undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions

View file

@ -0,0 +1,35 @@
/*
* Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
@bug 4138774
@summary Make sure that a bad drive letter doesn't cause an exception
*/
public class BadDriveLetter {
public static void main(String[] args) {
System.err.println(new java.io.File(".:").getAbsolutePath());
}
}

View file

@ -0,0 +1,50 @@
/*
* Copyright (c) 1998, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
@bug 4096648
@summary Make sure that isDirectory and lastModified work on "x:"
@requires (os.family == "windows")
*/
import java.io.File;
public class DriveOnly {
public static void main(String[] args) throws Exception {
File f = new File("").getCanonicalFile();
while (f.getParent() != null) f = f.getParentFile();
String p = f.getPath().substring(0, 2);
if (!(Character.isLetter(p.charAt(0)) && (p.charAt(1) == ':'))) {
System.err.println("No current drive, cannot run test");
return;
}
f = new File(p);
if (!f.isDirectory())
throw new Exception("\"" + f + "\" is not a directory");
if (f.lastModified() == 0)
throw new Exception("\"" + f + "\" has no last-modified time");
}
}

View file

@ -0,0 +1,59 @@
/*
* Copyright (c) 1997, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
@bug 4070044 4164823
@summary Check getCanonicalPath's treatment of drive-relative paths (win32)
@requires (os.family == "windows")
*/
import java.io.*;
public class DriveRelativePath {
static void fail(String s) {
throw new RuntimeException(s);
}
public static void main(String[] args) throws IOException {
File f = new File("foo");
String c = f.getCanonicalPath();
System.err.println(c);
int di = c.indexOf(':');
if (di == -1) fail("No drive in canonical path");
String drive = c.substring(0, di + 1);
File f2 = new File(drive + "foo");
System.err.println(f2);
String c2 = f2.getCanonicalPath();
System.err.println(c2);
if (!c2.equals(c)) fail("Canonical path mismatch: \""
+ f2 + "\" maps to \""
+ c2 + "\"; it should map to \""
+ c + "\"");
}
}

View file

@ -0,0 +1,51 @@
/*
* Copyright (c) 1998, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
@bug 4065189
@summary Check that win32 pathnames of the form "C:\\"
can be listed by the File.list method
@requires (os.family == "windows")
@author Mark Reinhold
*/
import java.io.*;
public class DriveSlash {
public static void main(String[] args) throws Exception {
File f = new File("c:\\");
System.err.println(f.getCanonicalPath());
String[] fs = f.list();
if (fs == null) {
throw new Exception("File.list returned null");
}
for (int i = 0; i < fs.length; i++) {
System.err.print(" " + fs[i]);
}
System.err.println();
}
}

View file

@ -0,0 +1,76 @@
/*
* Copyright (c) 1998, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4042592 4042593
@requires (os.family == "windows")
* @summary Test operation of rename and delete on win32
*/
import java.io.*;
/**
* This class tests to see if java.io.file rename() method
* operates properly with non canonical pathnames
* and then tests delete() method with non canonical pathnames
*/
public class RenameDelete {
public static void main(String[] args) throws Exception {
boolean success = false;
//construct a test file in this location
File f1 = new File(".");
StringBuffer location = new StringBuffer("\\");
location.append(f1.getCanonicalPath());
StringBuffer fromLocation = new StringBuffer(location.toString()+"\\From");
StringBuffer toLocation = new StringBuffer(location.toString()+"\\To");
f1 = new File(fromLocation.toString());
File f2 = new File(toLocation.toString());
if(f1.exists() || f2.exists()) {
System.err.println("Directories exist -- test not valid");
return;
}
System.err.println("Create:"+f1.mkdir());
System.err.println("Exist as directory:"+f1.exists()+" "+f1.isDirectory());
success = f1.renameTo(f2);
System.err.println("Rename:"+success);
if (!success)
throw new RuntimeException("File method rename did not function");
success = f2.delete();
System.err.println("Delete:"+success);
if (!success)
throw new RuntimeException("File method delete did not function");
}
}

View file

@ -0,0 +1,91 @@
/*
* Copyright (c) 1998, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
@bug 4039597
@summary Check that pathnames containing double-byte characters are not
corrupted by win32 path processing
@requires (os.family == "windows")
@author Mark Reinhold
@library /test/lib
*/
import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.OutputStream;
import jtreg.SkippedException;
public class SJIS {
private static void rm(File f) {
if (!f.delete()) throw new RuntimeException("Can't delete " + f);
}
private static void touch(File f) throws IOException {
OutputStream o = new FileOutputStream(f);
o.close();
}
public static void main(String[] args) throws Exception {
/* This test is only valid on win32 systems
that use the SJIS encoding */
String enc = System.getProperty("native.encoding");
if ((enc == null) || !enc.equals("MS932")) {
throw new SkippedException(
"native.encoding(%s) is not MS932".formatted(enc));
}
File f = new File("\u30BD");
if (f.exists()) rm(f);
System.err.println(f.getCanonicalPath());
touch(f);
System.err.println(f.getCanonicalPath());
rm(f);
if (!f.mkdir()) {
throw new Exception("Can't create directory " + f);
}
File f2 = new File(f, "\u30BD");
System.err.println(f2.getCanonicalPath());
touch(f2);
String cfn = f2.getCanonicalPath();
if (!(new File(cfn)).exists()) {
throw new Exception(cfn + " not found");
}
File d = new File(".");
String[] fs = d.list();
if (fs == null) System.err.println("No files listed");
for (int i = 0; i < fs.length; i++) {
System.err.println(fs[i]);
}
}
}

View file

@ -0,0 +1,51 @@
/*
* Copyright (c) 2005, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
* @bug 6344646
* @summary tests that WinNTFileSystem.hashCode() uses
* locale independent case mapping.
* @requires (os.family == "windows")
*/
import java.io.*;
import java.util.*;
public class bug6344646 {
public static void main(String[] s) {
Locale reservedLocale = Locale.getDefault();
try {
Locale.setDefault(Locale.of("lt"));
File f1 = new File("J\u0301");
File f2 = new File("j\u0301");
if (f1.hashCode() != f2.hashCode()) {
throw new RuntimeException("File.hashCode() for \"J\u0301\" " +
"and \"j\u0301\" should be the same");
}
} finally {
// restore the reserved locale
Locale.setDefault(reservedLocale);
}
}
}