engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undefect. CWE-407 — 63 sites patched across 27 ecosystems

Browse source 
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

34
test/jdk/java/lang/ClassLoader/loadLibraryDeadlock/Class1.java Normal file
View file

@ -0,0 +1,34 @@
/*
* Copyright (c) 2021, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2021, BELLSOFT. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* Class1 loads a native library that calls ClassLoader.findClass in JNI_OnLoad.
* Class1 runs concurrently with another thread that opens a signed jar file.
*/
class Class1 {
static {
System.loadLibrary("loadLibraryDeadlock");
System.out.println("Signed jar loaded from native library.");
}
}

89
test/jdk/java/lang/ClassLoader/loadLibraryDeadlock/LoadLibraryDeadlock.java Normal file
View file

@ -0,0 +1,89 @@
/*
* Copyright (c) 2021, 2023, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2021, BELLSOFT. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* LoadLibraryDeadlock class triggers the deadlock between the two
* lock objects - ZipFile object and ClassLoader.loadedLibraryNames hashmap.
* Thread #2 loads a signed jar which leads to acquiring the lock objects in
* natural order (ZipFile then HashMap) - loading a signed jar may involve
* Providers initialization. Providers may load native libraries.
* Thread #1 acquires the locks in reverse order, first entering loadLibrary
* called from Class1, then acquiring ZipFile during the search for a class
* triggered from JNI.
*/
import java.lang.*;
import java.net.URISyntaxException;
public class LoadLibraryDeadlock {
public static void main(String[] args) {
System.out.println("LoadLibraryDeadlock test started");
Thread t1 = new Thread() {
public void run() {
try {
// an instance of unsigned class that loads a native library
Class<?> c1 = Class.forName("Class1");
Object o = c1.newInstance();
System.out.println("Class1 loaded from " + getLocation(c1));
} catch (ClassNotFoundException |
InstantiationException |
IllegalAccessException e) {
System.out.println("Class Class1 not found.");
throw new RuntimeException(e);
}
}
};
Thread t2 = new Thread() {
public void run() {
try {
// load a class from a signed jar, which locks the JarFile
Class<?> c2 = Class.forName("p.Class2");
System.out.println("Class2 loaded from " + getLocation(c2));
} catch (ClassNotFoundException e) {
System.out.println("Class Class2 not found.");
throw new RuntimeException(e);
}
}
};
t2.start();
t1.start();
try {
t1.join();
t2.join();
} catch (InterruptedException ex) {
throw new RuntimeException(ex);
}
}
private static String getLocation(Class<?> c) {
var pd = c.getProtectionDomain();
var cs = pd != null ? pd.getCodeSource() : null;
try {
// same format as returned by TestLoadLibraryDeadlock::getLocation
return cs != null ? cs.getLocation().toURI().getPath() : null;
} catch (URISyntaxException ex) {
throw new RuntimeException(ex);
}
}
}

188
test/jdk/java/lang/ClassLoader/loadLibraryDeadlock/TestLoadLibraryDeadlock.java Normal file
View file

