undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions

View file

@ -0,0 +1,216 @@
/*
* Copyright (c) 2009, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4167874
* @modules java.logging
* jdk.httpserver
* jdk.compiler
* @library ../../../../com/sun/net/httpserver
* /test/lib
* @build jdk.test.lib.compiler.CompilerUtils
* jdk.test.lib.util.FileUtils
* jdk.test.lib.util.JarUtils
* jdk.test.lib.Platform
* FileServerHandler
* @run main/othervm CloseTest
* @summary URL-downloaded jar files can consume all available file descriptors
*/
import java.io.File;
import java.io.IOException;
import java.lang.reflect.Method;
import java.net.URLClassLoader;
import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.net.URL;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import jdk.test.lib.compiler.CompilerUtils;
import jdk.test.lib.net.URIBuilder;
import jdk.test.lib.util.JarUtils;
import com.sun.net.httpserver.HttpContext;
import com.sun.net.httpserver.HttpServer;
import static java.nio.file.StandardCopyOption.REPLACE_EXISTING;
public class CloseTest extends Common {
private static final String WORK_DIR = System.getProperty("user.dir")
+ "/";
//
// needs two jar files test1.jar and test2.jar with following structure
//
// com/foo/TestClass
// com/foo/TestClass1
// com/foo/Resource1
// com/foo/Resource2
//
// and a directory hierarchy with the same structure/contents
public static void main(String args[]) throws Exception {
setup();
startHttpServer(WORK_DIR + "serverRoot/");
String testjar = WORK_DIR + "test.jar";
copyFile(WORK_DIR + "test1.jar", testjar);
test(testjar, 1);
// repeat test with different implementation
// of test.jar (whose TestClass.getValue() returns 2
copyFile(WORK_DIR + "test2.jar", testjar);
test(testjar, 2);
// repeat test using a directory of files
String testdir = WORK_DIR + "testdir/";
rm_minus_rf(new File(testdir));
copyDir(WORK_DIR + "test1/", testdir);
test(testdir, 1);
testdir = WORK_DIR + "testdir/";
rm_minus_rf(new File(testdir));
copyDir(WORK_DIR + "test2/", testdir);
test(testdir, 2);
getHttpServer().stop(3);
}
// create a loader on jarfile (or directory), plus a http loader
// load a class , then look for a resource
// also load a class from http loader
// then close the loader
// check further new classes/resources cannot be loaded
// check jar (or dir) can be deleted
// check existing classes can be loaded
// check boot classes can be loaded
static void test(String name, int expectedValue) throws Exception {
URL url = new URL("file", null, name);
URL url2 = getServerURL();
System.out.println("Doing tests with URL: " + url + " and " + url2);
URL[] urls = new URL[2];
urls[0] = url;
urls[1] = url2;
URLClassLoader loader = new URLClassLoader(urls);
Class testclass = loadClass("com.foo.TestClass", loader, true);
Class class2 = loadClass("Test", loader, true); // from http
class2.newInstance();
Object test = testclass.newInstance();
Method method = testclass.getDeclaredMethods()[0]; // int getValue();
int res = (Integer) method.invoke(test);
if (res != expectedValue) {
throw new RuntimeException("wrong value from getValue() [" + res +
"/" + expectedValue + "]");
}
// should find /resource1
URL u1 = loader.findResource("com/foo/Resource1");
if (u1 == null) {
throw new RuntimeException("can't find com/foo/Resource1 in test1.jar");
}
loader.close();
// should NOT find /resource2 even though it is in jar
URL u2 = loader.findResource("com/foo/Resource2");
if (u2 != null) {
throw new RuntimeException("com/foo/Resource2 unexpected in test1.jar");
}
// load tests
loadClass("com.foo.TestClass1", loader, false);
loadClass("com.foo.TestClass", loader, true);
loadClass("java.util.ArrayList", loader, true);
// now check we can delete the path
rm_minus_rf(new File(name));
System.out.println(" ... OK");
}
static HttpServer httpServer;
static HttpServer getHttpServer() {
return httpServer;
}
static URL getServerURL() throws Exception {
int port = httpServer.getAddress().getPort();
return URIBuilder.newBuilder()
.scheme("http")
.loopback()
.port(port)
.path("/")
.toURL();
}
static void startHttpServer(String docroot) throws Exception {
httpServer = HttpServer.create(
new InetSocketAddress(InetAddress.getLoopbackAddress(), 0),
10);
HttpContext ctx = httpServer.createContext(
"/", new FileServerHandler(docroot)
);
httpServer.start();
}
/**
* Prepare jars files for the tests
*/
private static void setup () throws IOException {
String[] tests = new String[]{"test1", "test2"};
Path workDir = Paths.get(WORK_DIR);
Path testSrc = Paths.get(System.getProperty("test.src"));
for (String test : tests) {
Path testSrcDir = testSrc.resolve(test);
Path testTargetDir = workDir.resolve(test);
// Compile sources for corresponding test
CompilerUtils.compile(testSrcDir, testTargetDir);
// Copy all resources
Path packages = Paths.get("com", "foo");
Path copySrcDir = testSrcDir.resolve(packages);
Path copyTargetDir = testTargetDir.resolve(packages);
Files.createDirectories(copyTargetDir);
Path res1 = Paths.get("Resource1");
Path res2 = Paths.get("Resource2");
Files.copy(copySrcDir.resolve(res1), copyTargetDir.resolve(res1),
REPLACE_EXISTING);
Files.copy(copySrcDir.resolve(res2), copyTargetDir.resolve(res2),
REPLACE_EXISTING);
// Create jar
JarUtils.createJarFile(workDir.resolve(test + ".jar"), testTargetDir);
}
// Copy and compile server test class
Path serverRoot = Paths.get("serverRoot");
Path targetDir = workDir.resolve(serverRoot);
Path file = Paths.get("Test.java");
Files.createDirectories(targetDir);
Files.copy(testSrc.resolve(serverRoot).resolve(file),
targetDir.resolve(file), REPLACE_EXISTING);
CompilerUtils.compile(targetDir, targetDir);
}
}

