undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions

View file

@ -0,0 +1,52 @@
/*
* Copyright (c) 2004, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4902078
* @summary concurrent modification not detected on 2nd to last iteration
* @author Josh Bloch
*
* @ignore Bug fix temporarily removed as it uncovered other bugs (4992226)
*/
import java.util.ArrayList;
import java.util.ConcurrentModificationException;
import java.util.List;
public class CheckForComodification {
private static final int LENGTH = 10;
public static void main(String[] args) throws Exception {
List<Integer> list = new ArrayList<>();
for (int i = 0; i < LENGTH; i++)
list.add(i);
try {
for (int i : list)
if (i == LENGTH - 2)
list.remove(i);
} catch (ConcurrentModificationException e) {
return;
}
throw new RuntimeException("No ConcurrentModificationException");
}
}

View file

@ -0,0 +1,114 @@
/*
* Copyright (c) 2020, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8161558
* @summary ListIterator should not discard cause on exception
* @run testng CheckForIndexOutOfBoundsException
*/
import java.util.List;
import java.util.AbstractList;
import java.util.Iterator;
import java.util.ListIterator;
import java.util.NoSuchElementException;
import org.testng.annotations.Test;
import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.assertTrue;
import static org.testng.Assert.fail;
// Fixed size list containing two elements
class MyList extends AbstractList<String> {
private static final int SIZE = 2;
public String get(int i) {
if (i >= 0 && i < SIZE) {
return "x";
} else {
throw new IndexOutOfBoundsException(i);
}
}
public int size() {
return SIZE;
}
}
@Test
public class CheckForIndexOutOfBoundsException {
List<String> list = new MyList();
@Test
public void checkIteratorNext() {
var iterator = list.iterator(); // position at start
try {
for (int i = 0; i <= list.size(); i++) {
iterator.next();
}
fail("Failing checkIteratorNext() - NoSuchElementException should have been thrown");
} catch (NoSuchElementException e) {
checkAssertOnException(e);
}
}
@Test
public void checkListIteratorNext() {
var iterator = list.listIterator(list.size()); // position at end
try {
iterator.next();
fail("Failing checkListIteratorNext() - NoSuchElementException should have been thrown");
} catch (NoSuchElementException e) {
checkAssertOnException(e);
}
}
@Test
public void checkListIteratorPrevious() {
var iterator = list.listIterator(0); // position at start
try {
iterator.previous();
fail("Failing checkListIteratorPrevious() - NoSuchElementException should have been thrown");
} catch (NoSuchElementException e) {
checkAssertOnException(e);
}
}
private void checkAssertOnException(NoSuchElementException e) {
var cause = e.getCause();
assertNotNull(cause, "Exception.getCause()");
assertTrue(cause instanceof IndexOutOfBoundsException, "Exception.getCause() should be an " +
"IndexOutOfBoundsException");
var msg = e.getMessage();
assertNotNull(msg, "Exception.getMessage()");
assertTrue(msg.contains("IndexOutOfBoundsException"), "Exception.getMessage() should " +
"contain the string 'IndexOutOfBoundsException'");
}
}

View file

@ -0,0 +1,78 @@
/*
* Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4189896
* @summary AbstractList iterators previously checked for co-modification
* *after* the set/add/remove operations were performed.
*/
import java.util.ArrayList;
import java.util.ConcurrentModificationException;
import java.util.List;
import java.util.ListIterator;
public class FailFastIterator {
public static void main(String[] args) throws Exception {
List orig = new ArrayList(100);
for (int i=0; i<100; i++)
orig.add(new Integer(i));
List copy = new ArrayList(orig);
try {
ListIterator i = copy.listIterator();
i.next();
copy.remove(99);
copy.add(new Integer(99));
i.remove();
throw new Exception("remove: iterator didn't fail fast");
} catch (ConcurrentModificationException e) {
}
if (!copy.equals(orig))
throw new Exception("remove: iterator didn't fail fast enough");
try {
ListIterator i = copy.listIterator();
i.next();
copy.remove(99);
copy.add(new Integer(99));
i.set(new Integer(666));
throw new Exception("set: iterator didn't fail fast");
} catch (ConcurrentModificationException e) {
}
if (!copy.equals(orig))
throw new Exception("set: iterator didn't fail fast enough");
try {
ListIterator i = copy.listIterator();
copy.remove(99);
copy.add(new Integer(99));
i.add(new Integer(666));
throw new Exception("add: iterator didn't fail fast");
} catch (ConcurrentModificationException e) {
}
if (!copy.equals(orig))
throw new Exception("add: iterator didn't fail fast enough");
}
}

View file

@ -0,0 +1,53 @@
/*
* Copyright (c) 2000, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4375048
* @summary AbstractList's ListIterator.hasNext() returns
* true, after ListIterator.previous() causes
* an exception for an empty list.
* @author Konstantin Kladko
*/
import java.util.ArrayList;
import java.util.List;
import java.util.ListIterator;
import java.util.NoSuchElementException;
public class HasNextAfterException {
public static void main(String[] args) {
List list = new ArrayList();
ListIterator i = list.listIterator();
try {
i.previous();
}
catch (NoSuchElementException e) {
}
if (i.hasNext()) {
throw new RuntimeException(
"ListIterator.hasNext() returns true for an empty "
+ "List after ListIterator.previous().");
}
}
}