engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undefect. CWE-407 — 63 sites patched across 27 ecosystems

Browse source 
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

90
test/jdk/java/io/SequenceInputStream/Close.java Normal file
View file

@ -0,0 +1,90 @@
/*
* Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
* @bug 8078891
* @summary Ensure close() closes all component streams
*/
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.SequenceInputStream;
import java.util.Collections;
import java.util.Enumeration;
import java.util.List;
public class Close {
public static void main(String[] argv) {
byte[] buf = new byte[42];
List<CloseableBAOS> list = List.of(new CloseableBAOS(buf),
new CloseableBAOS(buf), new CloseableBAOS(buf),
new CloseableBAOS(buf));
Enumeration<CloseableBAOS> enumeration = Collections.enumeration(list);
SequenceInputStream sequence = new SequenceInputStream(enumeration);
try {
sequence.close();
throw new RuntimeException("Expected IOException not thrown");
} catch (IOException e) {
for (CloseableBAOS c : list) {
if (!c.isClosed()) {
throw new RuntimeException("Component stream not closed");
}
}
Throwable[] suppressed = e.getSuppressed();
if (suppressed == null) {
throw new RuntimeException("No suppressed exceptions");
} else if (suppressed.length != list.size() - 1) {
throw new RuntimeException("Expected " + (list.size() - 1) +
" suppressed exceptions but got " + suppressed.length);
}
for (Throwable t : suppressed) {
if (!(t instanceof IOException)) {
throw new RuntimeException("Expected IOException but got " +
t.getClass().getName());
}
}
}
}
static class CloseableBAOS extends ByteArrayInputStream{
private boolean closed;
CloseableBAOS(byte[] buf) {
super(buf);
}
@Override
public void close() throws IOException {
closed = true;
throw new IOException();
}
public boolean isClosed() {
return closed;
}
}
}

55
test/jdk/java/io/SequenceInputStream/ConstructorNull.java Normal file
View file

@ -0,0 +1,55 @@
/*
* Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4016189
* @summary Test operation of nextStream method of SIS
*
*/
import java.io.*;
/**
* This class tests to see if java.io.SequenceInputStream
* nextStream() method operates properly when some of the
* streams it is given on input are null
*/
public class ConstructorNull {
public static void main( String[] argv ) throws Exception {
byte[] data = {10,20};
int b1,b2;
ByteArrayInputStream is = new ByteArrayInputStream(data);
try {
SequenceInputStream sis = new SequenceInputStream(null,is);
int b = sis.read();
throw new RuntimeException("No exception with null stream");
} catch(NullPointerException e) {
System.err.println("Test passed: NullPointerException thrown");
}
}
}

66
test/jdk/java/io/SequenceInputStream/LotsOfStreams.java Normal file
View file

@ -0,0 +1,66 @@
/*
* Copyright (c) 2014, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
* @bug 7011804
* @summary SequenceInputStream#read() was implemented recursivly,
* which may cause stack overflow
*/
import java.io.ByteArrayInputStream;
import java.io.InputStream;
import java.io.SequenceInputStream;
import java.util.Enumeration;
public class LotsOfStreams {
static final int MAX_SUBSTREAMS = 32000;
public static void main(String[] argv) throws Exception {
try (InputStream stream =
new SequenceInputStream(new LOSEnumeration())) {
stream.read();
}
try (InputStream stream =
new SequenceInputStream(new LOSEnumeration())) {
byte[] b = new byte[1];
stream.read(b, 0, 1);
}
}
static class LOSEnumeration
implements Enumeration<InputStream> {
private static InputStream inputStream =
new ByteArrayInputStream(new byte[0]);
private int left = MAX_SUBSTREAMS;
public boolean hasMoreElements() {
return (left > 0);
}
public InputStream nextElement() {
left--;
return inputStream;
}
}
}