View file

@ -0,0 +1,92 @@
/*
* Copyright (c) 2011, 2017, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.io.*;
import java.net.*;
import java.nio.file.Files;
import jdk.test.lib.util.FileUtils;
import static java.nio.file.StandardCopyOption.*;
public class Common {
static void copyFile (String src, String dst) {
copyFile (new File(src), new File(dst));
}
static void copyDir (String src, String dst) {
copyDir (new File(src), new File(dst));
}
static void copyFile (File src, File dst) {
try {
if (!src.isFile()) {
throw new RuntimeException ("File not found: " + src.toString());
}
Files.copy(src.toPath(), dst.toPath(), REPLACE_EXISTING);
} catch (IOException e) {
throw new RuntimeException (e);
}
}
static void rm_minus_rf (File path) throws IOException, InterruptedException {
if (!path.exists())
return;
FileUtils.deleteFileTreeWithRetry(path.toPath());
}
static void copyDir (File src, File dst) {
if (!src.isDirectory()) {
throw new RuntimeException ("Dir not found: " + src.toString());
}
if (dst.exists()) {
throw new RuntimeException ("Dir exists: " + dst.toString());
}
dst.mkdir();
String[] names = src.list();
File[] files = src.listFiles();
for (int i=0; i<files.length; i++) {
String f = names[i];
if (files[i].isDirectory()) {
copyDir (files[i], new File (dst, f));
} else {
copyFile (new File (src, f), new File (dst, f));
}
}
}
/* expect is true if you expect to find it, false if you expect not to */
static Class loadClass (String name, URLClassLoader loader, boolean expect){
try {
Class clazz = Class.forName (name, true, loader);
if (!expect) {
throw new RuntimeException ("loadClass: "+name+" unexpected");
}
return clazz;
} catch (ClassNotFoundException e) {
if (expect) {
throw new RuntimeException ("loadClass: " +name + " not found");
}
}
return null;
}
}

