPLACE_EXISTING;
+import static java.nio.file.StandardOpenOption.*;
+
+import org.junit.jupiter.api.Test;
+
+public class ChunkedTransferTo {
+    // this value must exceed MaxDirectMemorySize
+    private static final int SIZE = 10_000_000;
+
+    @Test
+    public void byteArrayInputStream() throws IOException {
+        byte[] src = new byte[SIZE];
+        Random rnd = new Random(System.nanoTime());
+        rnd.nextBytes(src);
+        try (ByteArrayInputStream bais = new ByteArrayInputStream(src)) {
+            Path target = Files.createTempFile("SNA", "FU");
+            FileChannel fc = FileChannel.open(target, CREATE, WRITE);
+            bais.transferTo(Channels.newOutputStream(fc));
+            byte[] dst = new byte[SIZE + 1];
+            try (FileInputStream fis = new FileInputStream(target.toFile())) {
+                int n = -1;
+                if ((n = fis.read(dst)) != SIZE)
+                    throw new RuntimeException(n + " != " + SIZE);
+            }
+            Files.delete(target);
+            if (!Arrays.equals(src, 0, SIZE, dst, 0, SIZE))
+                throw new RuntimeException("Arrays are not equal");
+        } catch (OutOfMemoryError oome) {
+            throw new RuntimeException(oome);
+        }
+    }
+}

test/jdk/java/io/ByteArrayInputStream/ReadAllReadNTransferTo.java

@@ -0,0 +1,92 @@
+/*
+ * Copyright (c) 2018, 2021, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.Objects;
+import java.util.Random;
+import jdk.test.lib.RandomFactory;
+
+/* @test
+ * @library /test/lib
+ * @build jdk.test.lib.RandomFactory
+ * @run main ReadAllReadNTransferTo
+ * @bug 6766844 8180451
+ * @summary Verify ByteArrayInputStream readAllBytes, readNBytes, and transferTo
+ * @key randomness
+ */
+public class ReadAllReadNTransferTo {
+    private static final int SIZE = 0x4d4d;
+
+    private static Random random = RandomFactory.getRandom();
+
+    public static void main(String... args) throws IOException {
+        byte[] buf = new byte[SIZE];
+        random.nextBytes(buf);
+        int position = random.nextInt(SIZE/2);
+        int size = random.nextInt(SIZE - position);
+
+        ByteArrayInputStream bais = new ByteArrayInputStream(buf);
+        bais.readAllBytes();
+        if (bais.read(new byte[0]) != -1) {
+            throw new RuntimeException("read(byte[]) did not return -1");
+        }
+        if (bais.read(new byte[1], 0, 0) != -1) {
+            throw new RuntimeException("read(byte[],int,int) did not return -1");
+        }
+
+        bais = new ByteArrayInputStream(buf, position, size);
+        int off = size < 2 ? 0 : random.nextInt(size / 2);
+        int len = size - off < 1 ? 0 : random.nextInt(size - off);
+
+        byte[] bN = new byte[off + len];
+        if (bais.readNBytes(bN, off, len) != len) {
+            throw new RuntimeException("readNBytes return value");
+        }
+        if (!Arrays.equals(bN, off, off + len,
+            buf, position, position + len)) {
+            throw new RuntimeException("readNBytes content");
+        }
+
+        byte[] bAll = bais.readAllBytes();
+        Objects.requireNonNull(bAll, "readAllBytes return value");
+        if (bAll.length != size - len) {
+            throw new RuntimeException("readAllBytes return value length");
+        }
+        if (!Arrays.equals(bAll, 0, bAll.length,
+            buf, position + len, position + len + bAll.length)) {
+            throw new RuntimeException("readAllBytes content");
+        }
+
+        bais = new ByteArrayInputStream(buf);
+        ByteArrayOutputStream baos = new ByteArrayOutputStream(buf.length);
+        if (bais.transferTo(baos) != buf.length) {
+            throw new RuntimeException("transferTo return value length");
+        }
+        if (!Arrays.equals(buf, baos.toByteArray())) {
+            throw new RuntimeException("transferTo content");
+        }
+    }
+}

