undefect. CWE-407 — 63 sites patched across 27 ecosystems
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
This commit is contained in:
commit
0a580b313d
70422 changed files with 17213626 additions and 0 deletions
|
|
@ -0,0 +1,109 @@
|
|||
/*
|
||||
* Copyright (c) 2018, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/*
|
||||
* @test
|
||||
* @bug 8177552
|
||||
* @modules jdk.localedata
|
||||
* @summary Checks deserialization of compact number format
|
||||
* @library /java/text/testlib
|
||||
* @build TestDeserializeCNF HexDumpReader
|
||||
* @run junit/othervm TestDeserializeCNF
|
||||
*/
|
||||
|
||||
import org.junit.jupiter.api.BeforeAll;
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.junit.jupiter.api.TestInstance;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.io.InputStream;
|
||||
import java.io.ObjectInputStream;
|
||||
import java.math.RoundingMode;
|
||||
import java.text.CompactNumberFormat;
|
||||
import java.text.DecimalFormatSymbols;
|
||||
import java.util.Locale;
|
||||
|
||||
import static org.junit.jupiter.api.Assertions.assertEquals;
|
||||
|
||||
@TestInstance(TestInstance.Lifecycle.PER_CLASS)
|
||||
public class TestDeserializeCNF {
|
||||
|
||||
// This object is serialized in cnf1.ser.txt with HALF_UP
|
||||
// rounding mode, groupingsize = 3 and parseBigDecimal = true
|
||||
private static final CompactNumberFormat COMPACT_FORMAT1 = new CompactNumberFormat("#,##0.###",
|
||||
DecimalFormatSymbols.getInstance(Locale.US),
|
||||
new String[]{"", "", "", "0K", "00K", "000K", "0M", "00M", "000M", "0B", "00B", "000B", "0T", "00T", "000T"});
|
||||
|
||||
// This object is serialized in cnf2.ser.txt with min integer digits = 20
|
||||
// and min fraction digits = 5
|
||||
private static final CompactNumberFormat COMPACT_FORMAT2 = new CompactNumberFormat("#,##0.###",
|
||||
DecimalFormatSymbols.getInstance(Locale.JAPAN),
|
||||
new String[]{"", "", "", "0", "0\u4e07", "00\u4e07", "000\u4e07", "0000\u4e07", "0\u5104", "00\u5104", "000\u5104", "0000\u5104", "0\u5146", "00\u5146", "000\u5146"});
|
||||
|
||||
private static final String FILE_COMPACT_FORMAT1 = "cnf1.ser.txt";
|
||||
private static final String FILE_COMPACT_FORMAT2 = "cnf2.ser.txt";
|
||||
|
||||
@BeforeAll
|
||||
void mutateInstances() {
|
||||
COMPACT_FORMAT1.setRoundingMode(RoundingMode.HALF_UP);
|
||||
COMPACT_FORMAT1.setGroupingSize(3);
|
||||
COMPACT_FORMAT1.setParseBigDecimal(true);
|
||||
|
||||
COMPACT_FORMAT2.setMinimumIntegerDigits(20);
|
||||
COMPACT_FORMAT2.setMinimumFractionDigits(5);
|
||||
}
|
||||
|
||||
@Test
|
||||
void testDeserialization() throws IOException, ClassNotFoundException {
|
||||
try (InputStream istream1 = HexDumpReader.getStreamFromHexDump(FILE_COMPACT_FORMAT1);
|
||||
ObjectInputStream ois1 = new ObjectInputStream(istream1);
|
||||
InputStream istream2 = HexDumpReader.getStreamFromHexDump(FILE_COMPACT_FORMAT2);
|
||||
ObjectInputStream ois2 = new ObjectInputStream(istream2);) {
|
||||
|
||||
CompactNumberFormat obj1 = (CompactNumberFormat) ois1.readObject();
|
||||
assertEquals(COMPACT_FORMAT1, obj1, "Deserialized instance is not"
|
||||
+ " equal to the instance serialized in " + FILE_COMPACT_FORMAT1);
|
||||
|
||||
CompactNumberFormat obj2 = (CompactNumberFormat) ois2.readObject();
|
||||
assertEquals(COMPACT_FORMAT2, obj2, "Deserialized instance is not"
|
||||
+ " equal to the instance serialized in " + FILE_COMPACT_FORMAT2);
|
||||
}
|
||||
}
|
||||
|
||||
// The objects are serialized using the serialize() method, the hex
|
||||
// dump printed is copied to respective object files
|
||||
// void serialize(CompactNumberFormat cnf) {
|
||||
// ByteArrayOutputStream baos = new ByteArrayOutputStream();
|
||||
// try (ObjectOutputStream oos = new ObjectOutputStream(baos)) {
|
||||
// oos.writeObject(cnf);
|
||||
// } catch (IOException ioe) {
|
||||
// throw new RuntimeException(ioe);
|
||||
// }
|
||||
// byte[] ser = baos.toByteArray();
|
||||
// for (byte b : ser) {
|
||||
// System.out.print("" + String.format("%02x", b));
|
||||
// }
|
||||
// }
|
||||
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,123 @@
