undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.

test/jdk/java/io/Serializable/resolveClass/MethodTest.java

@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2001, 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+ * @bug 4413434
+ * @summary Verify that generated java.lang.reflect implementation classes do
+ *          not interfere with serialization's class resolution mechanism.
+ */
+
+import java.io.*;
+import java.lang.reflect.*;
+
+public class MethodTest implements Serializable {
+    private static final long serialVersionUID = 1L;
+
+    public static void main(String[] args) throws Exception {
+        Method readObject = ObjectInputStream.class.getDeclaredMethod(
+            "readObject", new Class<?>[0]);
+        ByteArrayOutputStream bout = new ByteArrayOutputStream();
+        ObjectOutputStream oout = new ObjectOutputStream(bout);
+        oout.writeObject(new MethodTest());
+        oout.close();
+
+        for (int i = 0; i < 100; i++) {
+            ObjectInputStream oin = new ObjectInputStream(
+                new ByteArrayInputStream(bout.toByteArray()));
+            readObject.invoke(oin, new Object[0]);
+        }
+    }
+}

test/jdk/java/io/Serializable/resolveClass/consTest/Boot.java

@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2001, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @bug 4413434
+ * @summary Verify that generated java.lang.reflect implementation classes do
+ *          not interfere with serialization's class resolution mechanism.
+ */
+
+import java.io.*;
+
+// this class should be loaded from bootclasspath
+public class Boot {
+    public Boot(ObjectInputStream oin) throws Exception {
+        oin.readObject();
+    }
+}

test/jdk/java/io/Serializable/resolveClass/consTest/ConsTest.java

@@ -0,0 +1,60 @@
+/*
+ * Copyright (c) 2001, 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 4413434
+ * @library /test/lib
+ * @build jdk.test.lib.util.JarUtils SetupJar Boot
+ * @run driver SetupJar
+ * @run main/othervm -Xbootclasspath/a:boot.jar ConsTest
+ * @summary Verify that generated java.lang.reflect implementation classes do
+ *          not interfere with serialization's class resolution mechanism.
+ */
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import java.io.Serializable;
+import java.lang.reflect.Constructor;
+
+import jdk.test.lib.util.JarUtils;
+
+public class ConsTest implements Serializable {
+    private static final long serialVersionUID = 1L;
+
+    public static void main(String[] args) throws Exception {
+        Constructor<?> cons = Boot.class.getConstructor(ObjectInputStream.class);
+        ByteArrayOutputStream bout = new ByteArrayOutputStream();
+        ObjectOutputStream oout = new ObjectOutputStream(bout);
+        oout.writeObject(new ConsTest());
+        oout.close();
+
+        for (int i = 0; i < 100; i++) {
+            ObjectInputStream oin = new ObjectInputStream(
+                new ByteArrayInputStream(bout.toByteArray()));
+            cons.newInstance(oin);
+        }
+    }
+}

test/jdk/java/io/Serializable/resolveClass/consTest/SetupJar.java

@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.nio.file.Path;
+import java.nio.file.Paths;
+
+import jdk.test.lib.util.JarUtils;
+
+public class SetupJar {
+
+    public static void main(String args[]) throws Exception {
+        Path classes = Paths.get(System.getProperty("test.classes", ""));
+        JarUtils.createJarFile(Paths.get("boot.jar"), classes,
+                classes.resolve("Boot.class"));
+    }
+}

test/jdk/java/io/Serializable/resolveClass/deserializeButton/DeserializeButtonTest.java

@@ -0,0 +1,62 @@
+/*
+ * Copyright (c) 2001, 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 4413434
+ * @library /test/lib
+ * @build jdk.test.lib.util.JarUtils Foo
+ * @run main DeserializeButtonTest
+ * @summary Verify that class loaded outside of application class loader is
+ *          correctly resolved during deserialization when read in by custom
+ *          readObject() method of a bootstrap class (in this case,
+ *          java.util.Vector).
+ */
+
+import java.net.URLClassLoader;
+import java.net.URL;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+
+import jdk.test.lib.util.JarUtils;
+
+public class DeserializeButtonTest {
+    public static void main(String[] args) throws Exception {
+        setup();
+
+        try (URLClassLoader ldr =
+            new URLClassLoader(new URL[]{ new URL("file:cb.jar") })) {
+            Runnable r = (Runnable) Class.forName("Foo", true, ldr)
+                    .getConstructor().newInstance();
+            r.run();
+        }
+    }
+
+    private static void setup() throws Exception {
+        Path classes = Paths.get(System.getProperty("test.classes", ""));
+        JarUtils.createJarFile(Paths.get("cb.jar"),
+                               classes,
+                               classes.resolve("Foo.class"),
+                               classes.resolve("Foo$TestElement.class"));
+    }
+}

test/jdk/java/io/Serializable/resolveClass/deserializeButton/Foo.java

@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 2001, 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @bug 4413434
+ * @summary Verify that class loaded outside of application class loader is
+ *          correctly resolved during deserialization when read in by custom
+ *          readObject() method of a bootstrap class (in this case,
+ *          java.util.Vector).
+ */
+
+import java.io.*;
+import java.util.Vector;
+
+public class Foo implements Runnable {
+
+    static class TestElement extends Object implements Serializable {
+        private static final long serialVersionUID = 1L;
+    }
+
+    public void run() {
+        try {
+            Vector<TestElement> container = new Vector<TestElement>();
+            container.add(new TestElement());
+
+            // iterate to trigger java.lang.reflect code generation
+            for (int i = 0; i < 100; i++) {
+                ByteArrayOutputStream bout = new ByteArrayOutputStream();
+                ObjectOutputStream oout = new ObjectOutputStream(bout);
+                oout.writeObject(container);
+                oout.close();
+                ObjectInputStream oin = new ObjectInputStream(
+                    new ByteArrayInputStream(bout.toByteArray()));
+                oin.readObject();
+            }
+        } catch (Exception ex) {
+            throw new Error(
+                "Error occured while (de)serializing container: ", ex);
+        }
+    }
+}