undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions

View file

@ -0,0 +1,85 @@
/*
* Copyright (c) 1999, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4251878
* @summary change in default URL port causes regression in java.rmi.Naming
* @author Dana Burns
* @library ../testlibrary
* @modules java.rmi/sun.rmi.registry
* java.rmi/sun.rmi.server
* java.rmi/sun.rmi.transport
* java.rmi/sun.rmi.transport.tcp
* @build TestLibrary
* @run main/othervm DefaultRegistryPort
* @key intermittent
*/
/*
* Ensure that the default registry port for java.rmi.Naming URLs
* is 1099. Test creates a registry on port 1099 and then does a
* lookup with a Naming URL that uses the default port.
*/
import java.rmi.Naming;
import java.rmi.Remote;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
public class DefaultRegistryPort {
public static void main(String args[]) throws Exception {
Registry registry = null;
System.err.println("Starting registry on default port REGISTRY_PORT="
+ Registry.REGISTRY_PORT);
final int NUM = 10;
for (int loop = 0; loop < NUM; loop++) {
System.err.println("in loop: " + loop);
try {
registry = LocateRegistry.createRegistry(Registry.REGISTRY_PORT);
System.err.println("Created registry=" + registry);
break;
} catch(java.rmi.RemoteException e) {
String err = e.getMessage();
if (err.contains("Address already in use")
|| err.contains("Port already in use")) {
try {
Thread.sleep((long)(TestLibrary.getTimeoutFactor() * 100));
} catch (InterruptedException ignore) { }
continue;
}
TestLibrary.bomb(e);
}
}
if (registry == null) {
throw new RuntimeException("can not create registry at "
+ Registry.REGISTRY_PORT + " after trying " + NUM + "times");
}
registry.rebind("myself", registry);
Remote myself = Naming.lookup("rmi://localhost/myself");
System.err.println("Test PASSED");
}
}

View file

@ -0,0 +1,87 @@
/*
* Copyright (c) 2001, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
* @summary Ensure that java.rmi.Naming.lookup can handle URLs containing
* IPv6 addresses.
* @bug 4402708
* @library ../testlibrary
* @modules java.rmi/sun.rmi.registry
* java.rmi/sun.rmi.server
* java.rmi/sun.rmi.transport
* java.rmi/sun.rmi.transport.tcp
* @build RegistryVM
* @run main/othervm -Djava.net.preferIPv6Addresses=true LookupIPv6
*/
import java.io.Serializable;
import java.net.InetAddress;
import java.net.Inet6Address;
import java.net.MalformedURLException;
import java.rmi.Naming;
import java.rmi.Remote;
public class LookupIPv6 {
public static void main(String[] args) throws Exception {
// use loopback IPv6 address to avoid lengthy socket connection delays
String[] urls = {
"rmi://[0000:0000:0000:0000:0000:0000:0000:0001]/foo",
"//[0:0:0:0:0:0:0:1]:88/foo",
"rmi://[0::0:0:0:1]/foo:bar",
"//[::1]:88"
};
for (int i = 0; i < urls.length; i++) {
try {
Naming.lookup(urls[i]);
} catch (MalformedURLException ex) {
throw ex;
} catch (Exception ex) {
// URLs are bogus, lookups expected to fail
}
}
/* Attempt to use IPv6-based URL to look up object in local registry.
* Since not all platforms support IPv6, this portion of the test may
* be a no-op in some cases. On supporting platforms, the first
* element of the array returned by InetAddress.getAllByName should be
* an Inet6Address since this test is run with
* -Djava.net.preferIPv6Addresses=true.
*/
InetAddress localAddr = InetAddress.getAllByName(null)[0];
if (localAddr instanceof Inet6Address) {
System.out.println("IPv6 detected");
RegistryVM rvm = RegistryVM.createRegistryVM();
try {
rvm.start();
String name = String.format("rmi://[%s]:%d/foo",
localAddr.getHostAddress(), rvm.getPort());
Naming.rebind(name, new R());
Naming.lookup(name);
} finally {
rvm.cleanup();
}
}
}
private static class R implements Remote, Serializable { }
}

View file

@ -0,0 +1,56 @@
/*
* Copyright (c) 2001, 2016, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
* @bug 4387038
* @summary Ensure that java.rmi.Naming.lookup functions properly for names
* containing embedded ':' characters.
*
* @library ../testlibrary
* @modules java.rmi/sun.rmi.registry
* java.rmi/sun.rmi.server
* java.rmi/sun.rmi.transport
* java.rmi/sun.rmi.transport.tcp
* @build TestLibrary
* @run main/othervm LookupNameWithColon
*/
import java.rmi.Naming;
import java.rmi.registry.Registry;
public class LookupNameWithColon {
public static void main(String[] args) throws Exception {
String[] names = {
"fairly:simple", "somewhat:more/complicated",
"multiple:colons:in:name"
};
Registry reg = TestLibrary.createRegistryOnEphemeralPort();
int port = TestLibrary.getRegistryPort(reg);
for (int i = 0; i < names.length; i++) {
reg.rebind(names[i], reg);
Naming.lookup("rmi://localhost:" + port + "/" + names[i]);
}
}
}

