undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.

test/jdk/java/io/Serializable/enum/array/Test.java

@@ -0,0 +1,69 @@
+/*
+ * Copyright (c) 2003, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+ * @bug 4838379
+ * @summary Verify that serialization of enum constant arrays functions
+ *          properly.
+ */
+
+import java.io.*;
+import java.util.Arrays;
+
+enum Foo { klaatu, barada { int i = 1; }, nikto }
+
+public class Test {
+    public static void main(String[] args) throws Exception {
+        ByteArrayOutputStream bout = new ByteArrayOutputStream();
+        ObjectOutputStream oout = new ObjectOutputStream(bout);
+        Foo[] fa = Foo.values();
+        Object[] oa = Arrays.asList(fa).toArray();
+        oout.writeObject(oa);
+        oout.writeObject(fa);
+        oout.close();
+        ObjectInputStream oin = new ObjectInputStream(
+            new ByteArrayInputStream(bout.toByteArray()));
+        Object[] oa2 = (Object[]) oin.readObject();
+        if (!elementsIdentical(oa, oa2)) {
+            throw new Error("arrays differ: " +
+                Arrays.asList(oa) + ", " + Arrays.asList(oa2));
+        }
+        Foo[] fa2 = (Foo[]) oin.readObject();
+        if (!elementsIdentical(fa, fa2)) {
+            throw new Error("arrays differ: " +
+                Arrays.asList(fa) + ", " + Arrays.asList(fa2));
+        }
+    }
+
+    static boolean elementsIdentical(Object[] a1, Object[] a2) {
+        if (a1.length != a2.length) {
+            return false;
+        }
+        for (int i = 0; i < a1.length; i++) {
+            if (a1[i] != a2[i]) {
+                return false;
+            }
+        }
+        return true;
+    }
+}

test/jdk/java/io/Serializable/enum/badResolve/Read.java

@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @bug 4838379
+ * @summary Verify that enum classes present in a serialization stream cannot
+ *          be resolved by the receiver to non-enum classes, and vice-versa.
+ */
+
+import java.io.*;
+
+class EnumToNonEnum implements Serializable {
+    private static final long serialVersionUID = 0L;
+}
+
+enum NonEnumToEnum { foo }
+
+public class Read {
+    public static void main(String[] args) throws Exception {
+        read("0.ser");
+        read("1.ser");
+        read("2.ser");
+        read("3.ser");
+    }
+
+    static void read(String filename) throws Exception {
+        FileInputStream in = new FileInputStream(filename);
+        try {
+            ObjectInputStream oin = new ObjectInputStream(in);
+            Object obj = oin.readObject();
+            throw new Error("read of " + obj + " should not have succeeded");
+        } catch (InvalidClassException e) {
+            System.out.println("caught expected exception " + e);
+        } finally {
+            in.close();
+        }
+    }
+}

test/jdk/java/io/Serializable/enum/badResolve/Write.java

@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2003, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+ * @bug 4838379
+ * @summary Verify that enum classes present in a serialization stream cannot
+ *          be resolved by the receiver to non-enum classes, and vice-versa.
+ *
+ * @compile Write.java
+ * @run main Write
+ * @clean Write
+ * @compile Read.java
+ * @run main Read
+ * @clean Read
+ */
+
+import java.io.*;
+
+enum EnumToNonEnum { foo }
+
+class NonEnumToEnum implements Serializable {
+    private static final long serialVersionUID = 0L;
+}
+
+public class Write {
+    public static void main(String[] args) throws Exception {
+        write(EnumToNonEnum.class, "0.ser");
+        write(NonEnumToEnum.class, "1.ser");
+        write(EnumToNonEnum.foo, "2.ser");
+        write(new NonEnumToEnum(), "3.ser");
+    }
+
+    static void write(Object obj, String filename) throws Exception {
+        ObjectOutputStream oout =
+            new ObjectOutputStream(new FileOutputStream(filename));
+        oout.writeObject(obj);
+        oout.close();
+    }
+}

