undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions

View file

@ -0,0 +1,156 @@
/*
* Copyright (c) 2015, 2016, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8066070
* @run testng AddNonComparable
*/
import org.testng.annotations.Test;
import java.util.PriorityQueue;
import java.util.Queue;
import java.util.SortedMap;
import java.util.SortedSet;
import java.util.TreeMap;
import java.util.TreeSet;
import java.util.concurrent.ConcurrentSkipListMap;
import java.util.concurrent.ConcurrentSkipListSet;
import java.util.concurrent.PriorityBlockingQueue;
import java.util.function.BiConsumer;
import java.util.function.Supplier;
import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertNull;
import static org.testng.Assert.assertTrue;
public class AddNonComparable {
static <E> void test(Queue<E> queue, Supplier<E> supplier,
BiConsumer<? super Queue<E>, Throwable> checker) {
Throwable x = null;
try { queue.add(supplier.get()); }
catch (Throwable e) { x = e; }
checker.accept(queue, x);
}
@Test
public void queues() {
test(new PriorityQueue<>(), NonComparable::new,
(q, e) -> {
assertEquals(q.size(), 0);
assertTrue(e instanceof ClassCastException);
});
test(new PriorityQueue<>(), AComparable::new,
(q, e) -> {
assertEquals(q.size(), 1);
assertNull(e);
});
test(new PriorityBlockingQueue<>(), NonComparable::new,
(q, e) -> {
assertEquals(q.size(), 0);
assertTrue(e instanceof ClassCastException);
});
test(new PriorityBlockingQueue<>(), AComparable::new,
(q, e) -> {
assertEquals(q.size(), 1);
assertNull(e);
});
}
static <E> void test(SortedSet<E> set, Supplier<E> supplier,
BiConsumer<? super SortedSet<E>, Throwable> checker) {
Throwable x = null;
try { set.add(supplier.get()); }
catch (Throwable e) { x = e; }
checker.accept(set, x);
}
@Test
public void sets() {
test(new TreeSet<>(), NonComparable::new,
(s, e) -> {
assertEquals(s.size(), 0);
assertTrue(e instanceof ClassCastException);
});
test(new TreeSet<>(), AComparable::new,
(s, e) -> {
assertEquals(s.size(), 1);
assertNull(e);
});
test(new ConcurrentSkipListSet<>(), NonComparable::new,
(s, e) -> {
assertEquals(s.size(), 0);
assertTrue(e instanceof ClassCastException);
});
test(new ConcurrentSkipListSet<>(), AComparable::new,
(s, e) -> {
assertEquals(s.size(), 1);
assertNull(e);
});
}
static <K> void test(SortedMap<K,Boolean> map, Supplier<K> supplier,
BiConsumer<? super SortedMap<K,Boolean>, Throwable> checker) {
Throwable x = null;
try { map.put(supplier.get(), Boolean.TRUE); }
catch (Throwable e) { x = e; }
checker.accept(map, x);
}
@Test
public void maps() {
test(new TreeMap<>(), NonComparable::new,
(m, e) -> {
assertEquals(m.size(), 0);
assertTrue(e instanceof ClassCastException);
});
test(new TreeMap<>(), AComparable::new,
(m, e) -> {
assertEquals(m.size(), 1);
assertNull(e);
});
test(new ConcurrentSkipListMap<>(), NonComparable::new,
(s, e) -> {
assertEquals(s.size(), 0);
assertTrue(e instanceof ClassCastException);
});
test(new ConcurrentSkipListMap<>(), AComparable::new,
(s, e) -> {
assertEquals(s.size(), 1);
assertNull(e);
});
}
static class NonComparable { }
static class AComparable implements Comparable<AComparable> {
@Override public int compareTo(AComparable v) { return 0; }
}
}