View file

@ -0,0 +1,67 @@
/*
* Copyright (c) 2002, 2016, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
* @bug 4626311
* @summary Protocol "rmi:" is used in contrary to spec. The Naming.list
* method should not append an "rmi:" scheme prefix to the URLs in the
* array of Strings it returns.
* @author Ann Wollrath
*
* @library ../testlibrary
* @modules java.rmi/sun.rmi.registry
* java.rmi/sun.rmi.server
* java.rmi/sun.rmi.transport
* java.rmi/sun.rmi.transport.tcp
* @build TestLibrary
* @run main/othervm RmiIsNoScheme
*/
import java.io.*;
import java.rmi.*;
import java.rmi.registry.*;
public class RmiIsNoScheme implements Remote, Serializable {
private RmiIsNoScheme() {}
public static void main(String[] args) {
System.err.println("\nRegression test for bug 4626311\n");
try {
Registry registry = TestLibrary.createRegistryOnEphemeralPort();
int registryPort = TestLibrary.getRegistryPort(registry);
Naming.rebind("//:" + registryPort + "/RmiIsNoScheme",
new RmiIsNoScheme());
String name = Naming.list("//:" + registryPort)[0];
System.err.println("name = " + name);
if (name.startsWith("rmi:", 0) == false) {
System.err.println("TEST PASSED: rmi scheme not present");
} else {
throw new RuntimeException("TEST FAILED: rmi scheme present!");
}
} catch (Exception e) {
TestLibrary.bomb(e);
}
}
}

View file

@ -0,0 +1,118 @@
/*
* Copyright (c) 2005, 2016, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 5083594
* @summary Ensure that Naming.java correctly parses host names with '_' in
* them.
* @author Vinod Johnson
*
* @library ../testlibrary
* @modules java.rmi/sun.rmi.registry
* java.rmi/sun.rmi.server
* java.rmi/sun.rmi.transport
* java.rmi/sun.rmi.transport.tcp
* @build TestLibrary UnderscoreHost_Stub
* @run main/othervm UnderscoreHost
*/
import java.io.IOException;
import java.net.MalformedURLException;
import java.net.ServerSocket;
import java.net.Socket;
import java.rmi.Naming;
import java.rmi.Remote;
import java.rmi.RemoteException;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
import java.rmi.server.RMISocketFactory;
import java.rmi.server.UnicastRemoteObject;
public class UnderscoreHost extends UnicastRemoteObject implements Remote {
private static final String HOSTNAME = "foo_bar";
private static final String NAME = "name";
/*
* The socket factory captures the host name of the parsed URL, and
* then connects to the local host.
*/
private static class HostVerifyingSocketFactory extends RMISocketFactory {
String host;
public synchronized Socket createSocket(String host, int port)
throws IOException {
if (this.host == null) {
// Only set it the first time, subsequent DGC dirty calls
// will be local host
this.host = host;
}
return new Socket("localhost", port);
}
public ServerSocket createServerSocket(int port) throws IOException {
return new ServerSocket(port);
}
}
public UnderscoreHost() throws RemoteException {};
public static void main(String args[]) {
UnderscoreHost t = null;
try {
HostVerifyingSocketFactory hvf = new HostVerifyingSocketFactory();
RMISocketFactory.setSocketFactory(hvf);
Registry r = TestLibrary.createRegistryOnEphemeralPort();
int port = TestLibrary.getRegistryPort(r);
t = new UnderscoreHost();
r.rebind(NAME, t);
Naming.lookup("rmi://" + HOSTNAME +
":" + port + "/" + NAME);
/*
* This test is coded to pass whether java.net.URI obeys
* RFC 2396 or RFC 3986 (see 5085902, 6394131, etc.).
*
* If java.net.URI obeys RFC 3986, so host names may
* contain underscores, then the Naming.lookup invocation
* should succeed-- but the host actually connected to
* must equal HOSTNAME.
*/
if (!hvf.host.equals(HOSTNAME)) {
throw new RuntimeException(
"java.rmi.Naming Parsing error:" +
hvf.host + ":" + HOSTNAME);
}
} catch (MalformedURLException e) {
/*
* If java.net.URI obeys RFC 2396, so host names must not
* contain underscores, then the Naming.lookup invocation
* should throw MalformedURLException-- so this is OK.
*/
} catch (IOException ioe) {
TestLibrary.bomb(ioe);
} catch (java.rmi.NotBoundException nbe) {
TestLibrary.bomb(nbe);
} finally {
TestLibrary.unexport(t);
}
}
}

View file

@ -0,0 +1,38 @@
/*
* Copyright (c) 2005, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
// Stub class generated by rmic, do not edit.
// Contents subject to change without notice.
public final class UnderscoreHost_Stub
extends java.rmi.server.RemoteStub
implements java.rmi.Remote
{
private static final long serialVersionUID = 2;
// constructors
public UnderscoreHost_Stub(java.rmi.server.RemoteRef ref) {
super(ref);
}
}

View file

@ -0,0 +1,28 @@
/*
* Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
*
*/
import java.rmi.Remote;
public interface Legal extends Remote {};

