undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions

View file

@ -0,0 +1,111 @@
/*
* Copyright (c) 2014, 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.io.*;
import java.lang.reflect.Field;
import java.util.Hashtable;
/**
* @test
* @bug 8068427
* @summary Hashtable deserialization reconstitutes table with wrong capacity
* @modules java.base/java.util:open
*/
public class DeserializedLength {
static boolean testDeserializedLength(int elements, float loadFactor) throws Exception {
// construct Hashtable with minimal initial capacity and given loadFactor
Hashtable<Integer, Integer> ht1 = new Hashtable<>(1, loadFactor);
// add given number of unique elements
for (int i = 0; i < elements; i++) {
ht1.put(i, i);
}
// serialize and deserialize into a deep clone
Hashtable<Integer, Integer> ht2 = serialClone(ht1);
// compare lengths of internal tables
Object[] table1 = (Object[]) hashtableTableField.get(ht1);
Object[] table2 = (Object[]) hashtableTableField.get(ht2);
assert table1 != null;
assert table2 != null;
int minLength = (int) (ht1.size() / loadFactor) + 1;
int maxLength = minLength * 2;
boolean ok = (table2.length >= minLength && table2.length <= maxLength);
System.out.printf(
"%7d %5.2f %7d %7d %7d...%7d %s\n",
ht1.size(), loadFactor,
table1.length, table2.length,
minLength, maxLength,
(ok ? "OK" : "NOT-OK")
);
return ok;
}
static <T> T serialClone(T o) throws IOException, ClassNotFoundException {
ByteArrayOutputStream bos = new ByteArrayOutputStream();
try (ObjectOutputStream oos = new ObjectOutputStream(bos)) {
oos.writeObject(o);
}
@SuppressWarnings("unchecked")
T clone = (T) new ObjectInputStream(
new ByteArrayInputStream(bos.toByteArray())).readObject();
return clone;
}
private static final Field hashtableTableField;
static {
try {
hashtableTableField = Hashtable.class.getDeclaredField("table");
hashtableTableField.setAccessible(true);
} catch (NoSuchFieldException e) {
throw new Error(e);
}
}
public static void main(String[] args) throws Exception {
boolean ok = true;
System.out.printf("Results:\n" +
" ser. deser.\n" +
" size load lentgh length valid range ok?\n" +
"------- ----- ------- ------- ----------------- ------\n"
);
for (int elements : new int[]{10, 50, 500, 5000}) {
for (float loadFactor : new float[]{0.25f, 0.5f, 0.75f, 1.0f, 2.5f}) {
ok &= testDeserializedLength(elements, loadFactor);
}
}
if (!ok) {
throw new AssertionError("Test failed.");
}
}
}

View file

@ -0,0 +1,56 @@
/*
* Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4208530
* @summary Hashtable was less robust to extension that it could have been
* because the equals and Hashcode methods used internals
* unnecessarily. (java.security.Provider tickled this sensitivity.)
*/
import java.security.Provider;
import java.util.Map;
public class EqualsCast {
public static void main(String[] args) throws Exception {
Map m1 = new MyProvider("foo", 69, "baz");
Map m2 = new MyProvider("foo", 69, "baz");
m1.equals(m2);
}
}
class MyProvider extends Provider {
private String name;
public MyProvider(String name, double version, String info) {
super(name, version, info);
this.name = name;
put("Signature.sigalg", "sigimpl");
}
public String getName() {
return this.name;
}
}

View file

@ -0,0 +1,41 @@
/*
* Copyright (c) 2001, 2012, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4559052
* @summary Hashtable's hashCode method always returns zero(!)
* @author Josh Bloch
*/
import java.util.Hashtable;
import java.util.Map;
public class HashCode {
public static void main(String[] args) throws Exception {
Map m = new Hashtable();
if (m.hashCode() != 0)
throw new Exception("Empty Hashtable has nonzero hashCode.");
}
}