View file

@ -0,0 +1,141 @@
/*
* Copyright (c) 2011, 2017, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* @test
* @bug 6899919
* @library /test/lib
* @modules jdk.compiler
* @build jdk.test.lib.compiler.CompilerUtils
* jdk.test.lib.util.FileUtils
* jdk.test.lib.util.JarUtils
* jdk.test.lib.Platform
* @run main/othervm GetResourceAsStream
*/
import java.io.File;
import java.io.IOException;
import java.io.InputStream;
import java.net.URL;
import java.net.URLClassLoader;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.nio.file.StandardCopyOption;
import java.nio.file.StandardOpenOption;
import jdk.test.lib.compiler.CompilerUtils;
import jdk.test.lib.util.JarUtils;
public class GetResourceAsStream extends Common {
private static final String WORK_DIR = System.getProperty("user.dir");
/*
* We simply test various scenarios with class/resource files
* and make sure the files can be deleted after closing
* the loader. Therefore, the test will only really be verified
* on Windows. It will still run correctly on other platforms
*/
public static void main (String args[]) throws Exception {
setup();
/* the jar we copy for each test */
File srcfile = new File(WORK_DIR, "foo.jar");
/* the jar we use for the test */
File testfile = new File(WORK_DIR, "test.jar");
copyFile(srcfile, testfile);
test(testfile, false, false);
copyFile(srcfile, testfile);
test(testfile, true, false);
copyFile(srcfile, testfile);
test(testfile, true, true);
// repeat test using a directory of files
File testdir = new File(WORK_DIR, "testdir");
File srcdir = new File(WORK_DIR, "test3");
copyDir(srcdir, testdir);
test(testdir, true, false);
}
// create a loader on jarfile (or directory)
// load a class , then look for a resource
// then close the loader
// check further new classes/resources cannot be loaded
// check jar (or dir) can be deleted
static void test (File file, boolean loadclass, boolean readall)
throws Exception
{
URL[] urls = new URL[] {file.toURI().toURL()};
System.out.println ("Doing tests with URL: " + urls[0]);
URLClassLoader loader = new URLClassLoader (urls);
if (loadclass) {
Class testclass = loadClass ("com.foo.TestClass", loader, true);
}
InputStream s = loader.getResourceAsStream ("hello.txt");
s.read();
if (readall) {
while (s.read() != -1) ;
s.close();
}
loader.close ();
// should not find bye.txt now
InputStream s1 = loader.getResourceAsStream("bye.txt");
if (s1 != null) {
throw new RuntimeException ("closed loader returned resource");
}
// now check we can delete the path
rm_minus_rf (file);
System.out.println (" ... OK");
}
/**
* Prepare jars files for the tests
*/
private static void setup () throws IOException {
Path classes = Paths.get(WORK_DIR);
Path testSrc = Paths.get(System.getProperty("test.src"),
"test1", "com", "foo", "TestClass.java");
Path targetDir = classes.resolve("test3");
Path testTarget = targetDir.resolve("TestClass.java");
Files.createDirectories(targetDir);
Files.copy(testSrc, testTarget, StandardCopyOption.REPLACE_EXISTING);
// Compile sources for corresponding test
CompilerUtils.compile(targetDir, targetDir);
// Prepare txt files
Files.write(targetDir.resolve("hello.txt"), "Hello world".getBytes(),
StandardOpenOption.CREATE);
Files.write(targetDir.resolve("bye.txt"), "Bye world".getBytes(),
StandardOpenOption.CREATE);
// Create jar
JarUtils.createJarFile(classes.resolve("foo.jar"), targetDir);
}
}

View file

@ -0,0 +1,24 @@
test1 and test2 contain two different implementations of the same
classes. They are compiled and placed into two different target directories
and two jar files test1.jar and test2.jar.
The same class is in both jars/directories, but returns a different result
from the TestClass.getValue() method. The test does the following
1. copy test1.jar to a working directory and call it test.jar
2. load class and invoke method (checking result)
3. close the loader
4. delete test.jar (check delete succeeds)
5. copy test2.jar to same dir and repeat the test
6. The two tests are then repeated by copying the directories
test1 and test2.
The loader also includes a http:// URL in its search path and a http
server is used to serve the required class.
serverRoot is used as the root directory for the http server.

View file

@ -0,0 +1,28 @@
/*
* Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
public class Test {
public Test () {
System.out.println ("Test created");
}
}

View file

@ -0,0 +1 @@
Hello World

View file

@ -0,0 +1 @@
Hello World Again

View file

@ -0,0 +1,38 @@
/*
* Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package com.foo;
public class TestClass {
public int getValue () {
return 1;
}
}
/*
public class TestClass {
public int getValue () {
return 2;
}
}
*/

View file

@ -0,0 +1,26 @@
/*
* Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package com.foo;
public class TestClass1 {}

View file

@ -0,0 +1 @@
Hello World

View file

@ -0,0 +1 @@
Hello World Again

View file

@ -0,0 +1,38 @@
/*
* Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package com.foo;
/*
public class TestClass {
public int getValue () {
return 1;
}
}
*/
public class TestClass {
public int getValue () {
return 2;
}
}

View file

@ -0,0 +1,26 @@
/*
* Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package com.foo;
public class TestClass1 {}