undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.

test/jdk/java/io/PrintWriter/CheckError.java

@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) 2005, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * @test
+ * @bug 4213822
+ * @summary Test that checkError() returns a correct value
+ *      when a PrintWriter is wrapped with another
+ *      PrintWriter.
+ */
+
+import java.io.*;
+
+public class CheckError {
+    public static void main(String[] args) throws Exception {
+
+        boolean passTest1 = false;
+        File file = new File(System.getProperty("test.dir", "."),
+                          "junkie.out");
+
+        FileWriter fw = new FileWriter(file);
+
+        PrintWriter ppw  = new PrintWriter(
+                           new PrintWriter(fw));
+
+        fw.close();
+        ppw.println("Hello World!");
+
+        file.deleteOnExit();
+
+        if (ppw.checkError()) {
+            System.out.println("Correct: An error occured in the" +
+                " underlying writer");
+            passTest1 = true;
+        }
+        ppw.close();
+
+        // Test when the underlying stream is a PrintStream
+        FileOutputStream fos = new FileOutputStream(file);
+        PrintWriter pps  = new PrintWriter(
+                            new PrintStream(fos));
+
+        fos.close();
+        pps.println("Hello World!");
+
+        if (pps.checkError()) {
+            System.out.println("Correct: An error occured in the" +
+                " underlying Stream");
+        } else {
+            if (!passTest1) {
+                throw new Exception("CheckError() returned an incorrect value" +
+                    " when error occured in the underlying Stream" +
+                        " and when error occured in the underlying writer");
+            } else {
+                throw new Exception("CheckError() returned an incorrect value" +
+                    " when the error has occured in the underlying Stream");
+            }
+        }
+        if (!passTest1) {
+                throw new Exception("CheckError() returned an incorrect value" +
+                    " when the error has occured in the underlying Writer");
+        }
+        pps.close();
+    }
+}

test/jdk/java/io/PrintWriter/ClearErrorWriter.java

@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2005, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * @test
+ * @bug  4491255
+ * @summary Test for a new protected method PrintWriter.clearError()
+ *          to reset its internal error state
+ */
+
+import java.io.*;
+
+public class ClearErrorWriter extends PrintWriter {
+
+
+    public ClearErrorWriter(Writer w, boolean autoFlush) {
+        super(w, autoFlush);
+    }
+
+    public static void main(String[] args) throws Exception {
+
+        File f = new File(System.getProperty("test.dir", "."),
+                          "print-writer.out");
+        f.deleteOnExit();
+        ClearErrorWriter out = new ClearErrorWriter(new BufferedWriter(
+                                new FileWriter(f)),
+                                true);
+        out.println("Hello World!");
+        out.close();
+        out.println("Writing after close");
+
+        if (out.checkError()) {
+            System.out.println("An error occured");
+            out.clearError();
+
+            if (!out.checkError()) {
+                System.out.println("Error status cleared");
+            } else {
+                throw new Exception("Error Status unchanged");
+            }
+         }
+         else {
+             System.out.println(" No error occured");
+         }
+    }
+}

test/jdk/java/io/PrintWriter/EncodingTest.java

@@ -0,0 +1,138 @@
+/*
+ * Copyright (c) 2017, 2026, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.stream.Stream;
+
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * @test
+ * @bug 8183743
+ * @summary Test to verify the new overload method with Charset functions the same
+ * as the existing method that takes a charset name.
+ * @run junit EncodingTest
+ */
+public class EncodingTest {
+    static String USER_DIR = System.getProperty("user.dir", ".");
+    static boolean AUTOFLUSH = true;
+    public static enum ConstructorType {
+        STRING,
+        FILE,
+        OUTPUTSTREAM
+    }
+
+    /*
+     * DataProvider fields:
+     * Type of the constructor, a file to be written with a charset name,
+     * a file to be written with a charset, charset name, charset.
+     */
+    public static Stream<Arguments> parameters() throws IOException {
+        String csn = StandardCharsets.UTF_8.name();
+        Charset charset = StandardCharsets.UTF_8;
+        File file1 = new File(USER_DIR, "PWCharsetTest1.txt");
+        File file2 = new File(USER_DIR, "PWCharsetTest2.txt");
+
+        return Stream.of
+            (Arguments.of(ConstructorType.STRING, file1, file2, csn, charset),
+             Arguments.of(ConstructorType.FILE, file1, file2, csn, charset),
+             Arguments.of(ConstructorType.OUTPUTSTREAM, file1, file2, csn, charset));
+    }
+
+    /**
+     * Verifies that the overloading constructor behaves the same as the existing
+     * one.
+     *
+     * @param type the type of the constructor
+     * @param file1 file1 written with the name of a charset
+     * @param file2 file2 written with a charset
+     * @param csn the charset name
+     * @param charset the charset
+     * @throws IOException
+     */
+    @ParameterizedTest
+    @MethodSource("parameters")
+    public void test(ConstructorType type, File file1, File file2, String csn, Charset charset)
+            throws Exception {
+        createFile(getWriter(type, file1.getPath(), csn, null));
+        createFile(getWriter(type, file2.getPath(), null, charset));
+
+        assertEquals(Files.readAllLines(Paths.get(file2.getPath()), charset),
+                Files.readAllLines(Paths.get(file1.getPath()), charset));
+    }
+
+    void createFile(PrintWriter out) throws IOException {
+        out.println("high surrogate");
+        out.println(Character.MIN_HIGH_SURROGATE);
+        out.println("low surrogate");
+        out.println(Character.MIN_LOW_SURROGATE);
+        out.flush();
+        out.close();
+    }
+
+    PrintWriter getWriter(ConstructorType type, String path, String csn, Charset charset)
+            throws IOException {
+        PrintWriter out = null;
+        if (csn != null) {
+            switch (type) {
+                case STRING:
+                    out = new PrintWriter(path, csn);
+                    break;
+                case FILE:
+                    out = new PrintWriter(new File(path), csn);
+                    break;
+                case OUTPUTSTREAM:
+                    // No corresponding method with charset name
+                    // compare with PrintWriter(path, csn) instead
+                    out = new PrintWriter(path, csn);
+                    break;
+            }
+        } else {
+            switch (type) {
+                case STRING:
+                    out = new PrintWriter(path, charset);
+                    break;
+                case FILE:
+                    out = new PrintWriter(new File(path), charset);
+                    break;
+                case OUTPUTSTREAM:
+                    FileOutputStream fout = new FileOutputStream(path);
+                    out = new PrintWriter(fout, AUTOFLUSH, charset);
+                    break;
+            }
+        }
+
+        return out;
+    }
+}

