engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undefect. CWE-407 — 63 sites patched across 27 ecosystems

Browse source 
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

72
test/jdk/java/io/OutputStreamWriter/BoundsCheck.java Normal file
View file

@ -0,0 +1,72 @@
/*
* Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4221901
* @summary Ensure that negative offset or negative len parameter for
* write(String str, int off, int len) throws
* IndexOutOfBoundsException.
*/
import java.io.*;
public class BoundsCheck {
public static void main(String args[]) throws Exception {
ByteArrayOutputStream bos = new ByteArrayOutputStream();
OutputStreamWriter osw = new OutputStreamWriter(bos);
String data = "Data to be written";
char cdata[] = {'a', 'b', 'c', 'd', 'a', 'b', 'c', 'd'};
boolean caughtException = false;
try {
osw.write(data, -3, 5);
throw new RuntimeException("Test failed for negative offset");
} catch (IndexOutOfBoundsException e){ }
try {
osw.write(data, 3, -5);
throw new RuntimeException("Test failed for negative length");
} catch (IndexOutOfBoundsException e){ }
try {
osw.write(data, 3, 75);
throw new RuntimeException("Test failed for len+off > str.length");
} catch (IndexOutOfBoundsException e){ }
try {
osw.write(cdata, -3, 5);
throw new RuntimeException("Test failed for negative offset");
} catch (IndexOutOfBoundsException e){ }
try {
osw.write(cdata, 3, -5);
throw new RuntimeException("Test failed for negative length");
} catch (IndexOutOfBoundsException e){ }
try {
osw.write(cdata, 3, 75);
throw new RuntimeException("Test failed for len+off > str.length");
} catch (IndexOutOfBoundsException e){ }
}
}

86
test/jdk/java/io/OutputStreamWriter/CloseWriterOnFailedFlush.java Normal file
View file

@ -0,0 +1,86 @@
/*
* Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
* @bug 8136895
* @summary Verify stream closed after write error in StreamEncoder::implClose
*/
import java.io.IOException;
import java.io.OutputStream;
import java.io.OutputStreamWriter;
import java.io.Writer;
import java.nio.charset.MalformedInputException;
import java.nio.charset.StandardCharsets;
public class CloseWriterOnFailedFlush {
private static final String STR_IOE = "Test"; // IOException
private static final String STR_MIE = "\ud83c"; // MalformedInputException
public static void main(String[] args) throws IOException {
boolean failed = false;
for (String s : new String[] {STR_IOE, STR_MIE}) {
System.out.println("string: " + s);
ErroringOutputStream stream = new ErroringOutputStream();
try (Writer writer = new OutputStreamWriter(stream,
StandardCharsets.UTF_8.newEncoder())) {
writer.write(s);
} catch (IOException ex) {
Class exClass = ex.getClass();
if (s.equals(STR_IOE) && exClass != IOException.class ||
s.equals(STR_MIE) && exClass != MalformedInputException.class)
throw ex;
}
if (stream.isOpen()) {
System.err.println("Stream is STILL open");
failed = true;
} else {
System.out.println("Stream is closed");
}
}
if (failed)
throw new RuntimeException("Test failed");
}
private static class ErroringOutputStream extends OutputStream {
private boolean open = true;
@Override
public void write(int b) throws IOException {
throw new IOException();
}
public boolean isOpen() {
return open;
}
@Override
public void close() throws IOException {
open = false;
System.out.println("Closing");
}
}
}

80
test/jdk/java/io/OutputStreamWriter/Encode.java Normal file
View file

@ -0,0 +1,80 @@
/*
* Copyright (c) 2003, 2011, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4802209
* @summary check that the right utf-8 encoder is used
*/
import java.io.*;
import java.net.*;
public class Encode implements Runnable {
public static void main(String args[]) throws Exception {
new Encode();
}
final ServerSocket ss = new ServerSocket(0);
Encode() throws Exception {
(new Thread(this)).start();
String toEncode = "\uD800\uDC00 \uD801\uDC01 ";
String enc1 = URLEncoder.encode(toEncode, "UTF-8");
byte bytes[] = {};
ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
InputStreamReader reader = new InputStreamReader( bais, "8859_1");
String url = "http://localhost:" + Integer.toString(ss.getLocalPort()) +
"/missing.nothtml";
HttpURLConnection uc = (HttpURLConnection)new URL(url).openConnection();
uc.connect();
try {
String enc2 = URLEncoder.encode(toEncode, "UTF-8");
if (!enc1.equals(enc2)) {
System.out.println("test failed");
throw new RuntimeException("test failed");
}
} finally {
uc.disconnect();
}
}
public void run() {
try (ServerSocket serv = ss;
Socket s = serv.accept();
BufferedReader in =
new BufferedReader(new InputStreamReader(s.getInputStream())))
{
String req = in.readLine();
try (OutputStream os = s.getOutputStream();
BufferedOutputStream bos = new BufferedOutputStream(os);
PrintStream out = new PrintStream(bos))
{
out.print("HTTP/1.1 403 Forbidden\r\n");
out.print("\r\n");
}
} catch (Exception e) {
e.printStackTrace();
}
}
}