View file

@ -0,0 +1,138 @@
/*
* Copyright (c) 1997, 1998, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
@bug 4093817 4189594
@summary Test for an illegalargumentexception on loadFactor
*/
import java.util.HashMap;
import java.util.HashSet;
import java.util.Hashtable;
import java.util.Map;
import java.util.Set;
import java.util.WeakHashMap;
/**
* This class tests to see if creating a hash table with an
* illegal value of loadFactor results in an IllegalArgumentException
*/
public class IllegalLoadFactor {
public static void main(String[] args) throws Exception {
boolean testSucceeded = false;
try {
// this should generate an IllegalArgumentException
Hashtable bad1 = new Hashtable(100, -3);
}
catch (IllegalArgumentException e1) {
testSucceeded = true;
}
if (!testSucceeded)
throw new Exception("Hashtable, negative load factor");
testSucceeded = false;
try {
// this should generate an IllegalArgumentException
Hashtable bad1 = new Hashtable(100, Float.NaN);
}
catch (IllegalArgumentException e1) {
testSucceeded = true;
}
if (!testSucceeded)
throw new Exception("Hashtable, NaN load factor");
testSucceeded = false;
try {
// this should generate an IllegalArgumentException
HashMap bad1 = new HashMap(100, -3);
}
catch (IllegalArgumentException e1) {
testSucceeded = true;
}
if (!testSucceeded)
throw new Exception("HashMap, negative load factor");
testSucceeded = false;
try {
// this should generate an IllegalArgumentException
HashMap bad1 = new HashMap(100, Float.NaN);
}
catch (IllegalArgumentException e1) {
testSucceeded = true;
}
if (!testSucceeded)
throw new Exception("HashMap, NaN load factor");
testSucceeded = false;
try {
// this should generate an IllegalArgumentException
HashSet bad1 = new HashSet(100, -3);
}
catch (IllegalArgumentException e1) {
testSucceeded = true;
}
if (!testSucceeded)
throw new Exception("HashSet, negative load factor");
testSucceeded = false;
try {
// this should generate an IllegalArgumentException
HashSet bad1 = new HashSet(100, Float.NaN);
}
catch (IllegalArgumentException e1) {
testSucceeded = true;
}
if (!testSucceeded)
throw new Exception("HashSet, NaN load factor");
testSucceeded = false;
try {
// this should generate an IllegalArgumentException
WeakHashMap bad1 = new WeakHashMap(100, -3);
}
catch (IllegalArgumentException e1) {
testSucceeded = true;
}
if (!testSucceeded)
throw new Exception("WeakHashMap, negative load factor");
testSucceeded = false;
try {
// this should generate an IllegalArgumentException
WeakHashMap bad1 = new WeakHashMap(100, Float.NaN);
}
catch (IllegalArgumentException e1) {
testSucceeded = true;
}
if (!testSucceeded)
throw new Exception("WeakHashMap, NaN load factor");
// Make sure that legal creates don't throw exceptions
Map goodMap = new Hashtable(100, .69f);
goodMap = new HashMap(100, .69f);
Set goodSet = new HashSet(100, .69f);
goodMap = new WeakHashMap(100, .69f);
}
}

View file

@ -0,0 +1,101 @@
/*
* Copyright (c) 2003, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4652911
* @summary test Hashtable readObject for invocation of overridable put method
*/
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.Serializable;
import java.util.Hashtable;
/**
* Class that extends Hashtable to demonstrate bug when
* subclass wraps the values put into the Hashtable.
*/
public class ReadObject extends Hashtable {
/**
* Wraps the values put into MyHashtable objects
*/
class ValueWrapper implements Serializable {
private Object mValue;
ValueWrapper(Object value) {
mValue = value;
}
Object getValue() {
return mValue;
}
}
public Object get(Object key) {
ValueWrapper valueWrapper = (ValueWrapper)super.get(key);
Object value = valueWrapper.getValue();
if (value instanceof ValueWrapper)
throw new RuntimeException("Hashtable.get bug");
return value;
}
public Object put(Object key, Object value) {
if (value instanceof ValueWrapper)
throw new RuntimeException(
"Hashtable.put bug: value is already wrapped");
ValueWrapper valueWrapper = new ValueWrapper(value);
super.put(key, valueWrapper);
return value;
}
private static Object copyObject(Object oldObj) {
Object newObj = null;
try {
//Create a stream in which to serialize the object.
ByteArrayOutputStream ostream = new ByteArrayOutputStream();
ObjectOutputStream p = new ObjectOutputStream(ostream);
//Serialize the object into the stream
p.writeObject(oldObj);
//Create an input stream from which to deserialize the object
byte[] byteArray = ostream.toByteArray();
ByteArrayInputStream istream = new ByteArrayInputStream(byteArray);
ObjectInputStream q = new ObjectInputStream(istream);
//Deserialize the object
newObj = q.readObject();
} catch (Exception ex) {
ex.printStackTrace();
}
return newObj;
}
public static void main(String[] args) {
ReadObject myHashtable = new ReadObject();
myHashtable.put("key", "value");
ReadObject myHashtableCopy = (ReadObject)copyObject(myHashtable);
String value = (String)myHashtableCopy.get("key");
}
}