test/jdk/java/io/Serializable/enum/basic/Test.java

@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) 2003, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+ * @bug 4838379
+ * @summary Verify that basic serialization of non-specialized enum constants
+ *          functions properly.
+ */
+
+import java.io.*;
+
+enum Foo { klaatu, barada, nikto }
+
+public class Test {
+    public static void main(String[] args) throws Exception {
+        ByteArrayOutputStream bout = new ByteArrayOutputStream();
+        ObjectOutputStream oout = new ObjectOutputStream(bout);
+        for (Foo f : Foo.values()) {
+            oout.writeObject(f);
+        }
+        oout.close();
+        ObjectInputStream oin = new ObjectInputStream(
+            new ByteArrayInputStream(bout.toByteArray()));
+        for (Foo f : Foo.values()) {
+            Object obj = oin.readObject();
+            if (obj != f) {
+                throw new Error("expected " + f + ", got " + obj);
+            }
+        }
+    }
+}

test/jdk/java/io/Serializable/enum/classObject/Test.java

@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2003, 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+ * @bug 4838379
+ * @summary Verify that serialization of Class objects for enum types works
+ *          properly.
+ */
+
+import java.io.*;
+
+enum Foo { foo, bar { int i = 0; }, baz { double d = 3.0; } }
+
+public class Test {
+    public static void main(String[] args) throws Exception {
+        ByteArrayOutputStream bout = new ByteArrayOutputStream();
+        ObjectOutputStream oout = new ObjectOutputStream(bout);
+        Class<?>[] classes = { Enum.class, Foo.foo.getClass(),
+                            Foo.bar.getClass(), Foo.baz.getClass() };
+        for (int i = 0; i < classes.length; i++) {
+            oout.writeObject(classes[i]);
+        }
+        oout.close();
+
+        ObjectInputStream oin = new ObjectInputStream(
+            new ByteArrayInputStream(bout.toByteArray()));
+        for (int i = 0; i < classes.length; i++) {
+            Object obj = oin.readObject();
+            if (obj != classes[i]) {
+                throw new Error("expected " + classes[i] + ", got " + obj);
+            }
+        }
+    }
+}

test/jdk/java/io/Serializable/enum/constantSubclasses/Read.java

@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @bug 4838379
+ * @summary Verify that serialization of enum constants that are instances of
+ *          constant-specific subclasses functions properly.
+ */
+
+import java.io.*;
+
+enum Foo {
+    a,
+    b { byte b = 3; },
+    c,
+    d { double d = 6.0; }
+}
+
+public class Read {
+    public static void main(String[] args) throws Exception {
+        FileInputStream in = new FileInputStream("foo.ser");
+        try {
+            ObjectInputStream oin = new ObjectInputStream(in);
+            for (Foo f : Foo.values()) {
+                Object obj = oin.readObject();
+                if (obj != f) {
+                    throw new Error("expected " + f + ", got " + obj);
+                }
+            }
+        } finally {
+            in.close();
+        }
+    }
+}

test/jdk/java/io/Serializable/enum/constantSubclasses/Write.java

@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2003, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+ * @bug 4838379
+ * @summary Verify that serialization of enum constants that are instances of
+ *          constant-specific subclasses functions properly.
+ *
+ * @compile Write.java
+ * @run main Write
+ * @clean Write
+ * @compile Read.java
+ * @run main Read
+ * @clean Read
+ */
+
+import java.io.*;
+
+enum Foo {
+    a,
+    b,
+    c { int i = 5; },
+    d { float f = 5.0f; }
+}
+
+public class Write {
+    public static void main(String[] args) throws Exception {
+        ObjectOutputStream oout =
+            new ObjectOutputStream(new FileOutputStream("foo.ser"));
+        for (Foo f : Foo.values()) {
+            oout.writeObject(f);
+        }
+        oout.close();
+    }
+}