|
|||
/*
|
||||
* Copyright (c) 2018, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/*
|
||||
* @test
|
||||
* @bug 8177552 8327640
|
||||
* @modules jdk.localedata
|
||||
* @summary Checks the serialization feature of CompactNumberFormat
|
||||
* @run junit/othervm TestSerialization
|
||||
*/
|
||||
|
||||
import org.junit.jupiter.api.BeforeAll;
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.junit.jupiter.api.TestInstance;
|
||||
|
||||
import java.io.FileInputStream;
|
||||
import java.io.FileOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.io.ObjectInputStream;
|
||||
import java.io.ObjectOutputStream;
|
||||
import java.math.RoundingMode;
|
||||
import java.text.CompactNumberFormat;
|
||||
import java.text.NumberFormat;
|
||||
import java.util.Locale;
|
||||
|
||||
import static org.junit.jupiter.api.Assertions.assertEquals;
|
||||
|
||||
@TestInstance(TestInstance.Lifecycle.PER_CLASS)
|
||||
public class TestSerialization {
|
||||
|
||||
private static final NumberFormat FORMAT_HI = NumberFormat.getCompactNumberInstance(
|
||||
Locale.of("hi"), NumberFormat.Style.SHORT);
|
||||
private static final CompactNumberFormat FORMAT_EN_US = (CompactNumberFormat) NumberFormat
|
||||
.getCompactNumberInstance(Locale.US, NumberFormat.Style.LONG);
|
||||
private static final NumberFormat FORMAT_JA_JP = NumberFormat.getCompactNumberInstance(
|
||||
Locale.JAPAN, NumberFormat.Style.SHORT);
|
||||
private static final NumberFormat FORMAT_FR_FR = NumberFormat.getCompactNumberInstance(
|
||||
Locale.FRANCE, NumberFormat.Style.LONG);
|
||||
private static final NumberFormat FORMAT_DE_DE = NumberFormat.getCompactNumberInstance(
|
||||
Locale.GERMANY, NumberFormat.Style.SHORT);
|
||||
private static final NumberFormat FORMAT_KO_KR = NumberFormat.getCompactNumberInstance(
|
||||
Locale.KOREA, NumberFormat.Style.SHORT);
|
||||
|
||||
@BeforeAll
|
||||
void mutateInstances() {
|
||||
FORMAT_HI.setMinimumFractionDigits(2);
|
||||
FORMAT_HI.setMinimumIntegerDigits(5);
|
||||
|
||||
FORMAT_EN_US.setRoundingMode(RoundingMode.HALF_UP);
|
||||
FORMAT_EN_US.setGroupingSize(3);
|
||||
FORMAT_EN_US.setParseBigDecimal(true);
|
||||
|
||||
FORMAT_JA_JP.setMaximumFractionDigits(30);
|
||||
FORMAT_JA_JP.setMaximumIntegerDigits(30);
|
||||
|
||||
FORMAT_FR_FR.setParseIntegerOnly(true);
|
||||
FORMAT_FR_FR.setGroupingUsed(true);
|
||||
FORMAT_FR_FR.setStrict(true);
|
||||
|
||||
// Setting minimum integer digits beyond the allowed range
|
||||
FORMAT_DE_DE.setMinimumIntegerDigits(320);
|
||||
|
||||
// Setting minimum fraction digits beyond the allowed range
|
||||
FORMAT_KO_KR.setMinimumFractionDigits(350);
|
||||
}
|
||||
|
||||
@Test
|
||||
void testSerialization() throws IOException, ClassNotFoundException {
|
||||
// Serialize
|
||||
serialize("cdf.ser", FORMAT_HI, FORMAT_EN_US, FORMAT_JA_JP, FORMAT_FR_FR, FORMAT_DE_DE, FORMAT_KO_KR);
|
||||
// Deserialize
|
||||
deserialize("cdf.ser", FORMAT_HI, FORMAT_EN_US, FORMAT_JA_JP, FORMAT_FR_FR, FORMAT_DE_DE, FORMAT_KO_KR);
|
||||
}
|
||||
|
||||
private void serialize(String fileName, NumberFormat... formats)
|
||||
throws IOException {
|
||||
try (ObjectOutputStream os = new ObjectOutputStream(
|
||||
new FileOutputStream(fileName))) {
|
||||
for (NumberFormat fmt : formats) {
|
||||
os.writeObject(fmt);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
private static void deserialize(String fileName, NumberFormat... formats)
|
||||
throws IOException, ClassNotFoundException {
|
||||
try (ObjectInputStream os = new ObjectInputStream(
|
||||
new FileInputStream(fileName))) {
|
||||
for (NumberFormat fmt : formats) {
|
||||
NumberFormat obj = (NumberFormat) os.readObject();
|
||||
assertEquals(obj, fmt, "Serialized and deserialized"
|
||||
+ " objects do not match");
|
||||
|
||||
long number = 123456789789L;
|
||||
String expected = fmt.format(number);
|
||||
String actual = obj.format(number);
|
||||
assertEquals(expected, actual, "Serialized and deserialized"
|
||||
+ " objects are expected to return same formatted"
|
||||
+ " output for number: " + number);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,64 @@