test/jdk/java/io/ByteArrayInputStream/Skip.java

@@ -0,0 +1,79 @@
+/*
+ * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+
+/* @test
+ * @bug 6720170
+ * @summary check for ByteArrayInputStream.skip
+ */
+
+import java.io.*;
+
+public class Skip {
+    private static void dotest(InputStream in, int curpos, long total,
+                               long toskip, long expected)
+        throws Exception
+    {
+        System.err.println("\nCurrently at pos = " + curpos +
+                           "\nTotal bytes in the stream = " + total +
+                           "\nNumber of bytes to skip = " + toskip +
+                           "\nNumber of bytes that should be skipped = " +
+                           expected);
+
+        // position to curpos; EOF if negative
+        in.reset();
+        int avail = curpos >= 0 ? curpos : in.available();
+        long n = in.skip(avail);
+        if (n != avail) {
+            throw new RuntimeException("Unexpected number of bytes skipped = " + n);
+        }
+
+        long skipped = in.skip(toskip);
+        System.err.println("actual number skipped: "+ skipped);
+
+        if (skipped != expected) {
+            throw new RuntimeException("Unexpected number of bytes skipped = " + skipped);
+        }
+    }
+
+    public static void main(String argv[]) throws Exception {
+        int total = 1024;
+        ByteArrayInputStream in = new ByteArrayInputStream(new byte[total]);
+
+        /* test for skip */
+        dotest(in,  0, total, 23, 23);
+        dotest(in,  10, total, 23, 23);
+
+        /* test for negative skip */
+        dotest(in,  0, total, -23,  0);
+
+        /* check for skip after EOF */
+        dotest(in, -1, total,  20,  0);
+
+        /* check for skip beyond EOF starting from before EOF */
+        dotest(in,  0, total, total+20, total);
+
+        /* check for skip if the pos + toskip causes integer overflow */
+        dotest(in, 10, total, Long.MAX_VALUE, total-10);
+    }
+}

test/jdk/java/io/ByteArrayInputStream/TransferToTrusted.java

@@ -0,0 +1,92 @@
+/*
+ * Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8321053
+ * @summary Verify ByteArrayInputStream.buf is used directly by
+ *          ByteArrayInputStream.transferTo only when its OutputStream
+ *          parameter is trusted
+ * @key randomness
+ */
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.DataOutputStream;
+import java.io.IOException;
+import java.io.OutputStream;
+import java.util.Arrays;
+import java.util.Objects;
+import java.util.Random;
+
+public class TransferToTrusted {
+    private static final Random RND = new Random(System.nanoTime());
+
+    private static class UntrustedOutputStream extends OutputStream {
+        UntrustedOutputStream() {
+            super();
+        }
+
+        @Override
+        public void write(byte[] b, int off, int len) throws IOException {
+            Objects.checkFromIndexSize(off, len, b.length);
+            byte[] tmp = new byte[len];
+            RND.nextBytes(tmp);
+            System.arraycopy(tmp, 0, b, off, len);
+        }
+
+        @Override
+        public void write(int b) throws IOException {
+            write(new byte[] {(byte)b});
+        }
+    }
+
+    public static void main(String[] args) throws IOException {
+        byte[] buf = new byte[RND.nextInt(1025)];
+        System.out.println("buf.length: " + buf.length);
+        RND.nextBytes(buf);
+        byte[] dup = Arrays.copyOf(buf, buf.length);
+
+        ByteArrayInputStream bais = new ByteArrayInputStream(dup);
+        bais.mark(dup.length);
+
+        OutputStream[] outputStreams = new OutputStream[] {
+            new ByteArrayOutputStream(),
+            new UntrustedOutputStream()
+        };
+
+        for (OutputStream out : outputStreams) {
+            System.err.println("out: " + out.getClass().getName());
+
+            bais.transferTo(out);
+            bais.reset();
+            try {
+                if (!Arrays.equals(buf, bais.readAllBytes()))
+                    throw new RuntimeException("Internal buffer was modified");
+            } finally {
+                out.close();
+            }
+            bais.reset();
+        }
+    }
+}