test/jdk/java/io/Serializable/enum/ignoreSerializationFields/Test.java

@@ -0,0 +1,74 @@
+/*
+ * Copyright (c) 2003, 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+ * @bug 4838379
+ * @summary Verify that serialVersionUID and serialPersistentFields
+ *          declarations made by enum types and constants are ignored.
+ */
+
+import java.io.*;
+import java.util.Arrays;
+
+enum Foo {
+
+    foo,
+    bar {
+        @SuppressWarnings("serial") /* Incorrect declarations are being tested */
+        private static final long serialVersionUID = 2L;
+        // bar is implemented as an inner class instance, so the following
+        // declaration would cause a compile-time error
+        // private static final ObjectStreamField[] serialPersistentFields = {
+        //    new ObjectStreamField("gub", Float.TYPE)
+        // };
+    };
+
+    @SuppressWarnings("serial") /* Incorrect declarations are being tested */
+    private static final long serialVersionUID = 1L;
+
+    @SuppressWarnings("serial") /* Incorrect declarations are being tested */
+    private static final ObjectStreamField[] serialPersistentFields = {
+        new ObjectStreamField("blargh", Integer.TYPE)
+    };
+}
+
+public class Test {
+    public static void main(String[] args) throws Exception {
+        Class<?>[] classes =
+            { Foo.class, Foo.foo.getClass(), Foo.bar.getClass() };
+        for (int i = 0; i < classes.length; i++) {
+            ObjectStreamClass desc = ObjectStreamClass.lookup(classes[i]);
+            if (desc.getSerialVersionUID() != 0L) {
+                throw new Error(
+                    classes[i] + " has non-zero serialVersionUID: " +
+                    desc.getSerialVersionUID());
+            }
+            ObjectStreamField[] fields = desc.getFields();
+            if (fields.length > 0) {
+                throw new Error(
+                    classes[i] + " has non-empty list of fields: " +
+                    Arrays.asList(fields));
+            }
+        }
+    }
+}

test/jdk/java/io/Serializable/enum/ignoreSerializationMethods/Test.java

@@ -0,0 +1,93 @@
+/*
+ * Copyright (c) 2003, 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+ * @bug 4838379
+ * @summary Verify that custom serialization methods defined by enum types are
+ *          not invoked during serialization or deserialization.
+ */
+
+import java.io.*;
+
+enum Foo {
+
+    foo,
+    bar {
+        @SuppressWarnings("serial") /* Incorrect declarations are being tested */
+        private void writeObject(ObjectOutputStream out) throws IOException {
+            throw new Error("bar.writeObject invoked");
+        }
+        @SuppressWarnings("serial") /* Incorrect declarations are being tested */
+        private void readObject(ObjectInputStream in)
+            throws IOException, ClassNotFoundException
+        {
+            throw new Error("bar.readObject invoked");
+        }
+        @SuppressWarnings("serial") /* Incorrect declarations are being tested */
+        Object writeReplace() throws ObjectStreamException {
+            throw new Error("bar.writeReplace invoked");
+        }
+        // readResolve cannot be defined until Enum.readResolve is removed
+        // Object readResolve() throws ObjectStreamException {
+        //    throw new Error("bar.readResolve invoked");
+        // }
+    };
+
+    @SuppressWarnings("serial") /* Incorrect use is being tested */
+    private void writeObject(ObjectOutputStream out) throws IOException {
+        throw new Error("Foo.writeObject invoked");
+    }
+    @SuppressWarnings("serial") /* Incorrect use is being tested */
+    private void readObject(ObjectInputStream in)
+        throws IOException, ClassNotFoundException
+    {
+        throw new Error("Foo.readObject invoked");
+    }
+    @SuppressWarnings("serial") /* Incorrect use is being tested */
+    Object writeReplace() throws ObjectStreamException {
+        throw new Error("Foo.writeReplace invoked");
+    }
+    // readResolve cannot be defined until Enum.readResolve is removed
+    // Object readResolve() throws ObjectStreamException {
+    //    throw new Error("Foo.readResolve invoked");
+    // }
+}
+
+public class Test {
+    public static void main(String[] args) throws Exception {
+        ByteArrayOutputStream bout = new ByteArrayOutputStream();
+        ObjectOutputStream oout = new ObjectOutputStream(bout);
+        for (Foo f : Foo.values()) {
+            oout.writeObject(f);
+        }
+        oout.close();
+        ObjectInputStream oin = new ObjectInputStream(
+            new ByteArrayInputStream(bout.toByteArray()));
+        for (Foo f : Foo.values()) {
+            Object obj = oin.readObject();
+            if (obj != f) {
+                throw new Error("expected " + f + ", got " + obj);
+            }
+        }
+    }
+}