|
|||
#
|
||||
# Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
|
||||
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
#
|
||||
# This code is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License version 2 only, as
|
||||
# published by the Free Software Foundation.
|
||||
#
|
||||
# This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# version 2 for more details (a copy is included in the LICENSE file that
|
||||
# accompanied this code).
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License version
|
||||
# 2 along with this work; if not, write to the Free Software Foundation,
|
||||
# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
#
|
||||
# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
# or visit www.oracle.com if you need additional information or have any
|
||||
# questions.
|
||||
#
|
||||
|
||||
# Hex dump of a serialized CompactNumberFormat for TestDeserializeCNF.
|
||||
|
||||
aced00057372001d6a6176612e746578742e436f6d706163744e756d626572466f726d
|
||||
617462ed0c37b8207cf602000642000c67726f7570696e6753697a655a000f70617273
|
||||
65426967446563696d616c5b000f636f6d706163745061747465726e737400135b4c6a
|
||||
6176612f6c616e672f537472696e673b4c000e646563696d616c5061747465726e7400
|
||||
124c6a6176612f6c616e672f537472696e673b4c000c726f756e64696e674d6f646574
|
||||
00184c6a6176612f6d6174682f526f756e64696e674d6f64653b4c000773796d626f6c
|
||||
737400204c6a6176612f746578742f446563696d616c466f726d617453796d626f6c73
|
||||
3b787200166a6176612e746578742e4e756d626572466f726d6174dff6b3bf137d07e8
|
||||
03000b5a000c67726f7570696e67557365644200116d61784672616374696f6e446967
|
||||
6974734200106d6178496e74656765724469676974734900156d6178696d756d467261
|
||||
6374696f6e4469676974734900146d6178696d756d496e746567657244696769747342
|
||||
00116d696e4672616374696f6e4469676974734200106d696e496e7465676572446967
|
||||
6974734900156d696e696d756d4672616374696f6e4469676974734900146d696e696d
|
||||
756d496e74656765724469676974735a00107061727365496e74656765724f6e6c7949
|
||||
001573657269616c56657273696f6e4f6e53747265616d787200106a6176612e746578
|
||||
742e466f726d6174fbd8bc12e90f1843020000787000007f0000000000000135000100
|
||||
000000000000010000000001780301757200135b4c6a6176612e6c616e672e53747269
|
||||
6e673badd256e7e91d7b4702000078700000000f74000071007e000a71007e000a7400
|
||||
02304b74000330304b7400043030304b740002304d74000330304d7400043030304d74
|
||||
0002304274000330304274000430303042740002305474000330305474000430303054
|
||||
740009232c2323302e2323237e7200166a6176612e6d6174682e526f756e64696e674d
|
||||
6f646500000000000000001200007872000e6a6176612e6c616e672e456e756d000000
|
||||
0000000000120000787074000748414c465f55507372001e6a6176612e746578742e44
|
||||
6563696d616c466f726d617453796d626f6c73501d17990868939c0200114300106465
|
||||
63696d616c536570617261746f72430005646967697443000b6578706f6e656e746961
|
||||
6c43001167726f7570696e67536570617261746f724300096d696e75735369676e4300
|
||||
116d6f6e6574617279536570617261746f724300107061747465726e53657061726174
|
||||
6f724300077065724d696c6c43000770657263656e7449001573657269616c56657273
|
||||
696f6e4f6e53747265616d4300097a65726f44696769744c00034e614e71007e00024c
|
||||
000e63757272656e637953796d626f6c71007e00024c00146578706f6e656e7469616c
|
||||
536570617261746f7271007e00024c0008696e66696e69747971007e00024c0012696e
|
||||
746c43757272656e637953796d626f6c71007e00024c00066c6f63616c657400124c6a
|
||||
6176612f7574696c2f4c6f63616c653b7870002e00230045002c002d002e003b203000
|
||||
250000000300307400034e614e7074000145740003e2889e70737200106a6176612e75
|
||||
74696c2e4c6f63616c657ef811609c30f9ec03000649000868617368636f64654c0007
|
||||
636f756e74727971007e00024c000a657874656e73696f6e7371007e00024c00086c61
|
||||
6e677561676571007e00024c000673637269707471007e00024c000776617269616e74
|
||||
71007e00027870ffffffff740002555371007e000a740002656e71007e000a71007e00
|
||||
0a78
|
||||
|
|
@ -0,0 +1,64 @@
|
|||
#
|
||||
# Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
|
||||
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
#
|
||||
# This code is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License version 2 only, as
|
||||
# published by the Free Software Foundation.
|
||||
#
|
||||
# This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# version 2 for more details (a copy is included in the LICENSE file that