test/jdk/java/io/PrintWriter/FailingConstructors.java

@@ -0,0 +1,133 @@
+/*
+ * Copyright (c) 2011, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * @test
+ * @bug 7000511
+ * @summary PrintStream, PrintWriter, Formatter, Scanner leave files open when
+ *          exception thrown
+ */
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.io.UnsupportedEncodingException;
+
+public class FailingConstructors {
+    static final String fileName = "FailingConstructorsTest";
+    static final String UNSUPPORTED_CHARSET = "unknownCharset";
+    static final String FILE_CONTENTS = "This is a small file!";
+
+    private static void realMain(String[] args) throws Throwable {
+        test(false, new File(fileName));
+
+        /* create the file and write its contents */
+        File file = File.createTempFile(fileName, null);
+        file.deleteOnExit();
+        FileOutputStream fos = new FileOutputStream(file);
+        fos.write(FILE_CONTENTS.getBytes());
+        fos.close();
+
+        test(true, file);
+        file.delete();
+    }
+
+    private static void test(boolean exists, File file) throws Throwable {
+        /* PrintWriter(File file, String csn) */
+        try {
+            new PrintWriter(file, UNSUPPORTED_CHARSET);
+            fail();
+        } catch(FileNotFoundException|UnsupportedEncodingException e) {
+            pass();
+        }
+
+        check(exists, file);
+
+        try {
+            new PrintWriter(file, (String)null);
+            fail();
+        } catch(FileNotFoundException|NullPointerException e) {
+            pass();
+        }
+
+        check(exists, file);
+
+        /* PrintWriter(String fileName, String csn)  */
+        try {
+            new PrintWriter(file.getName(), UNSUPPORTED_CHARSET);
+            fail();
+        } catch(FileNotFoundException|UnsupportedEncodingException e) {
+            pass();
+        }
+
+        check(exists, file);
+
+        try {
+            new PrintWriter(file.getName(), (String)null);
+            fail();
+        } catch(FileNotFoundException|NullPointerException e) {
+            pass();
+        }
+
+        check(exists, file);
+    }
+
+    private static void check(boolean exists, File file) {
+        if (exists) {
+            /* the file should be unchanged */
+            verifyContents(file);
+        } else {
+            /* the file should not have been created */
+            if (file.exists()) { fail(file + " should not have been created"); }
+        }
+    }
+
+    private static void verifyContents(File file) {
+        try (FileInputStream fis = new FileInputStream(file)) {
+            byte[] contents = FILE_CONTENTS.getBytes();
+            int read, count = 0;
+            while ((read = fis.read()) != -1) {
+                if (read != contents[count++])  {
+                    fail("file contents have been altered");
+                    return;
+                }
+            }
+        } catch (IOException ioe) {
+            unexpected(ioe);
+        }
+    }
+
+    //--------------------- Infrastructure ---------------------------
+    static volatile int passed = 0, failed = 0;
+    static void pass() {passed++;}
+    static void fail() {failed++; Thread.dumpStack();}
+    static void fail(String message) {System.out.println(message); fail(); }
+    static void unexpected(Throwable t) {failed++; t.printStackTrace();}
+    public static void main(String[] args) throws Throwable {
+        try {realMain(args);} catch (Throwable t) {unexpected(t);}
+        System.out.printf("%nPassed = %d, failed = %d%n%n", passed, failed);
+        if (failed > 0) throw new AssertionError("Some tests failed");}
+}