test/jdk/java/io/Serializable/enum/mismatchedTypecode/Test.java

@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) 2003, 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+ * @bug 4838379
+ * @summary Verify that TC_OBJECT followed by a class descriptor for an enum
+ *          class results in an InvalidClassException, as does TC_ENUM followed
+ *          by a class descriptor for a non-enum class.
+ */
+
+import java.io.*;
+
+enum Foo { bar }
+
+class TestObjectOutputStream extends ObjectOutputStream {
+
+    static ObjectStreamClass fooDesc = ObjectStreamClass.lookup(Foo.class);
+    static ObjectStreamClass integerDesc =
+        ObjectStreamClass.lookup(Integer.class);
+
+    TestObjectOutputStream(OutputStream out) throws IOException {
+        super(out);
+    }
+
+    protected void writeClassDescriptor(ObjectStreamClass desc)
+        throws IOException
+    {
+        if (desc == fooDesc) {
+            super.writeClassDescriptor(integerDesc);
+        } else if (desc == integerDesc) {
+            super.writeClassDescriptor(fooDesc);
+        } else {
+            super.writeClassDescriptor(desc);
+        }
+    }
+}
+
+public class Test {
+    public static void main(String[] args) throws Exception {
+        ByteArrayOutputStream bout = new ByteArrayOutputStream();
+        ObjectOutputStream oout = new TestObjectOutputStream(bout);
+        oout.writeObject(Foo.bar);
+        oout.close();
+        ObjectInputStream oin = new ObjectInputStream(
+            new ByteArrayInputStream(bout.toByteArray()));
+        try {
+            Object obj = oin.readObject();
+            throw new Error("read of " + obj + " should not have succeeded");
+        } catch (InvalidClassException e) {
+            System.out.println("caught expected exception " + e);
+        }
+
+        oout = new TestObjectOutputStream(bout = new ByteArrayOutputStream());
+        oout.writeObject(5);
+        oout.close();
+        oin = new ObjectInputStream(
+            new ByteArrayInputStream(bout.toByteArray()));
+        try {
+            Object obj = oin.readObject();
+            throw new Error("read of " + obj + " should not have succeeded");
+        } catch (InvalidClassException e) {
+            System.out.println("caught expected exception " + e);
+        }
+    }
+}

test/jdk/java/io/Serializable/enum/missingConstant/Read.java

@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @bug 4838379
+ * @summary Verify that deserialization of an enum constant that does not exist
+ *          on the receiving side results in an InvalidObjectException.
+ */
+
+import java.io.*;
+
+enum Foo { foo, bar }
+
+public class Read {
+    public static void main(String[] args) throws Exception {
+        FileInputStream in = new FileInputStream("foo.ser");
+        try {
+            ObjectInputStream oin = new ObjectInputStream(in);
+            for (Foo f : Foo.values()) {
+                Object obj = oin.readObject();
+                if (obj != f) {
+                    throw new Error("expected " + f + ", got " + obj);
+                }
+            }
+            try {
+                Object obj = oin.readObject();
+                throw new Error("read of " + obj + " should not succeed");
+            } catch (InvalidObjectException e) {
+                System.out.println("caught expected exception: " + e);
+            }
+        } finally {
+            in.close();
+        }
+    }
+}

test/jdk/java/io/Serializable/enum/missingConstant/Write.java

@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2003, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+ * @bug 4838379
+ * @summary Verify that deserialization of an enum constant that does not exist
+ *          on the receiving side results in an InvalidObjectException.
+ *
+ * @compile Write.java
+ * @run main Write
+ * @clean Write
+ * @compile Read.java
+ * @run main Read
+ * @clean Read
+ */
+
+import java.io.*;
+
+enum Foo { foo, bar, baz }
+
+public class Write {
+    public static void main(String[] args) throws Exception {
+        ObjectOutputStream oout =
+            new ObjectOutputStream(new FileOutputStream("foo.ser"));
+        for (Foo f : Foo.values()) {
+            oout.writeObject(f);
+        }
+        oout.close();
+    }
+}

