undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions

View file

@ -0,0 +1,119 @@
/*
* Copyright (c) 1998, 2014, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
* @bug 4099660 4102938
* @summary Remote classes not extending RemoteObject should be able to
* implement hashCode() and equals() methods so that instances
* can be successfully compared to RemoteObject instances
* (specifically: stubs) that contain the instance's RemoteRef.
* @author Peter Jones
*
* @build NotExtending_Stub NotExtending_Skel
* @run main/othervm NotExtending
*/
import java.rmi.*;
import java.rmi.server.*;
public class NotExtending implements Remote {
/** remote stub for this server instance */
private Remote stub;
/** value of stub's hash code */
private int hashValue;
/** true if the hashValue field has been initialized */
private boolean hashValueInitialized = false;
// no declared constructor - rely on implicit no-arg contructor
public Remote export() throws RemoteException {
stub = UnicastRemoteObject.exportObject(this);
setHashValue(stub.hashCode());
return stub;
}
public void unexport() throws RemoteException {
UnicastRemoteObject.unexportObject(this, true);
}
private void setHashValue(int value) {
hashValue = value;
hashValueInitialized = true;
}
public int hashCode() {
/*
* Test fails if the hashCode() method is called (during export)
* before the correct hash value has been initialized.
*/
if (!hashValueInitialized) {
throw new AssertionError(
"hashCode() invoked before hashValue initialized");
}
return hashValue;
}
public boolean equals(Object obj) {
return stub.equals(obj);
}
public static void main(String[] args) throws Exception {
NotExtending server = null;
try {
/*
* Verify that hashCode() is not invoked before it is
* initialized. Tests bugid 4102938.
*/
server = new NotExtending();
Remote stub = server.export();
System.err.println("Server exported without invoking hashCode().");
/*
* Verify that passing stub to server's equals() method
* returns true.
*/
if (server.equals(stub)) {
System.err.println("server.equals(stub) returns true");
} else {
throw new AssertionError("server.equals(stub) returns false");
}
/*
* Verify that passing server to stub's equals() method
* returns true. Tests bugid 4099660.
*/
if (stub.equals(server)) {
System.err.println("stub.equals(server) returns true");
} else {
throw new AssertionError("stub.equals(server) returns false");
}
} finally {
if (server != null) {
server.unexport();
}
}
}
}

View file

@ -0,0 +1,56 @@
/*
* Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
// Skeleton class generated by rmic, do not edit.
// Contents subject to change without notice.
public final class NotExtending_Skel
implements java.rmi.server.Skeleton
{
private static java.rmi.server.Operation[] operations = {
};
private static final long interfaceHash = 3103311997983563335L;
public java.rmi.server.Operation[] getOperations() {
return operations;
}
public void dispatch(java.rmi.Remote obj, java.rmi.server.RemoteCall call, int opnum, long hash)
throws java.lang.Exception
{
if (opnum < 0) {
throw new java.rmi.UnmarshalException("invalid method hash");
} else {
if (hash != interfaceHash)
throw new java.rmi.server.SkeletonMismatchException("interface hash mismatch");
}
NotExtending server = (NotExtending) obj;
switch (opnum) {
default:
throw new java.rmi.UnmarshalException("invalid method number");
}
}
}

View file

@ -0,0 +1,65 @@
/*
* Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
// Stub class generated by rmic, do not edit.
// Contents subject to change without notice.
public final class NotExtending_Stub
extends java.rmi.server.RemoteStub
implements java.rmi.Remote
{
private static java.rmi.server.Operation[] operations = {
};
private static final long interfaceHash = 3103311997983563335L;
private static final long serialVersionUID = 2;
private static boolean useNewInvoke;
static {
try {
java.rmi.server.RemoteRef.class.getMethod("invoke",
new java.lang.Class[] {
java.rmi.Remote.class,
java.lang.reflect.Method.class,
java.lang.Object[].class,
long.class
});
useNewInvoke = true;
} catch (java.lang.NoSuchMethodException e) {
useNewInvoke = false;
}
}
// constructors
public NotExtending_Stub() {
super();
}
public NotExtending_Stub(java.rmi.server.RemoteRef ref) {
super(ref);
}
// methods from remote interfaces
}