View file

@ -0,0 +1,158 @@
/*
* Copyright (c) 2006, 2014, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 6394004
* @summary Test ForgetMeNot implementation feature (and more)
* @author Martin Buchholz
*/
import java.util.Arrays;
import java.util.Iterator;
import java.util.NoSuchElementException;
import java.util.PriorityQueue;
import java.util.Queue;
public class ForgetMeNot {
private static void checkQ(PriorityQueue<Integer> q, Integer...elts) {
check(Arrays.equals(q.toArray(), elts));
}
private static void noMoreElements(final Iterator<Integer> it) {
for (int j = 0; j < 2; j++) {
THROWS(NoSuchElementException.class, () -> it.next());
check(! it.hasNext());
}
}
private static void removeIsCurrentlyIllegal(final Iterator<Integer> it) {
for (int j = 0; j < 2; j++) {
THROWS(IllegalStateException.class, () -> it.remove());
}
}
private static void remove(Iterator<Integer> it,
Queue<Integer> q) {
int size = q.size();
it.remove();
removeIsCurrentlyIllegal(it);
equal(size, q.size()+1);
}
private static void realMain(String[] args) throws Throwable {
final PriorityQueue<Integer> q = new PriorityQueue<>();
Iterator<Integer> it;
//----------------------------------------------------------------
// Empty
//----------------------------------------------------------------
checkQ(q);
check(q.isEmpty());
check(! q.contains(1));
it = q.iterator();
removeIsCurrentlyIllegal(it);
noMoreElements(it);
q.clear();
check(q.isEmpty());
//----------------------------------------------------------------
// Singleton
//----------------------------------------------------------------
q.add(1);
checkQ(q, 1);
check(! q.isEmpty());
check(q.contains(1));
it = q.iterator();
removeIsCurrentlyIllegal(it);
check(it.hasNext());
equal(it.next(), 1);
noMoreElements(it);
remove(it, q);
check(q.isEmpty());
noMoreElements(it);
checkQ(q);
q.clear();
//----------------------------------------------------------------
// @see PriorityQueue.forgetMeNot
//----------------------------------------------------------------
final Integer[] a = {0, 4, 1, 6, 7, 2, 3}; // Carefully chosen!
q.addAll(Arrays.asList(a));
checkQ(q, a);
it = q.iterator();
checkQ(q, a);
removeIsCurrentlyIllegal(it);
checkQ(q, a);
check(it.hasNext());
removeIsCurrentlyIllegal(it);
checkQ(q, a);
check(it.hasNext());
equal(it.next(), 0);
equal(it.next(), 4);
equal(it.next(), 1);
equal(it.next(), 6);
check(it.hasNext());
checkQ(q, a);
remove(it, q);
checkQ(q, 0, 3, 1, 4, 7, 2);
check(it.hasNext());
removeIsCurrentlyIllegal(it);
equal(it.next(), 7);
remove(it, q);
checkQ(q, 0, 2, 1, 4, 3);
check(it.hasNext());
removeIsCurrentlyIllegal(it);
check(it.hasNext());
equal(it.next(), 3);
equal(it.next(), 2);
check(! it.hasNext());
remove(it, q);
checkQ(q, 0, 3, 1, 4);
check(! it.hasNext());
noMoreElements(it);
removeIsCurrentlyIllegal(it);
}
//--------------------- Infrastructure ---------------------------
static volatile int passed = 0, failed = 0;
static void pass() {passed++;}
static void fail() {failed++; Thread.dumpStack();}
static void fail(String msg) {System.out.println(msg); fail();}
static void unexpected(Throwable t) {failed++; t.printStackTrace();}
static void check(boolean cond) {if (cond) pass(); else fail();}
static void equal(Object x, Object y) {
if (x == null ? y == null : x.equals(y)) pass();
else fail(x + " not equal to " + y);}
public static void main(String[] args) throws Throwable {
try {realMain(args);} catch (Throwable t) {unexpected(t);}
System.out.printf("%nPassed = %d, failed = %d%n%n", passed, failed);
if (failed > 0) throw new AssertionError("Some tests failed");}
interface Fun {void f() throws Throwable;}
static void THROWS(Class<? extends Throwable> k, Fun... fs) {
for (Fun f : fs)
try { f.f(); fail("Expected " + k.getName() + " not thrown"); }
catch (Throwable t) {
if (k.isAssignableFrom(t.getClass())) pass();
else unexpected(t);}}
}