@ -0,0 +1,188 @@
/*
* Copyright (c) 2021, 2023, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2021, BELLSOFT. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8266310
* @summary Checks if there's no deadlock between the two lock objects -
* class loading lock and ClassLoader.loadedLibraryNames hashmap.
* @library /test/lib
* @build LoadLibraryDeadlock Class1 p.Class2
* @run main/othervm/native -Xcheck:jni TestLoadLibraryDeadlock
*/
import jdk.test.lib.Asserts;
import jdk.test.lib.JDKToolFinder;
import jdk.test.lib.process.*;
import jdk.test.lib.util.FileUtils;
import java.lang.ProcessBuilder;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.io.*;
import java.util.*;
import java.util.spi.ToolProvider;
import static jdk.test.lib.process.ProcessTools.*;
public class TestLoadLibraryDeadlock {
private static final ToolProvider JAR = ToolProvider.findFirst("jar")
.orElseThrow(() -> new RuntimeException("ToolProvider for jar not found"));
private static final String KEYSTORE = "keystore.jks";
private static final String STOREPASS = "changeit";
private static final String KEYPASS = "changeit";
private static final String ALIAS = "test";
private static final String DNAME = "CN=test";
private static final String VALIDITY = "366";
private static String testClassPath = System.getProperty("test.classes");
private static String testLibraryPath = System.getProperty("test.nativepath");
private static String classPathSeparator = System.getProperty("path.separator");
private static OutputAnalyzer runCommand(File workingDirectory, String... commands) throws Throwable {
ProcessBuilder pb = new ProcessBuilder(commands);
pb.directory(workingDirectory);
System.out.println("COMMAND: " + String.join(" ", commands));
return ProcessTools.executeProcess(pb);
}
private static OutputAnalyzer runCommandInTestClassPath(String... commands) throws Throwable {
return runCommand(new File(testClassPath), commands);
}
private static OutputAnalyzer genKey() throws Throwable {
FileUtils.deleteFileIfExistsWithRetry(
Paths.get(testClassPath, KEYSTORE));
String keytool = JDKToolFinder.getJDKTool("keytool");
return runCommandInTestClassPath(keytool,
"-storepass", STOREPASS,
"-keypass", KEYPASS,
"-keystore", KEYSTORE,
"-keyalg", "rsa", "-keysize", "2048",
"-genkeypair",
"-alias", ALIAS,
"-dname", DNAME,
"-validity", VALIDITY
);
}
private static void createJar(String outputJar, String... classes) throws Throwable {
List<String> args = new ArrayList<>();
Collections.addAll(args, "cvf", Paths.get(testClassPath, outputJar).toString());
for (String c : classes) {
Collections.addAll(args, "-C", testClassPath, c);
}
if (JAR.run(System.out, System.err, args.toArray(new String[0])) != 0) {
throw new RuntimeException("jar operation failed");
}
}
private static OutputAnalyzer signJar(String jarToSign) throws Throwable {
String jarsigner = JDKToolFinder.getJDKTool("jarsigner");
return runCommandInTestClassPath(jarsigner,
"-keystore", KEYSTORE,
"-storepass", STOREPASS,
jarToSign, ALIAS
);
}
private final static long countLines(OutputAnalyzer output, String string) {
return output.asLines()
.stream()
.filter(s -> s.contains(string))
.count();
}
public static void main(String[] args) throws Throwable {
genKey()
.shouldHaveExitValue(0);
Path aJar = Path.of(testClassPath, "a.jar");
Path bJar = Path.of(testClassPath, "b.jar");
Path cJar = Path.of(testClassPath, "c.jar");
FileUtils.deleteFileIfExistsWithRetry(aJar);
FileUtils.deleteFileIfExistsWithRetry(bJar);
FileUtils.deleteFileIfExistsWithRetry(cJar);
createJar("a.jar",
"LoadLibraryDeadlock.class",
"LoadLibraryDeadlock$1.class",
"LoadLibraryDeadlock$2.class");
createJar("b.jar",
"Class1.class");
createJar("c.jar",
"p/Class2.class");
signJar("c.jar")
.shouldHaveExitValue(0);
// load trigger class
OutputAnalyzer outputAnalyzer = executeCommand(createTestJavaProcessBuilder("-cp",
aJar.toString() + classPathSeparator +
bJar.toString() + classPathSeparator +
cJar.toString(),
"-Djava.library.path=" + testLibraryPath,
"LoadLibraryDeadlock"));
outputAnalyzer.shouldHaveExitValue(0);
Asserts.assertTrue(
countLines(outputAnalyzer, "Java-level deadlock") == 0,
"Found a deadlock.");
// if no deadlock, make sure all components have been loaded
Asserts.assertTrue(
countLines(outputAnalyzer, "Class Class1 not found.") == 0,
"Unable to load class. Class1 not found.");
Asserts.assertTrue(
countLines(outputAnalyzer, "Class Class2 not found.") == 0,
"Unable to load class. Class2 not found.");
Asserts.assertTrue(
countLines(outputAnalyzer, "Native library loaded.") > 0,
"Unable to load native library.");
Asserts.assertTrue(
countLines(outputAnalyzer, "Class1 loaded from " + toLocationString(bJar)) > 0,
"Unable to load " + toLocationString(bJar));
Asserts.assertTrue(
countLines(outputAnalyzer, "Class2 loaded from " + toLocationString(cJar)) > 0,
"Unable to load signed " + toLocationString(cJar));
Asserts.assertTrue(
countLines(outputAnalyzer, "Signed jar loaded from native library.") > 0,
"Unable to load signed jar from native library.");
}
private static String toLocationString(Path path) {
// same format as returned by LoadLibraryDeadlock::getLocation
return path.toUri().getPath();
}
}

50
test/jdk/java/lang/ClassLoader/loadLibraryDeadlock/libloadLibraryDeadlock.c Normal file
View file

@ -0,0 +1,50 @@
/*
* Copyright (c) 2021, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2021, BELLSOFT. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
#include <stdio.h>
#include "jni.h"
/*
* Native library that loads an arbitrary class from a (signed) jar.
* This triggers the search in jars, and the lock in ZipFile is acquired
* as a result.
*/
JNIEXPORT jint JNICALL
JNI_OnLoad(JavaVM *vm, void *reserved)
{
JNIEnv *env;
jclass cl;
printf("Native library loaded.\n");
fflush(stdout);
if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) {
return JNI_EVERSION; /* JNI version not supported */
}
// find any class which triggers the search in jars
cl = (*env)->FindClass(env, "p/Class2");
return JNI_VERSION_1_2;
}

31
test/jdk/java/lang/ClassLoader/loadLibraryDeadlock/p/Class2.java Normal file
View file

@ -0,0 +1,31 @@
/*
* Copyright (c) 2021, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2021, BELLSOFT. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* Class2 is loaded from Thread #2 that checks jar signature and from
* Thread #1 that loads a native library.
*/
package p;
class Class2 {}