View file

@ -0,0 +1,116 @@
/*
* Copyright (c) 2003, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
* @bug 4507539
* @summary support using dynamic proxies as RMI stubs
* @author Ann Wollrath
*
* @build ToStub ToStub_Stub
* @run main/othervm/timeout=240 ToStub
*/
import java.io.IOException;
import java.lang.reflect.Proxy;
import java.rmi.NoSuchObjectException;
import java.rmi.Remote;
import java.rmi.server.RemoteObjectInvocationHandler;
import java.rmi.server.RemoteStub;
import java.rmi.server.UnicastRemoteObject;
import java.rmi.server.RemoteObject;
public class ToStub implements RemoteInterface {
public Object passObject(Object obj) {
return obj;
}
public static void main(String[] args) throws Exception {
RemoteInterface server1 = null;
RemoteInterface server2 = null;
RemoteInterface stub = null;
RemoteInterface proxy = null;
try {
System.setProperty("java.rmi.server.ignoreStubClasses", "true");
System.err.println("export objects");
server1 = new ToStub();
server2 = new ToStub();
stub = (RemoteInterface) UnicastRemoteObject.exportObject(server1);
proxy = (RemoteInterface)
UnicastRemoteObject.exportObject(server2, 0);
System.err.println("test toStub");
if (stub != RemoteObject.toStub(server1)) {
throw new RuntimeException(
"toStub returned incorrect value for server1");
}
if (!Proxy.isProxyClass(proxy.getClass())) {
throw new RuntimeException("proxy is not a dynamic proxy");
}
if (proxy != RemoteObject.toStub(server2)) {
throw new RuntimeException(
"toStub returned incorrect value for server2");
}
try {
RemoteObject.toStub(new ToStub());
throw new RuntimeException(
"stub returned for exported object!");
} catch (NoSuchObjectException nsoe) {
}
System.err.println("invoke methods");
Object obj = stub.passObject(stub);
if (!stub.equals(obj)) {
throw new RuntimeException("returned stub not equal");
}
obj = proxy.passObject(proxy);
if (!proxy.equals(obj)) {
throw new RuntimeException("returned proxy not equal");
}
System.err.println("TEST PASSED");
} finally {
if (stub != null) {
UnicastRemoteObject.unexportObject(server1, true);
}
if (proxy != null) {
UnicastRemoteObject.unexportObject(server2, true);
}
}
}
}
interface RemoteInterface extends Remote {
Object passObject(Object obj) throws IOException;
}

View file

@ -0,0 +1,66 @@
/*
* Copyright (c) 2003, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
// Stub class generated by rmic, do not edit.
// Contents subject to change without notice.
public final class ToStub_Stub
extends java.rmi.server.RemoteStub
implements RemoteInterface
{
private static final long serialVersionUID = 2;
private static java.lang.reflect.Method $method_passObject_0;
static {
try {
$method_passObject_0 = RemoteInterface.class.getMethod("passObject", new java.lang.Class[] {java.lang.Object.class});
} catch (java.lang.NoSuchMethodException e) {
throw new java.lang.NoSuchMethodError(
"stub class initialization failed");
}
}
// constructors
public ToStub_Stub(java.rmi.server.RemoteRef ref) {
super(ref);
}
// methods from remote interfaces
// implementation of passObject(Object)
public java.lang.Object passObject(java.lang.Object $param_Object_1)
throws java.io.IOException
{
try {
Object $result = ref.invoke(this, $method_passObject_0, new java.lang.Object[] {$param_Object_1}, 3074202549763602823L);
return ((java.lang.Object) $result);
} catch (java.lang.RuntimeException e) {
throw e;
} catch (java.io.IOException e) {
throw e;
} catch (java.lang.Exception e) {
throw new java.rmi.UnexpectedException("undeclared checked exception", e);
}
}
}