View file

@ -0,0 +1,202 @@
/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* This file is available under and governed by the GNU General Public
* License version 2 only, as published by the Free Software Foundation.
* However, the following notice accompanied the original version of this
* file:
*
* Written by Martin Buchholz with assistance from members of JCP JSR-166
* Expert Group and released to the public domain, as explained at
* http://creativecommons.org/publicdomain/zero/1.0/
*/
/*
* @test
* @bug 6950540
* @summary Attempt to add a null throws NullPointerException
*/
import java.util.ArrayList;
import java.util.Collection;
import java.util.Comparator;
import java.util.PriorityQueue;
import java.util.SortedSet;
import java.util.TreeSet;
import java.util.concurrent.ArrayBlockingQueue;
import java.util.concurrent.LinkedBlockingDeque;
import java.util.concurrent.LinkedBlockingQueue;
import java.util.concurrent.PriorityBlockingQueue;
public class NoNulls {
void test(String[] args) throws Throwable {
final Comparator<String> nullTolerantComparator
= new Comparator<>() {
public int compare(String x, String y) {
return (x == null ? -1 :
y == null ? 1 :
x.compareTo(y));
}};
final SortedSet<String> nullSortedSet
= new TreeSet<>(nullTolerantComparator);
nullSortedSet.add(null);
final PriorityQueue<String> nullPriorityQueue
= new PriorityQueue<>() {
public Object[] toArray() { return new Object[] { null };}};
final Collection<String> nullCollection = new ArrayList<>();
nullCollection.add(null);
THROWS(NullPointerException.class,
new F() { void f() {
new PriorityQueue<String>(nullCollection);
}},
new F() { void f() {
new PriorityBlockingQueue<String>(nullCollection);
}},
new F() { void f() {
new ArrayBlockingQueue<String>(10, false, nullCollection);
}},
new F() { void f() {
new ArrayBlockingQueue<String>(10, true, nullCollection);
}},
new F() { void f() {
new LinkedBlockingQueue<String>(nullCollection);
}},
new F() { void f() {
new LinkedBlockingDeque<String>(nullCollection);
}},
new F() { void f() {
new PriorityQueue<String>((Collection<String>) nullPriorityQueue);
}},
new F() { void f() {
new PriorityBlockingQueue<String>((Collection<String>) nullPriorityQueue);
}},
new F() { void f() {
new PriorityQueue<String>(nullSortedSet);
}},
new F() { void f() {
new PriorityBlockingQueue<String>(nullSortedSet);
}},
new F() { void f() {
new PriorityQueue<String>((Collection<String>) nullSortedSet);
}},
new F() { void f() {
new PriorityBlockingQueue<String>((Collection<String>) nullSortedSet);
}},
new F() { void f() {
new PriorityQueue<String>(nullPriorityQueue);
}},
new F() { void f() {
new PriorityBlockingQueue<String>(nullPriorityQueue);
}},
new F() { void f() {
new PriorityQueue<String>().add(null);
}},
new F() { void f() {
new PriorityBlockingQueue<String>().add(null);
}},
new F() { void f() {
new ArrayBlockingQueue<String>(10, false).add(null);
}},
new F() { void f() {
new ArrayBlockingQueue<String>(10, true).add(null);
}},
new F() { void f() {
new LinkedBlockingQueue<String>().add(null);
}},
new F() { void f() {
new LinkedBlockingDeque<String>().add(null);
}},
new F() { void f() {
new PriorityQueue<String>().offer(null);
}},
new F() { void f() {
new PriorityBlockingQueue<String>().offer(null);
}});
nullSortedSet.add("foo");
nullCollection.add("foo");
THROWS(NullPointerException.class,
new F() { void f() {
new PriorityQueue<String>(nullCollection);
}},
new F() { void f() {
new PriorityBlockingQueue<String>(nullCollection);
}},
new F() { void f() {
new PriorityQueue<String>((Collection<String>) nullPriorityQueue);
}},
new F() { void f() {
new PriorityBlockingQueue<String>((Collection<String>) nullPriorityQueue);
}},
new F() { void f() {
new PriorityQueue<String>(nullSortedSet);
}},
new F() { void f() {
new PriorityBlockingQueue<String>(nullSortedSet);
}},
new F() { void f() {
new PriorityQueue<String>((Collection<String>) nullSortedSet);
}},
new F() { void f() {
new PriorityBlockingQueue<String>((Collection<String>) nullSortedSet);
}});
}
//--------------------- Infrastructure ---------------------------
volatile int passed = 0, failed = 0;
void pass() {passed++;}
void fail() {failed++; Thread.dumpStack();}
void fail(String msg) {System.err.println(msg); fail();}
void unexpected(Throwable t) {failed++; t.printStackTrace();}
void check(boolean cond) {if (cond) pass(); else fail();}
void equal(Object x, Object y) {
if (x == null ? y == null : x.equals(y)) pass();
else fail(x + " not equal to " + y);}
public static void main(String[] args) throws Throwable {
new NoNulls().instanceMain(args);}
public void instanceMain(String[] args) throws Throwable {
try {test(args);} catch (Throwable t) {unexpected(t);}
System.out.printf("%nPassed = %d, failed = %d%n%n", passed, failed);
if (failed > 0) throw new AssertionError("Some tests failed");}
abstract class F {abstract void f() throws Throwable;}
void THROWS(Class<? extends Throwable> k, F... fs) {
for (F f : fs)
try {f.f(); fail("Expected " + k.getName() + " not thrown");}
catch (Throwable t) {
if (k.isAssignableFrom(t.getClass())) pass();
else unexpected(t);}}
}