251
test/jdk/java/io/SequenceInputStream/TransferTo.java Normal file
View file

@ -0,0 +1,251 @@
/*
* Copyright (c) 2022, 2026, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.io.IOException;
import java.io.OutputStream;
import java.io.SequenceInputStream;
import java.util.Arrays;
import java.util.Random;
import java.util.concurrent.atomic.AtomicReference;
import java.util.function.Consumer;
import java.util.function.Supplier;
import static java.lang.String.format;
import jdk.test.lib.RandomFactory;
import org.junit.jupiter.api.Test;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNotEquals;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
/*
* @test
* @library /test/lib
* @build jdk.test.lib.RandomFactory
* @run junit/othervm/timeout=180 TransferTo
* @bug 8297298
* @summary Tests whether java.io.SequenceInputStream.transferTo conforms to the
* InputStream.transferTo specification
* @key randomness
*/
public class TransferTo {
private static final int MIN_SIZE = 10_000;
private static final int MAX_SIZE_INCR = 100_000_000 - MIN_SIZE;
private static final int ITERATIONS = 10;
private static final Random RND = RandomFactory.getRandom();
/*
* Testing API compliance: input stream must throw NullPointerException
* when parameter "out" is null.
*/
@Test
public void testNullPointerException() throws Exception {
// factory for incoming data provider
InputStreamProvider inputStreamProvider = byteArrayInput();
// tests empty input stream
assertThrows(NullPointerException.class,
() -> inputStreamProvider.input().transferTo(null));
// tests single-byte input stream
assertThrows(NullPointerException.class,
() -> inputStreamProvider.input((byte) 1).transferTo(null));
// tests dual-byte input stream
assertThrows(NullPointerException.class,
() -> inputStreamProvider.input((byte) 1, (byte) 2).transferTo(null));
}
/*
* Testing API compliance: complete content of input stream must be
* transferred to output stream.
*/
@Test
public void testStreamContents() throws Exception {
// factory for incoming data provider
InputStreamProvider inputStreamProvider = byteArrayInput();
// factory for outgoing data recorder
OutputStreamProvider outputStreamProvider = byteArrayOutput();
// tests empty input stream
checkTransferredContents(inputStreamProvider,
outputStreamProvider, new byte[0]);
// tests input stream with a length between 1k and 4k
checkTransferredContents(inputStreamProvider,
outputStreamProvider, createRandomBytes(1024, 4096));
// tests input stream with several data chunks, as 16k is more than a
// single chunk can hold
checkTransferredContents(inputStreamProvider,
outputStreamProvider, createRandomBytes(16384, 16384));
// tests randomly chosen starting positions within source and
// target stream
for (int i = 0; i < ITERATIONS; i++) {
byte[] inBytes = createRandomBytes(MIN_SIZE, MAX_SIZE_INCR);
int posIn = RND.nextInt(inBytes.length);
int posOut = RND.nextInt(MIN_SIZE);
checkTransferredContents(inputStreamProvider,
outputStreamProvider, inBytes, posIn, posOut);
}
// tests reading beyond source EOF (must not transfer any bytes)
checkTransferredContents(inputStreamProvider,
outputStreamProvider, createRandomBytes(4096, 0), 4096, 0);
// tests writing beyond target EOF (must extend output stream)
checkTransferredContents(inputStreamProvider,
outputStreamProvider, createRandomBytes(4096, 0), 0, 4096);
}
/*
* Special case: Assert subsequent input stream is read when preceding stream already was MAX_VALUE long.
* Note: Not testing actual content as it requires multiple GBs of memory and long time.
*/
@Test
public void testHugeStream() throws Exception {
InputStream is1 = repeat(0, Long.MAX_VALUE);
InputStream is2 = repeat(0, 1);
assertNotEquals(is1.available(), 0);
assertNotEquals(is2.available(), 0);
SequenceInputStream sis = new SequenceInputStream(is1, is2);
OutputStream nos = OutputStream.nullOutputStream();
sis.transferTo(nos);
assertEquals(0, is1.available());
assertEquals(0, is2.available());
}
/*
* Produces an input stream that returns b count times.
* Builds a dysfunctional mock that solely implements
* available() and transferTo() particually,
* but fails with any other operation.
*/
private static InputStream repeat(int b, long count) {
return new InputStream() {
private long pos;
@Override
public int available() throws IOException {
return (int) Math.min(count - pos, Integer.MAX_VALUE);
}
@Override
public int read() throws IOException {
throw new UnsupportedOperationException();
}
@Override
public long transferTo(OutputStream os) throws IOException {
// skipping actual writing to os to spare time
pos += count;
return count;
}
};
}
/*
* Asserts that the transferred content is correct, i.e., compares the bytes
* actually transferred to those expected. The position of the input and
* output streams before the transfer are zero (BOF).
*/
private static void checkTransferredContents(InputStreamProvider inputStreamProvider,
OutputStreamProvider outputStreamProvider, byte[] inBytes) throws Exception {
checkTransferredContents(inputStreamProvider,
outputStreamProvider, inBytes, 0, 0);
}
/*
* Asserts that the transferred content is correct, i. e. compares the bytes
* actually transferred to those expected. The positions of the input and
* output streams before the transfer are provided by the caller.
*/
private static void checkTransferredContents(InputStreamProvider inputStreamProvider,
OutputStreamProvider outputStreamProvider, byte[] inBytes, int posIn,
int posOut) throws Exception {
AtomicReference<Supplier<byte[]>> recorder = new AtomicReference<>();
try (InputStream in = inputStreamProvider.input(inBytes);
OutputStream out = outputStreamProvider.output(recorder::set)) {
// skip bytes until starting position
in.skipNBytes(posIn);
out.write(new byte[posOut]);
long reported = in.transferTo(out);
int count = inBytes.length - posIn;
assertEquals(count, reported,
format("reported %d bytes but should report %d", reported, count));
byte[] outBytes = recorder.get().get();
assertTrue(Arrays.equals(inBytes, posIn, posIn + count,
outBytes, posOut, posOut + count),
format("inBytes.length=%d, outBytes.length=%d", count, outBytes.length));
}
}
/*
* Creates an array of random size (between min and min + maxRandomAdditive)
* filled with random bytes
*/
private static byte[] createRandomBytes(int min, int maxRandomAdditive) {
byte[] bytes = new byte[min +
(maxRandomAdditive == 0 ? 0 : RND.nextInt(maxRandomAdditive))];
RND.nextBytes(bytes);
return bytes;
}
private interface InputStreamProvider {
InputStream input(byte... bytes) throws Exception;
}
private interface OutputStreamProvider {
OutputStream output(Consumer<Supplier<byte[]>> spy) throws Exception;
}
private static InputStreamProvider byteArrayInput() {
return bytes -> {
InputStream is1 = new ByteArrayInputStream(bytes, 0, bytes.length / 2);
InputStream is2 = new ByteArrayInputStream(bytes, bytes.length / 2, bytes.length);
return new SequenceInputStream(is1, is2);
};
}
private static OutputStreamProvider byteArrayOutput() {
return new OutputStreamProvider() {
@Override
public OutputStream output(Consumer<Supplier<byte[]>> spy) {
ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
spy.accept(outputStream::toByteArray);
return outputStream;
}
};
}
}