View file

@ -0,0 +1,136 @@
/*
* Copyright (c) 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
* @bug 4460983
* @summary This test verifies that when a RemoteObject is being
* deserialized, if the "external ref type name" is a non-empty
* string that is not equal to one of the external ref type names
* required to be supported by the specification, then a
* ClassNotFoundException is thrown. Of particular note, with the
* specification change for 4460983, "ActivatableServerRef" is no
* longer a supported "external ref type name", and the names of
* other classes in the internal package sun.rmi.server should
* produce the same result.
* @author Peter Jones
*
* @run main/othervm UnrecognizedRefType
*/
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInput;
import java.io.ObjectInputStream;
import java.io.ObjectOutput;
import java.io.ObjectOutputStream;
import java.lang.reflect.Method;
import java.rmi.Remote;
import java.rmi.server.Operation;
import java.rmi.server.RemoteCall;
import java.rmi.server.RemoteObject;
import java.rmi.server.RemoteRef;
public class UnrecognizedRefType {
public static void main(String[] args) throws Exception {
System.err.println("\nRegression test for bug 4460983\n");
test(new FakeRemoteObject("ActivatableServerRef"));
test(new FakeRemoteObject("MarshalInputStream"));
test(new FakeRemoteObject("XXX"));
System.err.println("TEST PASSED");
}
private static void test(RemoteObject obj) throws Exception {
ByteArrayOutputStream bout = new ByteArrayOutputStream();
ObjectOutputStream out = new ObjectOutputStream(bout);
out.writeObject(obj);
ByteArrayInputStream bin =
new ByteArrayInputStream(bout.toByteArray());
ObjectInputStream in = new ObjectInputStream(bin);
try {
Object obj2 = in.readObject();
System.err.println(
"Object unexpectedly deserialized successfully: " + obj2);
throw new RuntimeException(
"TEST FAILED: object successfully deserialized");
} catch (ClassNotFoundException e) {
System.err.println("ClassNotFoundException as expected:");
e.printStackTrace();
} // other exceptions cause test failure
}
private static class FakeRemoteObject extends RemoteObject {
FakeRemoteObject(String refType) {
super(new FakeRemoteRef(refType));
}
}
private static class FakeRemoteRef implements RemoteRef {
private final String refType;
FakeRemoteRef(String refType) {
this.refType = refType;
}
public Object invoke(Remote obj,
Method method,
Object[] params,
long opnum)
{
throw new UnsupportedOperationException();
}
public RemoteCall newCall(RemoteObject obj,
Operation[] op,
int opnum,
long hash)
{
throw new UnsupportedOperationException();
}
public void invoke(RemoteCall call) {
throw new UnsupportedOperationException();
}
public void done(RemoteCall call) {
throw new UnsupportedOperationException();
}
public String getRefClass(java.io.ObjectOutput out) {
return refType;
}
public int remoteHashCode() { return hashCode(); }
public boolean remoteEquals(RemoteRef obj) { return equals(obj); }
public String remoteToString() { return toString(); }
public void readExternal(ObjectInput in) {
throw new UnsupportedOperationException();
}
public void writeExternal(ObjectOutput out) {
// no data to write
}
}
}