View file

@ -0,0 +1,100 @@
/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* This file is available under and governed by the GNU General Public
* License version 2 only, as published by the Free Software Foundation.
* However, the following notice accompanied the original version of this
* file:
*
* Written by Doug Lea with assistance from members of JCP JSR-166
* Expert Group and released to the public domain, as explained at
* http://creativecommons.org/publicdomain/zero/1.0/
*/
/*
* @test
* @bug 4486658
* @summary Checks that a priority queue returns elements in sorted order across various operations
*/
import java.util.ArrayList;
import java.util.Collections;
import java.util.Comparator;
import java.util.Iterator;
import java.util.List;
import java.util.PriorityQueue;
import java.util.Queue;
public class PriorityQueueSort {
static class MyComparator implements Comparator<Integer> {
public int compare(Integer x, Integer y) {
return Integer.compare(x.intValue(), y.intValue());
}
}
public static void main(String[] args) {
int n = 10000;
if (args.length > 0)
n = Integer.parseInt(args[0]);
List<Integer> sorted = new ArrayList<>(n);
for (int i = 0; i < n; i++)
sorted.add(new Integer(i));
List<Integer> shuffled = new ArrayList<>(sorted);
Collections.shuffle(shuffled);
Queue<Integer> pq = new PriorityQueue<>(n, new MyComparator());
for (Iterator<Integer> i = shuffled.iterator(); i.hasNext(); )
pq.add(i.next());
List<Integer> recons = new ArrayList<>();
while (!pq.isEmpty())
recons.add(pq.remove());
if (!recons.equals(sorted))
throw new RuntimeException("Sort test failed");
recons.clear();
pq = new PriorityQueue<>(shuffled);
while (!pq.isEmpty())
recons.add(pq.remove());
if (!recons.equals(sorted))
throw new RuntimeException("Sort test failed");
// Remove all odd elements from queue
pq = new PriorityQueue<>(shuffled);
for (Iterator<Integer> i = pq.iterator(); i.hasNext(); )
if ((i.next().intValue() & 1) == 1)
i.remove();
recons.clear();
while (!pq.isEmpty())
recons.add(pq.remove());
for (Iterator<Integer> i = sorted.iterator(); i.hasNext(); )
if ((i.next().intValue() & 1) == 1)
i.remove();
if (!recons.equals(sorted))
throw new RuntimeException("Iterator remove test failed.");
}
}

View file

@ -0,0 +1,108 @@
/*
* Copyright (c) 2005, 2013, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 6207984 6268068
* @summary Test contains/remove equator compatibility
* @author Martin Buchholz
*/
import java.util.ArrayDeque;
import java.util.Arrays;
import java.util.Comparator;
import java.util.List;
import java.util.PriorityQueue;
import java.util.Queue;
import java.util.concurrent.ArrayBlockingQueue;
import java.util.concurrent.LinkedBlockingDeque;
import java.util.concurrent.LinkedBlockingQueue;
import java.util.concurrent.LinkedTransferQueue;
import java.util.concurrent.PriorityBlockingQueue;
public class RemoveContains {
static volatile int passed = 0, failed = 0;
static void fail(String msg) {
failed++;
new AssertionError(msg).printStackTrace();
}
static void pass() {
passed++;
}
static void unexpected(Throwable t) {
failed++;
t.printStackTrace();
}
static void check(boolean condition, String msg) {
if (condition)
passed++;
else
fail(msg);
}
static void check(boolean condition) {
check(condition, "Assertion failure");
}
public static void main(String[] args) {
final Comparator<String> firstChar = new Comparator<>() {
public int compare(String x, String y) {
return x.charAt(0) - y.charAt(0); }};
test(new PriorityQueue<String>(firstChar));
test(new PriorityQueue<String>(10, firstChar));
test(new PriorityBlockingQueue<String>(10, firstChar));
test(new ArrayBlockingQueue<String>(10));
test(new LinkedBlockingQueue<String>(10));
test(new LinkedBlockingDeque<String>(10));
test(new LinkedTransferQueue<String>());
test(new ArrayDeque<String>(10));
System.out.printf("%nPassed = %d, failed = %d%n%n", passed, failed);
if (failed > 0) throw new Error("Some tests failed");
}
private static void test(Queue<String> q) {
try {
List<String> words =
Arrays.asList("foo", "fee", "fi", "fo", "fum",
"Englishman");
q.addAll(words);
for (String word : words)
check(q.contains(word));
check(! q.contains("flurble"));
check(q.remove("fi"));
for (String word : words)
check(q.contains(word) ^ word.equals("fi"));
check(! q.remove("fi"));
check(! q.remove("flurble"));
} catch (Throwable t) { unexpected(t); }
}
}