test/jdk/java/io/PrintWriter/OpsAfterClose.java

@@ -0,0 +1,89 @@
+/*
+ * Copyright (c) 2005, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ *  @test
+ *  @bug 5085148
+ *  @summary Test if PrintWriter methods check if the stream
+ *           has been closed.
+ */
+
+import java.io.*;
+
+public enum OpsAfterClose {
+
+        WRITE_BUF { boolean check(PrintWriter w) {
+                    char buf[] = new char[2];
+                    w.write(buf);
+                    return w.checkError();
+            } },
+
+        WRITE_BUF_OFF { boolean check(PrintWriter w) {
+                    char buf[] = new char[2];
+                    int len = 1;
+                    w.write(buf, 0, len);
+                    return w.checkError();
+             } },
+        WRITE_INT { boolean check(PrintWriter w) {
+                    w.write(1);
+                    return w.checkError();
+             } },
+        WRITE_STR { boolean check(PrintWriter w) {
+                    String s = "abc";
+                    w.write(s);
+                    return w.checkError();
+             } },
+        WRITE_STR_OFF { boolean check(PrintWriter w) {
+                    String s = "abc";
+                    w.write(s, 0, s.length());
+                    return w.checkError();
+             } };
+
+    abstract boolean check(PrintWriter w);
+
+    public static void main(String args[]) throws Exception {
+
+        System.out.println("Testing PrintWriter");
+        boolean failed = false;
+        boolean result = false;
+        File f = new File(System.getProperty("test.dir", "."),
+                          "print-writer.out");
+        f.deleteOnExit();
+
+        for (OpsAfterClose op : OpsAfterClose.values()) {
+            PrintWriter pw = new PrintWriter(
+                                new FileWriter(f));
+            pw.close();
+            result = op.check(pw);
+            if (!result) {
+                failed = true;
+            }
+           System.out.println(op + ":" + result);
+        }
+        if (failed) {
+            throw new Exception(
+                "Test failed for the failed operation{s} " +
+                "above for the PrintWriter");
+        }
+    }
+}

test/jdk/java/io/PrintWriter/OversynchronizedTest.java

@@ -0,0 +1,96 @@
+/*
+ * Copyright (c) 2005, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+   @bug 4905777
+   @summary PrintWriter.println(Object) oversynchronized, can deadlock
+*/
+
+import java.io.PrintWriter;
+
+public class OversynchronizedTest extends Thread {
+    private static PrintWriter writer = new PrintWriter(System.out);
+    private static TestObj testObj = new TestObj("This is a test.", writer);
+    private static int loopNum = 100;
+
+    public void run() {
+        for(int i=0; i<loopNum; i++) {
+            testObj.test();
+
+            //passing an object to PrintWriter.println might cause deadlock
+            //if the object has a synchronized toString() method.
+            //using PrintWriter.println(testObj.toString()) won't have a problem
+           writer.println(testObj);
+        }
+    }
+
+    public static void main(String args[]) throws Exception {
+        // should no NullPointerException
+        writer.println((Object)null);
+
+        int num = 5;
+
+        OversynchronizedTest[] t = new OversynchronizedTest[num];
+        for(int i=0; i<num; i++) {
+            t[i] = new OversynchronizedTest();
+            t[i].start();
+        }
+
+        for(int i=0; i <num; i++) {
+            t[i].join();
+        }
+
+        System.out.println("Test completed");
+    }
+}
+
+class TestObj {
+    String mStr;
+
+    TestObj(String str, PrintWriter writer) {
+        mStr = str;
+        this.writer = writer;
+    }
+
+    synchronized void test() {
+        try {
+            long t = Math.round(Math.random()*10);
+            Thread.currentThread().sleep(t);
+        } catch (InterruptedException e) {
+            // jtreg timeout?
+            // Only jtreg will interrupt this thread so it knows what to do:
+            e.printStackTrace();
+        }
+
+        //the following line might cause hang if there is PrintWriter.println(testObj)
+        //called by other threads.
+        writer.println("In test().");
+    }
+
+    public synchronized String toString() {
+        writer.println("Calling toString\n");
+        return mStr;
+    }
+
+    private PrintWriter writer;
+}

test/jdk/java/io/PrintWriter/SubClass.java

@@ -0,0 +1,64 @@
+/*
+ * Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+   @bug 4103356 4121985
+   @summary Test new subclassing features of PrintWriter
+ */
+
+import java.io.*;
+
+
+public class SubClass {
+
+
+    static class PW extends PrintWriter {
+
+        PW(Writer out) {
+            super(out);
+        }
+
+        public void println() {
+            try {
+                out.write("[EOL]");
+            } catch (IOException x) {
+                setError();
+            }
+            super.println();
+        }
+
+    }
+
+
+    public static void main(String[] args) throws Exception {
+        StringWriter sw = new StringWriter();
+        PrintWriter pw = new PW(sw);
+        pw.println("Hello");
+        pw.close();
+        String s = sw.toString();
+        System.err.print(s);
+        if (!s.equals("Hello[EOL]" + System.getProperty("line.separator")))
+            throw new Exception("Subclass broken");
+    }
+
+}