View file

@ -0,0 +1,167 @@
/*
* Copyright (c) 1999, 2016, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4254808
* @summary Naming assumes '/' is present in relative URL; change in URL causes regression
* @author Dana Burns
* @library ../../testlibrary
* @modules java.rmi/sun.rmi.registry
* java.rmi/sun.rmi.server
* java.rmi/sun.rmi.transport
* java.rmi/sun.rmi.transport.tcp
* @build TestLibrary Legal LegalRegistryNames_Stub
* @run main/othervm LegalRegistryNames
* @key intermittent
*/
import java.net.InetAddress;
import java.net.UnknownHostException;
import java.rmi.Naming;
import java.rmi.RemoteException;
import java.rmi.Remote;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
import java.rmi.server.UnicastRemoteObject;
import java.util.Enumeration;
import java.util.Vector;
/**
* Ensure that all legal forms of Naming URLs operate with the
* java.rmi.Naming interface. This test requires using the default RMI Registry
* port as it tests all of the RMI naming URL's, including the ones which do not
* take a port (and therefore uses the default port).
*/
public class LegalRegistryNames extends UnicastRemoteObject
implements Legal
{
public LegalRegistryNames() throws java.rmi.RemoteException {}
public static void main(String args[]) throws RuntimeException {
System.err.println("\nRegression test for bug/rfe 4254808\n");
Registry registry = null;
LegalRegistryNames legal = null;
boolean oneFormFailed = false;
String[] names = null;
Vector legalForms = getLegalForms();
Remote shouldFind = null;
// create a registry and the test object
try {
legal = new LegalRegistryNames();
System.err.println("Starting registry on default port");
registry = LocateRegistry.createRegistry(Registry.REGISTRY_PORT);
} catch (Exception e) {
TestLibrary.bomb("registry already running on test port");
}
// enumerate through all legal URLs to verify that a remote
// object can be bound and unbound
String s = null;
Enumeration en = legalForms.elements();
while (en.hasMoreElements()) {
s = (String) en.nextElement();
System.err.println("\ntesting form: " + s);
try {
Naming.rebind(s, legal);
names = registry.list();
// ensure that the name in the registry is what is expected
if ((names.length > 0) &&
(names[0].compareTo("MyName") != 0))
{
oneFormFailed = true;
System.err.println("\tRegistry entry for form: " +
s + " is incorrect: " + names[0]);
}
// ensure that the object can be unbound under the URL string
shouldFind = Naming.lookup(s);
Naming.unbind(s);
System.err.println("\tform " + s + " OK");
} catch (Exception e) {
e.printStackTrace();
oneFormFailed = true;
System.err.println("\tunexpected lookup or unbind " +
"exception for form: " + s + e.getMessage() );
}
}
if (oneFormFailed) {
TestLibrary.bomb("Test failed");
}
// get the test to exit quickly
TestLibrary.unexport(legal);
}
/**
* return a vector of valid legal RMI naming URLs.
*/
private static Vector getLegalForms() {
String localHostAddress = null;
String localHostName = null;
// get the local host name and address
try {
localHostName = InetAddress.getLocalHost().getHostName();
localHostAddress = InetAddress.getLocalHost().getHostAddress();
} catch(UnknownHostException e) {
TestLibrary.bomb("Test failed: unexpected exception", e);
}
Vector legalForms = new Vector();
legalForms.add("///MyName");
legalForms.add("//:" + Registry.REGISTRY_PORT + "/MyName");
legalForms.add("//" + localHostAddress + "/MyName");
legalForms.add("//" + localHostAddress + ":" +
Registry.REGISTRY_PORT + "/MyName");
legalForms.add("//localhost/MyName");
legalForms.add("//localhost:" + Registry.REGISTRY_PORT + "/MyName");
legalForms.add("//" + localHostName + "/MyName");
legalForms.add("//" + localHostName + ":" + Registry.REGISTRY_PORT +
"/MyName");
legalForms.add("MyName");
legalForms.add("/MyName");
legalForms.add("rmi:///MyName");
legalForms.add("rmi://:" + Registry.REGISTRY_PORT + "/MyName");
legalForms.add("rmi://" + localHostAddress + "/MyName");
legalForms.add("rmi://" + localHostAddress + ":" +
Registry.REGISTRY_PORT + "/MyName");
legalForms.add("rmi://localhost/MyName");
legalForms.add("rmi://localhost:" + Registry.REGISTRY_PORT + "/MyName");
legalForms.add("rmi://" + localHostName + "/MyName");
legalForms.add("rmi://" + localHostName + ":" +
Registry.REGISTRY_PORT + "/MyName");
return legalForms;
}
}

View file

@ -0,0 +1,38 @@
/*
* Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
// Stub class generated by rmic, do not edit.
// Contents subject to change without notice.
public final class LegalRegistryNames_Stub
extends java.rmi.server.RemoteStub
implements java.rmi.Remote
{
private static final long serialVersionUID = 2;
// constructors
public LegalRegistryNames_Stub(java.rmi.server.RemoteRef ref) {
super(ref);
}
}