undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.

test/jdk/java/rmi/MarshalledObject/MOFilterTest.java

@@ -0,0 +1,140 @@
+/*
+ * Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InvalidClassException;
+import java.io.ObjectInput;
+import java.io.ObjectInputStream;
+import java.io.ObjectInputFilter;
+import java.io.ObjectOutputStream;
+import java.io.Serializable;
+import java.rmi.MarshalledObject;
+import java.util.Objects;
+
+
+import org.testng.Assert;
+import org.testng.annotations.Test;
+import org.testng.annotations.DataProvider;
+
+/* @test
+ * @run testng/othervm  MOFilterTest
+ *
+ * @summary Test MarshalledObject applies ObjectInputFilter
+ */
+@Test
+public class MOFilterTest {
+
+    /**
+     * Two cases are tested.
+     * The filter = null and a filter set to verify the calls to the filter.
+     * @return array objects with test parameters for each test case
+     */
+    @DataProvider(name = "FilterCases")
+    public static Object[][] filterCases() {
+        return new Object[][] {
+                {true},     // run the test with the filter
+                {false},    // run the test without the filter
+
+        };
+    }
+
+    /**
+     * Test that MarshalledObject inherits the ObjectInputFilter from
+     * the stream it was deserialized from.
+     */
+    @Test(dataProvider="FilterCases")
+    static void delegatesToMO(boolean withFilter) {
+        try {
+            Serializable testobj = Integer.valueOf(5);
+            MarshalledObject<Serializable> mo = new MarshalledObject<>(testobj);
+            Assert.assertEquals(mo.get(), testobj, "MarshalledObject.get returned a non-equals test object");
+
+            byte[] bytes = writeObjects(mo);
+
+            try (ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
+                 ObjectInputStream ois = new ObjectInputStream(bais)) {
+
+                CountingFilter filter1 = new CountingFilter();
+                ois.setObjectInputFilter(withFilter ? filter1 : null);
+                MarshalledObject<?> actualMO = (MarshalledObject<?>)ois.readObject();
+                int count = filter1.getCount();
+
+                actualMO.get();
+                int expectedCount = withFilter ? count + 2 : count;
+                int actualCount = filter1.getCount();
+                Assert.assertEquals(actualCount, expectedCount, "filter called wrong number of times during get()");
+            }
+        } catch (IOException ioe) {
+            Assert.fail("Unexpected IOException", ioe);
+        } catch (ClassNotFoundException cnf) {
+            Assert.fail("Deserializing", cnf);
+        }
+    }
+
+    /**
+     * Write objects and return a byte array with the bytes.
+     *
+     * @param objects zero or more objects to serialize
+     * @return the byte array of the serialized objects
+     * @throws IOException if an exception occurs
+     */
+    static byte[] writeObjects(Object... objects)  throws IOException {
+        byte[] bytes;
+        try (ByteArrayOutputStream baos = new ByteArrayOutputStream();
+             ObjectOutputStream oos = new ObjectOutputStream(baos)) {
+            for (Object o : objects) {
+                oos.writeObject(o);
+            }
+            bytes = baos.toByteArray();
+        }
+        return bytes;
+    }
+
+
+    static class CountingFilter implements ObjectInputFilter {
+
+        private int count;      // count of calls to the filter
+
+        CountingFilter() {
+            count = 0;
+        }
+
+        int getCount() {
+            return count;
+        }
+
+        /**
+         * Filter that rejects class Integer and allows others
+         *
+         * @param filterInfo access to the class, arrayLength, etc.
+         * @return {@code STATUS.REJECTED}
+         */
+        public ObjectInputFilter.Status checkInput(FilterInfo filterInfo) {
+            count++;
+            return ObjectInputFilter.Status.ALLOWED;
+        }
+    }
+
+}