View file

@ -0,0 +1,59 @@
/*
* Copyright (c) 2001, 2005, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4421469 6282555
* @summary Hashtable's toString method should detect self-referential
* hash tables rather than throwing a StackOverflowException.
* @author Josh Bloch, Martin Buchholz
*/
import java.util.HashMap;
import java.util.Hashtable;
import java.util.LinkedHashMap;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
public class SelfRef {
public static void main(String[] args) {
testMap(new Hashtable<Object,Object>());
testMap(new HashMap<Object,Object>());
testMap(new LinkedHashMap<Object,Object>());
testMap(new ConcurrentHashMap<Object,Object>());
}
private static void testMap(Map<Object,Object> m) {
if (! (m.toString().equals("{}")))
throw new Error();
m.put("Harvey", m);
if (! (m.toString().equals("{Harvey=(this Map)}")))
throw new Error();
m.clear();
m.put(m, "Harvey");
if (! (m.toString().equals("{(this Map)=Harvey}")))
throw new Error();
m.clear();
m.hashCode();
}
}

View file

@ -0,0 +1,156 @@
/*
* Copyright (c) 2010, 2011, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*
* -------------------------------------------
*
* Portions Copyright (c) 2010, 2011 IBM Corporation
*/
/*
* @test
* @bug 6927486
* @summary Serializing Hashtable objects which refer to each other should not be able to deadlock.
* @author Neil Richards <neil.richards@ngmr.net>, <neil_richards@uk.ibm.com>
*/
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectOutputStream;
import java.io.PrintWriter;
import java.io.Serializable;
import java.io.StringWriter;
import java.util.ArrayList;
import java.util.Hashtable;
import java.util.List;
import java.util.concurrent.CyclicBarrier;
public class SerializationDeadlock {
public static void main(final String[] args) throws Exception {
// Test for Hashtable serialization deadlock
final Hashtable<Object, Object> h1 = new Hashtable<>();
final Hashtable<Object, Object> h2 = new Hashtable<>();
final TestBarrier testStart = new TestBarrier(3);
// Populate the hashtables so that they refer to each other
h1.put(testStart, h2);
h2.put(testStart, h1);
final CyclicBarrier testEnd = new CyclicBarrier(3);
final TestThread t1 = new TestThread(h1, testEnd);
final TestThread t2 = new TestThread(h2, testEnd);
t1.start();
t2.start();
// Wait for both test threads to have initiated serialization
// of the 'testStart' object (and hence of both 'h1' and 'h2')
testStart.await();
// Wait for both test threads to successfully finish serialization
// of 'h1' and 'h2'.
System.out.println("Waiting for Hashtable serialization to complete ...");
System.out.println("(This test will hang if serialization deadlocks)");
testEnd.await();
System.out.println("Test PASSED: serialization completed successfully");
TestThread.handleExceptions();
}
static final class TestBarrier extends CyclicBarrier
implements Serializable {
public TestBarrier(final int count) {
super(count);
}
private void writeObject(final ObjectOutputStream oos)
throws IOException {
oos.defaultWriteObject();
// Wait until all test threads have started serializing data
try {
await();
} catch (final Exception e) {
throw new IOException("Test ERROR: Unexpected exception caught", e);
}
}
}
static final class TestThread extends Thread {
private static final List<Exception> exceptions = new ArrayList<>();
private final Hashtable<Object, Object> hashtable;
private final CyclicBarrier testEnd;
public TestThread(final Hashtable<Object, Object> hashtable,
final CyclicBarrier testEnd) {
this.hashtable = hashtable;
this.testEnd = testEnd;
setDaemon(true);
}
public void run() {
try {
final ByteArrayOutputStream baos = new ByteArrayOutputStream();
final ObjectOutputStream oos = new ObjectOutputStream(baos);
oos.writeObject(hashtable);
oos.close();
} catch (final IOException ioe) {
addException(ioe);
} finally {
try {
testEnd.await();
} catch (Exception e) {
addException(e);
}
}
}
private static synchronized void addException(final Exception exception) {
exceptions.add(exception);
}
public static synchronized void handleExceptions() {
if (false == exceptions.isEmpty()) {
throw new RuntimeException(getErrorText(exceptions));
}
}
private static String getErrorText(final List<Exception> exceptions) {
final StringWriter sw = new StringWriter();
final PrintWriter pw = new PrintWriter(sw);
pw.println("Test ERROR: Unexpected exceptions thrown on test threads:");
for (Exception exception : exceptions) {
pw.print("\t");
pw.println(exception);
for (StackTraceElement element : exception.getStackTrace()) {
pw.print("\t\tat ");
pw.println(element);
}
}
pw.close();
return sw.toString();
}
}
}

