undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.

test/jdk/java/io/StreamTokenizer/Comment.java

@@ -0,0 +1,86 @@
+/*
+ * Copyright (c) 1998, 2010, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+   @bug 4106810 4027740 4078997 4097738
+   @summary Make sure StreamTokenizer will correctly
+            parse different types of comments in input.
+   */
+
+
+import java.io.*;
+
+public class Comment {
+
+    public static void main(String[] args) throws Exception {
+
+        File f = new File(System.getProperty("test.src", "."), "input.txt");
+
+        int slashIsCommentStart = 1;
+        int slashSlashComment = 2;
+        int slashStarComment = 4;
+
+        for (int i = 0; i < 8 ; i++) {
+            FileReader reader = new FileReader(f);
+            try {
+                StreamTokenizer st = new StreamTokenizer(reader);
+
+                /* decide the state of this run */
+                boolean slashCommentFlag = ((i & slashIsCommentStart) != 0);
+                boolean slashSlashCommentFlag = ((i & slashSlashComment) != 0);
+                boolean slashStarCommentFlag = ((i & slashStarComment) != 0);
+
+                /* set the initial state of the tokenizer */
+                if (!slashCommentFlag) {
+                    st.ordinaryChar('/');
+                }
+                st.slashSlashComments(slashSlashCommentFlag);
+                st.slashStarComments(slashStarCommentFlag);
+
+                /* now go throgh the input file */
+                while(st.nextToken() != StreamTokenizer.TT_EOF)
+                {
+                    String token = st.sval;
+                    if (token == null) {
+                        continue;
+                    } else {
+                        if ((token.compareTo("Error1") == 0) && slashStarCommentFlag) {
+                            throw new Exception("Failed to pass one line C comments!");
+                        }
+                        if ((token.compareTo("Error2") == 0) && slashStarCommentFlag) {
+                            throw new Exception("Failed to pass multi line C comments!");
+                        }
+                        if ((token.compareTo("Error3") == 0) && slashSlashCommentFlag) {
+                            throw new Exception("Failed to pass C++ comments!");
+                        }
+                        if ((token.compareTo("Error4") == 0) && slashCommentFlag) {
+                            throw new Exception("Failed to pass / comments!");
+                        }
+                    }
+                }
+            } finally {
+                reader.close();
+            }
+        }
+    }
+}

test/jdk/java/io/StreamTokenizer/NullConstruct.java

@@ -0,0 +1,43 @@
+/*
+ * Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+   @bug 4022204
+   @summary Check for null input in the constructor.
+   */
+
+
+import java.io.*;
+
+public class NullConstruct {
+
+    public static void main(String[] args) throws Exception {
+        try {
+            Reader in = null;
+            StreamTokenizer st = new StreamTokenizer(in);
+            throw new Exception
+                ("Failed test: constructor didn't catch null input");
+        } catch (NullPointerException e) {
+        }
+    }
+}

test/jdk/java/io/StreamTokenizer/QuoteTest.java

@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+ *  @bug 4218879
+ *  @summary On encountering a quoted string in the stream, nextToken() must
+ *  return '\"' and StreamTokenizer.toString() must return the actual quoted
+ *  string.
+ */
+
+
+import java.io.*;
+
+public class QuoteTest {
+
+    static String testStr = "token1 token2 \"The test string\" token4";
+        public static void main(String[] args) throws Exception {
+
+        System.err.println("Parsing String: " + testStr);
+        StreamTokenizer st = new StreamTokenizer(new StringReader(testStr));
+        boolean foundToken = false;
+        String matchStr = null;
+        while(st.nextToken() != StreamTokenizer.TT_EOF)
+        {
+            switch (st.ttype) {
+                case '\"':
+                    foundToken = true;
+                    matchStr = st.toString();
+                    System.err.println("Found token " + matchStr);
+                    break;
+                default:
+                    System.err.println("Found token " + st);
+                    break;
+            }
+        }
+        if (!foundToken)
+            throw new RuntimeException("Test failed to recognize Quote type");
+        if (!matchStr.equals("Token[The test string], line 1"))
+            throw new RuntimeException("Test failed parse quoted string");
+    }
+}