test/jdk/java/io/Serializable/enum/unshared/Test.java

@@ -0,0 +1,133 @@
+/*
+ * Copyright (c) 2003, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+ * @bug 4838379
+ * @summary Verify that unshared write and read operations work properly with
+ *          enum constants.
+ */
+
+import java.io.*;
+
+enum Foo { foo, bar, baz }
+
+abstract class WriteReadTest {
+
+    abstract void write(ObjectOutputStream out) throws Exception;
+    abstract void read(ObjectInputStream in) throws Exception;
+
+    void run() throws Exception {
+        ByteArrayOutputStream bout = new ByteArrayOutputStream();
+        ObjectOutputStream oout = new ObjectOutputStream(bout);
+        write(oout);
+        oout.close();
+        read(new ObjectInputStream(
+            new ByteArrayInputStream(bout.toByteArray())));
+    }
+}
+
+public class Test {
+    public static void main(String[] args) throws Exception {
+        WriteReadTest[] tests = {
+            new WriteReadTest() {
+                void write(ObjectOutputStream out) throws Exception {
+                    out.writeObject(Foo.foo);
+                    out.writeObject(Foo.foo);
+                }
+                void read(ObjectInputStream in) throws Exception {
+                    Object obj = in.readObject();
+                    if (obj != Foo.foo) {
+                        throw new Error(
+                            "expected " + Foo.foo + " instead of " + obj);
+                    }
+                    try {
+                        obj = in.readUnshared();
+                        throw new Error(
+                            "read of " + obj + " should not have succeeded");
+                    } catch (ObjectStreamException e) {
+                        System.out.println("caught expected exception " + e);
+                    }
+                }
+            },
+            new WriteReadTest() {
+                void write(ObjectOutputStream out) throws Exception {
+                    out.writeObject(Foo.foo);
+                    out.writeObject(Foo.foo);
+                }
+                void read(ObjectInputStream in) throws Exception {
+                    Object obj = in.readUnshared();
+                    if (obj != Foo.foo) {
+                        throw new Error(
+                            "expected " + Foo.foo + " instead of " + obj);
+                    }
+                    try {
+                        obj = in.readObject();
+                        throw new Error(
+                            "read of " + obj + " should not have succeeded");
+                    } catch (ObjectStreamException e) {
+                        System.out.println("caught expected exception " + e);
+                    }
+                }
+            },
+            new WriteReadTest() {
+                void write(ObjectOutputStream out) throws Exception {
+                    out.writeObject(Foo.foo);
+                    out.writeUnshared(Foo.foo);
+                }
+                void read(ObjectInputStream in) throws Exception {
+                    Object obj = in.readUnshared();
+                    if (obj != Foo.foo) {
+                        throw new Error(
+                            "expected " + Foo.foo + " instead of " + obj);
+                    }
+                    obj = in.readUnshared();
+                    if (obj != Foo.foo) {
+                        throw new Error(
+                            "expected " + Foo.foo + " instead of " + obj);
+                    }
+                }
+            },
+            new WriteReadTest() {
+                void write(ObjectOutputStream out) throws Exception {
+                    out.writeUnshared(Foo.foo);
+                    out.writeObject(Foo.foo);
+                }
+                void read(ObjectInputStream in) throws Exception {
+                    Object obj = in.readUnshared();
+                    if (obj != Foo.foo) {
+                        throw new Error(
+                            "expected " + Foo.foo + " instead of " + obj);
+                    }
+                    obj = in.readUnshared();
+                    if (obj != Foo.foo) {
+                        throw new Error(
+                            "expected " + Foo.foo + " instead of " + obj);
+                    }
+                }
+            }
+        };
+        for (int i = 0; i < tests.length; i++) {
+            tests[i].run();
+        }
+    }
+}