|
||||
# accompanied this code).
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License version
|
||||
# 2 along with this work; if not, write to the Free Software Foundation,
|
||||
# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
#
|
||||
# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
# or visit www.oracle.com if you need additional information or have any
|
||||
# questions.
|
||||
#
|
||||
|
||||
# Hex dump of a serialized CompactNumberFormat for TestDeserializeCNF.
|
||||
|
||||
aced00057372001d6a6176612e746578742e436f6d706163744e756d626572466f726d
|
||||
617462ed0c37b8207cf602000642000c67726f7570696e6753697a655a000f70617273
|
||||
65426967446563696d616c5b000f636f6d706163745061747465726e737400135b4c6a
|
||||
6176612f6c616e672f537472696e673b4c000e646563696d616c5061747465726e7400
|
||||
124c6a6176612f6c616e672f537472696e673b4c000c726f756e64696e674d6f646574
|
||||
00184c6a6176612f6d6174682f526f756e64696e674d6f64653b4c000773796d626f6c
|
||||
737400204c6a6176612f746578742f446563696d616c466f726d617453796d626f6c73
|
||||
3b787200166a6176612e746578742e4e756d626572466f726d6174dff6b3bf137d07e8
|
||||
03000b5a000c67726f7570696e67557365644200116d61784672616374696f6e446967
|
||||
6974734200106d6178496e74656765724469676974734900156d6178696d756d467261
|
||||
6374696f6e4469676974734900146d6178696d756d496e746567657244696769747342
|
||||
00116d696e4672616374696f6e4469676974734200106d696e496e7465676572446967
|
||||
6974734900156d696e696d756d4672616374696f6e4469676974734900146d696e696d
|
||||
756d496e74656765724469676974735a00107061727365496e74656765724f6e6c7949
|
||||
001573657269616c56657273696f6e4f6e53747265616d787200106a6176612e746578
|
||||
742e466f726d6174fbd8bc12e90f1843020000787000057f0000000500000135051400
|
||||
000005000000140000000001780000757200135b4c6a6176612e6c616e672e53747269
|
||||
6e673badd256e7e91d7b4702000078700000000f74000071007e000a71007e000a7400
|
||||
013074000430e4b8877400053030e4b887740006303030e4b88774000730303030e4b8
|
||||
8774000430e584847400053030e58484740006303030e5848474000730303030e58484
|
||||
74000430e585867400053030e58586740006303030e58586740009232c2323302e2323
|
||||
237e7200166a6176612e6d6174682e526f756e64696e674d6f64650000000000000000
|
||||
1200007872000e6a6176612e6c616e672e456e756d0000000000000000120000787074
|
||||
000948414c465f4556454e7372001e6a6176612e746578742e446563696d616c466f72
|
||||
6d617453796d626f6c73501d17990868939c020011430010646563696d616c53657061
|
||||
7261746f72430005646967697443000b6578706f6e656e7469616c43001167726f7570
|
||||
696e67536570617261746f724300096d696e75735369676e4300116d6f6e6574617279
|
||||
536570617261746f724300107061747465726e536570617261746f724300077065724d
|
||||
696c6c43000770657263656e7449001573657269616c56657273696f6e4f6e53747265
|
||||
616d4300097a65726f44696769744c00034e614e71007e00024c000e63757272656e63
|
||||
7953796d626f6c71007e00024c00146578706f6e656e7469616c536570617261746f72
|
||||
71007e00024c0008696e66696e69747971007e00024c0012696e746c43757272656e63
|
||||
7953796d626f6c71007e00024c00066c6f63616c657400124c6a6176612f7574696c2f
|
||||
4c6f63616c653b7870002e00230045002c002d002e003b203000250000000300307400
|
||||
034e614e7074000145740003e2889e70737200106a6176612e7574696c2e4c6f63616c
|
||||
657ef811609c30f9ec03000649000868617368636f64654c0007636f756e7472797100
|
||||
7e00024c000a657874656e73696f6e7371007e00024c00086c616e677561676571007e
|
||||
00024c000673637269707471007e00024c000776617269616e7471007e00027870ffff
|
||||
ffff7400024a5071007e000a7400026a6171007e000a71007e000a78
|
||||
Loading…
Add table
Add a link
Reference in a new issue