View file

@ -0,0 +1,234 @@
/*
* Copyright (c) 1999, 2012, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4251010
* @summary equals does not works on stub objects created with
* custom socket AndFactory
* @author Laird Dornin
*
* @library ../../../testlibrary
* @modules java.rmi/sun.rmi.registry
* java.rmi/sun.rmi.server
* java.rmi/sun.rmi.transport
* java.rmi/sun.rmi.transport.tcp
* @build TestLibrary
* @run main/othervm/timeout=40 VerifyRemoteEquals
*/
import java.io.*;
import java.net.*;
import java.rmi.*;
import java.rmi.server.*;
/**
* Test ensures that a stub that has never been serialized and one
* that has can be .equals(). Test also ensures that stubs with
* custom socket factories can be .equals() with equivalent stubs.
*/
public class VerifyRemoteEquals {
/**
* Remote interface.
*/
public interface Test extends Remote {
}
/**
* Implementation of Remote interface passing custom socket
* factories
*/
public static final class TestImpl
extends UnicastRemoteObject implements Test
{
public TestImpl() throws RemoteException {
super();
}
public TestImpl(RMIClientSocketFactory clientFactory,
RMIServerSocketFactory serverFactory)
throws RemoteException
{
super(0, clientFactory, serverFactory);
}
public TestImpl(RMISocketFactory factory)
throws RemoteException
{
super(0, factory, factory);
}
}
/**
* Remote interface for retrieving Test object.
*/
public interface TestHome extends Remote {
public Test get() throws RemoteException;
}
/**
* Implementation of interface TestHome.
*/
public static final class TestHomeImpl
extends UnicastRemoteObject implements TestHome
{
private Test test;
public TestHomeImpl(Test test)
throws RemoteException {
super();
this.test = test;
}
public Test get() {
return test;
}
}
/**
* Custom server socket factory.
*/
public static final class ServerSocketAndFactory
extends ServerSocket implements RMIServerSocketFactory, Serializable
{
ServerSocketAndFactory() throws IOException, java.net.UnknownHostException {
// I am forced to do something useless with the parent
// constructor
super(0);
}
ServerSocketAndFactory(int port) throws IOException,
java.net.UnknownHostException
{
super(port);
}
public ServerSocket createServerSocket(int port)
throws IOException
{
return new ServerSocketAndFactory(port);
}
public int hashCode() {
return getLocalPort();
}
public boolean equals(Object obj) {
if (obj instanceof ServerSocketAndFactory) {
ServerSocketAndFactory ssf = (ServerSocketAndFactory) obj;
if (getLocalPort() == ssf.getLocalPort()) {
return true;
}
}
return false;
}
}
/**
* Custom socket factory.
*/
public static final class ClientSocketAndFactory
extends Socket implements RMIClientSocketFactory, Serializable
{
ClientSocketAndFactory() {
}
ClientSocketAndFactory(String host, int port) throws IOException {
super(host, port);
}
public Socket createSocket(String host, int port)
throws IOException {
return new ClientSocketAndFactory(host, port);
}
public int hashCode() {
return getPort();
}
public boolean equals(Object obj) {
if (obj instanceof ClientSocketAndFactory) {
ClientSocketAndFactory csf = (ClientSocketAndFactory) obj;
if (getPort() == csf.getPort()) {
return true;
}
}
return false;
}
}
public static void main(String[] args) {
try {
System.out.println("\n\nRegression test for, 4251010\n\n");
Test test = new TestImpl(new ClientSocketAndFactory(),
new ServerSocketAndFactory());
TestHome home = new TestHomeImpl(test);
Test test0 = ((Test) RemoteObject.toStub(test));
Test test1 = ((TestHome) RemoteObject.toStub(home)).get();
Test test2 = ((TestHome) RemoteObject.toStub(home)).get();
Test test3 = ((Test) (new MarshalledObject(test)).get());
if (test0.equals(test1)) {
System.out.println("test0, test1, stubs equal");
} else {
TestLibrary.bomb("test0, test1, stubs not equal");
}
if (test1.equals(test2)) {
System.out.println("test1, test2, stubs equal");
} else {
TestLibrary.bomb("test1, test2, stubs not equal");
}
// explicitly compare an unmarshalled object with toStub
// return
if (test2.equals(test3)) {
System.out.println("test2, test3, stubs equal");
} else {
TestLibrary.bomb("test2, test3, stubs not equal");
}
test0 = null;
test1 = null;
test2 = null;
test3 = null;
TestLibrary.unexport(test);
TestLibrary.unexport(home);
System.err.println("test passed: stubs were equal");
} catch (Exception e) {
TestLibrary.bomb("test got unexpected exception", e);
}
}
}