test/jdk/java/io/StreamTokenizer/ReadAhead.java

@@ -0,0 +1,137 @@
+/*
+ * Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+   @bug 4150737
+   @summary Ensure that StreamTokenizer does not read any further ahead
+            than is absolutely necessary
+ */
+
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.Reader;
+import java.io.StreamTokenizer;
+import java.io.IOException;
+
+
+public class ReadAhead {
+
+
+    /* An InputStream subclass that cannot read past a given limit */
+    private static class LimitedInputStream extends InputStream {
+
+        private String input;
+        private int limit;      /* Do not allow input[limit] to be read */
+        private int next = 0;
+
+        public LimitedInputStream(String input, int limit) {
+            this.input = input;
+            this.limit = limit;
+        }
+
+        public int read() throws IOException {
+            if (next >= limit)
+                throw new IOException("Attempted to read too far in stream");
+            return input.charAt(next++);
+        }
+
+    }
+
+
+    /* A Reader subclass that cannot read past a given limit */
+    private static class LimitedReader extends Reader {
+
+        private String input;
+        private int limit;      /* Do not allow input[limit] to be read */
+        private int next = 0;
+
+        public LimitedReader(String input, int limit) {
+            this.input = input;
+            this.limit = limit;
+        }
+
+        public int read() throws IOException {
+            if (next >= limit)
+                throw new IOException("Attempted to read too far in stream");
+            return input.charAt(next++);
+        }
+
+        public int read(char[] b, int off, int len) throws IOException {
+            int top = off + len;
+            int i;
+            for (i = off; i < top; i++) {
+                int c = read();
+                if (c < 0) break;
+                b[i] = (char)c;
+            }
+            return i - off;
+        }
+
+        public void close() { }
+
+    }
+
+
+    /* Interface for objects that can create new StreamTokenizers
+       with a given limited input */
+    private static interface StreamTokenizerMaker {
+        public StreamTokenizer create(String input, int limit);
+    }
+
+    private static void fail(String why) throws Exception {
+        throw new Exception(why);
+    }
+
+    private static void test(StreamTokenizer st) throws Exception {
+        st.eolIsSignificant(true);
+        int tt = st.nextToken();
+        if (tt != StreamTokenizer.TT_WORD) fail("expected TT_WORD");
+        if (!st.sval.equals("foo")) fail("expected word token \"foo\"");
+        tt = st.nextToken();
+        if (tt != StreamTokenizer.TT_EOL) fail("expected TT_EOL");
+    }
+
+    private static void test(StreamTokenizerMaker stm) throws Exception {
+        test(stm.create("foo\nx", 4));
+        test(stm.create("foo\r\nx", 4));
+    }
+
+
+    public static void main(String[] args) throws Exception {
+
+        /* InputStream case */
+        test(new StreamTokenizerMaker() {
+            public StreamTokenizer create(String input, int limit) {
+                return new StreamTokenizer(new LimitedInputStream(input, limit));
+            }});
+
+        /* Reader case */
+        test(new StreamTokenizerMaker() {
+            public StreamTokenizer create(String input, int limit) {
+                return new StreamTokenizer(new LimitedReader(input, limit));
+            }});
+
+    }
+
+}

test/jdk/java/io/StreamTokenizer/Reset.java

@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/* @test
+   @bug 4090992
+   @summary Make sure StreamTokenizer.nextToken works correctly when
+            the underlying stream is reset after the end of stream has
+            reached.
+   */
+
+import java.io.*;
+
+public class Reset {
+
+    public static void main (String argv[]) throws Exception {
+
+        StringBufferInputStream in = new StringBufferInputStream("[ #");
+        StreamTokenizer scan = new StreamTokenizer(in);
+
+        scan.nextToken();
+        scan.nextToken();
+        in.reset();
+        int token = scan.nextToken();
+        if (token != '[') {
+            throw new Exception
+                ("Test failed: should get token [, but get " + token);
+        }
+    }
+}

test/jdk/java/io/StreamTokenizer/input.txt

@@ -0,0 +1,10 @@
+/* Error1: not recognizing slashStar comment */
+
+/* Error2 : not recognizing
+ * Error2: slashStar
+ * Error2: comments
+ */
+
+// Error3: not recognizing slashSlash comments
+
+/ Error4: not recognizing slash comments