45
test/jdk/java/io/OutputStreamWriter/NullCreate.java Normal file
View file

@ -0,0 +1,45 @@
/*
* Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4149935
* @summary Create with a null stream should throw an exception
*/
import java.io.*;
public class NullCreate {
public static void main(String args[])
{
try{
OutputStreamWriter osw = new OutputStreamWriter(null);
} catch (NullPointerException e){
// No problem - null create argument caught
return;
}
throw new RuntimeException("Create with null did not throw an error");
}
}

56
test/jdk/java/io/OutputStreamWriter/TestWrite.java Normal file
View file

@ -0,0 +1,56 @@
/*
* Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4066847 4147276 4131647
* @summary Check for flush of output buffer before concluding it is too small
*/
import java.io.*;
public class TestWrite {
public static void main(String args[])
throws Exception
{
ByteArrayOutputStream bos;
OutputStreamWriter osw;
byte[] array;
try{
bos = new ByteArrayOutputStream();
osw = new OutputStreamWriter(bos, "EUCJIS");
osw.write('a');
for(int count = 0; count < 10000; ++count)
osw.write('\u3042'); // Hiragana
osw.close();
array = bos.toByteArray();
} catch (UnsupportedEncodingException e){
System.err.println("Unsupported encoding - EUCJIS. ext "
+ " may not be properly installed. ext is "
+ " required for the test to run properly ");
throw new Exception("Environment is incorrect");
}
}
}

112
test/jdk/java/io/OutputStreamWriter/WriteAfterClose.java Normal file
View file

@ -0,0 +1,112 @@
/*
* Copyright (c) 1998, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* @test
* @bug 4143651 5085148
*
* @summary Test if Writer methods will check if the stream
* has been closed.
*/
import java.io.*;
public class WriteAfterClose {
static boolean failed = false;
static void testWrite(Writer wtr) throws Exception {
// These tests could be tighted to only check for a particular
// kind of exception, but in 1.2beta4 StringWriter and
// other writers throw RuntimeExceptions
char[] cbuf = new char[2];
wtr.close();
System.out.println("Class " + wtr.getClass().getName());
try {
wtr.write('a');
System.out.println("FAILED: Allows char write on a closed stream");
failed = true;
} catch (Exception e) {
}
try {
wtr.write(cbuf, 0, 1);
System.out.println("FAILED: Allows buffer write on a closed stream");
failed = true;
} catch (Exception e) {
}
try {
wtr.write(cbuf, 0, 0);
System.out.println("FAILED: Allows empty write on a closed stream");
failed = true;
} catch (Exception e) {
}
try {
wtr.write("a");
System.out.println("FAILED: Allows string write on a closed stream");
failed = true;
} catch (Exception e) {
}
try {
wtr.write("a", 0, 1);
System.out.println("FAILED: Allows string buf write on a closed stream");
failed = true;
} catch (Exception e) {
}
try {
wtr.flush();
System.out.println("FAILED: Allows flushing writer on a closed stream");
failed = true;
} catch (Exception e) {
}
wtr.close();
}
public static void main(String argv[]) throws Exception {
StringWriter sw = new StringWriter();
testWrite(new BufferedWriter(sw));
ByteArrayOutputStream bos = new ByteArrayOutputStream();
OutputStreamWriter osw = new OutputStreamWriter(bos);
testWrite(osw);
File f = new File(System.getProperty("test.dir", "."),
"NewFile");
f.createNewFile();
f.deleteOnExit();
FileWriter fr = new FileWriter(f);
testWrite(fr);
if (failed) {
throw new Exception("The test failed because one of the"
+ " writer operation{s} failed. Check the messages");
}
}
}