test/jdk/java/rmi/MarshalledObject/compare/Compare.java

@@ -0,0 +1,108 @@
+/*
+ * Copyright (c) 1998, 2012, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 4096312
+ * @summary Codebase annotations on classes that are marshalled should not
+ *          affect the behavior of MarshalledObject.equals.  Only the bytes
+ *          not involved in location should be compared.
+ * @author Ken Arnold
+ *
+ * @run main/othervm Compare 11 annotatedRef
+ */
+
+import java.rmi.MarshalledObject;
+import java.io.*;
+
+public class Compare {
+    static class Node implements Serializable {
+        int value = nextValue++;
+        Node next;
+
+        static int nextValue = 1;
+    };
+
+    private static MarshalledObject made;
+    private static MarshalledObject read;
+
+    public static void main(String[] args) throws Throwable {
+        if (args.length == 1)
+            writeObjToOut(Integer.parseInt(args[0]));
+        else
+            compareObjToFile(args[0], args[1]);
+    }
+
+    static void writeObjToOut(int listLength) throws Throwable {
+        ObjectOutputStream out = new ObjectOutputStream(System.out);
+        out.writeObject(marshalledList(listLength));
+        out.close();
+    }
+
+    public static void compareHashCodes(String[] args) throws Throwable {
+        File f = new File(System.getProperty("test.src", "."), args[1]);
+        setupObjects(args[0], f);
+        if (made.hashCode() != read.hashCode()) {
+            throw new RuntimeException(
+                "made.hashCode(){" + made.hashCode() + "} != " +
+                "read.hashCode(){" + read.hashCode() + "}"
+            );
+        }
+    }
+
+    static void compareObjToFile(String lengthStr, String file0) throws Throwable
+    {
+        File f = new File(System.getProperty("test.src", "."), file0);
+        setupObjects(lengthStr, f);
+        if (!made.equals(read) || !read.equals(made)) {
+            throw new RuntimeException(
+                     "made.equals(read) = " + made.equals(read)
+                + ", read.equals(made) = " + read.equals(made)
+            );
+        }
+    }
+
+    static MarshalledObject setupObjects(String lengthStr, File file)
+        throws Throwable
+    {
+        int listLength = Integer.parseInt(lengthStr);
+        made = marshalledList(listLength);
+        ObjectInputStream in = new ObjectInputStream(new FileInputStream(file));
+        read = (MarshalledObject) in.readObject();
+        in.close();
+        return read;
+    }
+
+    static MarshalledObject marshalledList(int length) throws Throwable {
+        Node head = null;
+        Node cur = null;
+        for (int i = 0; i < length; i++) {
+            if (head == null)
+                cur = head = new Node();
+            else
+                cur = cur.next = new Node();
+        }
+        System.err.println("head = " + head);
+        return new MarshalledObject(head);
+    }
+}

test/jdk/java/rmi/MarshalledObject/compare/HashCode.java

@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 1998, 2012, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 4105900
+ * @summary MarshalledObject with null throws NullPointerException
+ * @author Ken Arnold
+ *
+ * @run main/othervm HashCode 11 annotatedRef
+ */
+
+import java.rmi.MarshalledObject;
+
+public class HashCode {
+    public static void main(String[] args) throws Throwable {
+        Compare.compareHashCodes(args);
+    }
+}

test/jdk/java/rmi/MarshalledObject/compare/NullReference.java

@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 1998, 2012, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 4105900
+ * @summary MarshalledObject with null throws NullPointerException.
+ *          This test does not affect VM global state, so othervm
+ *          is not required.
+ * @author Ken Arnold
+ *
+ * @run main NullReference
+ */
+
+import java.rmi.MarshalledObject;
+
+public class NullReference {
+    public static void main(String[] args) throws Throwable {
+        new MarshalledObject(null);
+    }
+}

test/jdk/java/rmi/MarshalledObject/compare/makeAnnotatedRef

@@ -0,0 +1,2 @@
+#!/bin/sh
+java -Djava.rmi.server.codebase=http://jini.east Compare 11 > annotatedRef