View file

@ -0,0 +1,96 @@
/*
* Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*
* -------------------------------------------
*
* Portions Copyright (c) 2010, 2011 IBM Corporation
*/
/*
* @test
* @bug 6927486
* @summary A serialized Hashtable can be de-serialized properly.
* @author Neil Richards <neil.richards@ngmr.net>, <neil_richards@uk.ibm.com>
*/
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.PrintWriter;
import java.io.StringWriter;
import java.util.Hashtable;
import java.util.Map;
public class SimpleSerialization {
public static void main(final String[] args) throws Exception {
Hashtable<String, String> h1 = new Hashtable<>();
System.err.println("*** BEGIN TEST ***");
h1.put("key", "value");
final ByteArrayOutputStream baos = new ByteArrayOutputStream();
try (ObjectOutputStream oos = new ObjectOutputStream(baos)) {
oos.writeObject(h1);
}
final byte[] data = baos.toByteArray();
final ByteArrayInputStream bais = new ByteArrayInputStream(data);
final Object deserializedObject;
try (ObjectInputStream ois = new ObjectInputStream(bais)) {
deserializedObject = ois.readObject();
}
if(!h1.getClass().isInstance(deserializedObject)) {
throw new RuntimeException("Result not assignable to type of h1");
}
if (false == h1.equals(deserializedObject)) {
Hashtable<String, String> d1 = (Hashtable<String, String>) h1;
for(Map.Entry entry: h1.entrySet()) {
System.err.println("h1.key::" + entry.getKey() + " d1.containsKey()::" + d1.containsKey((String) entry.getKey()));
System.err.println("h1.value::" + entry.getValue() + " d1.contains()::" + d1.contains(entry.getValue()));
System.err.println("h1.value == d1.value " + entry.getValue().equals(d1.get((String) entry.getKey())));
}
throw new RuntimeException(getFailureText(h1, deserializedObject));
}
}
private static String getFailureText(final Object orig, final Object copy) {
final StringWriter sw = new StringWriter();
try (PrintWriter pw = new PrintWriter(sw)) {
pw.println("Test FAILED: Deserialized object is not equal to the original object");
pw.print("\tOriginal: ");
printObject(pw, orig).println();
pw.print("\tCopy: ");
printObject(pw, copy).println();
}
return sw.toString();
}
private static PrintWriter printObject(final PrintWriter pw, final Object o) {
pw.printf("%s@%08x", o.getClass().getName(), System.identityHashCode(o));
return pw;
}
}