engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undefect. CWE-407 — 63 sites patched across 27 ecosystems

Browse source 
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

70
test/jdk/sun/awt/image/OffScreenImageSource/ImageConsumerUnregisterTest.java Normal file
View file

@ -0,0 +1,70 @@
/*
* Copyright (c) 2016, 2017, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* @test
* @key headful
* @bug 8160421 8161902
* @summary Test to check OffScreenImageSource handles case where
* imageComplete(ImageConsumer.SINGLEFRAMEDONE) unregisters.
* @run main/othervm ImageConsumerUnregisterTest
*/
import java.io.ByteArrayOutputStream;
import java.io.PrintStream;
public class ImageConsumerUnregisterTest extends javax.swing.JFrame {
public static void main(String[] args) throws Exception {
final java.awt.Component component = new ImageConsumerUnregisterTest();
// Redirect the System.err stream and verify there is no
// stacktrace printed
ByteArrayOutputStream rs = new ByteArrayOutputStream();
PrintStream obj = System.err;
System.setErr(new PrintStream(rs));
String str = "";
try {
// Test call
component.getToolkit().createCustomCursor(
component.getGraphicsConfiguration().createCompatibleImage(
16, 16, java.awt.Transparency.BITMASK),
new java.awt.Point(0, 0), "Hidden");
// Convert the redirected System.err contents to a string
str = rs.toString();
} finally {
// Reset System.err
System.setErr(obj);
if (!str.isEmpty()) {
throw new RuntimeException("Invalid"
+ " imageComplete(STATICIMAGEDONE) call");
}
}
}
}

136
test/jdk/sun/awt/image/OffScreenImageSource/ImageFilterTest.java Normal file
View file

@ -0,0 +1,136 @@
/*
* Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
* @bug 8139192
* @summary Test to check OffScreenImageSource handles
* ImageFilter.imageComplete() behaviors
* @run main ImageFilterTest
*/
import java.awt.Image;
import java.awt.Toolkit;
import java.awt.image.BufferedImage;
import java.awt.image.FilteredImageSource;
import java.awt.image.ImageFilter;
public class ImageFilterTest {
public static void main(String[] args) {
String[] scenarios = {
"SUCCESS",
"SINGLEFRAMEDONE exception",
"STATICIMAGEDONE exception"
};
for (String str : scenarios) {
MyImageFilter testFilter = new MyImageFilter(str);
test(testFilter);
}
}
public static void test(MyImageFilter testFilter) {
Image image = new BufferedImage(10, 10, BufferedImage.TYPE_INT_ARGB);
FilteredImageSource filtered =
new FilteredImageSource(image.getSource(), testFilter);
Image img = Toolkit.getDefaultToolkit().createImage(filtered);
BufferedImage buffImage = new BufferedImage(img.getWidth(null),
img.getHeight(null), BufferedImage.TYPE_INT_ARGB);
}
}
class MyImageFilter extends ImageFilter {
private String testScenario;
private boolean intermediateStatus;
public MyImageFilter(String scenario) {
super();
testScenario = scenario;
intermediateStatus = false;
}
@Override
public void imageComplete(int status) {
switch (testScenario) {
case "SUCCESS":
if (status == SINGLEFRAMEDONE) {
intermediateStatus = true;
}
if (status == STATICIMAGEDONE) {
if (!intermediateStatus) {
throw new RuntimeException("STATICIMAGEDONE is not expected");
}
}
if (status == IMAGEERROR) {
throw new RuntimeException("IMAGEERROR is not expected");
}
break;
case "SINGLEFRAMEDONE exception":
if (status == SINGLEFRAMEDONE) {
intermediateStatus = true;
throw new NullPointerException("NullPointerException for testing purpose");
}
if (status == IMAGEERROR) {
if (!intermediateStatus) {
throw new RuntimeException("IMAGEERROR is not expected");
}
}
if (status == STATICIMAGEDONE) {
throw new RuntimeException("STATICIMAGEDONE is not expected");
}
break;
case "STATICIMAGEDONE exception":
if (status == SINGLEFRAMEDONE) {
intermediateStatus = true;
}
if (status == STATICIMAGEDONE) {
if (intermediateStatus) {
throw new RuntimeException("RuntimeException for testing purpose");
}
}
if (status == IMAGEERROR) {
throw new RuntimeException("IMAGEERROR is not expected");
}
break;
default:
throw new RuntimeException("Invalid Test Scenario");
}
}
}

52
test/jdk/sun/awt/image/OffScreenImageSource/bug4200096/AddNullConsumerTest.java Normal file
View file

@ -0,0 +1,52 @@
/*
* Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.awt.image.BufferedImage;
/**
* @test
* @bug 4200096
* @summary OffScreenImageSource.addConsumer(null) shouldn't throw (or print) a NullPointerException
* @author Jeremy Wood
*/
/**
* This makes sure if OffScreenImageSource#addConsumer(null) is called: we
* treat that as a no-op and return immediately.
* <p>
* This test exists primarily to make sure the resolution to 4200096 does not
* significantly change legacy behavior. Whether or not a NPE is printed to
* System.err is not a hotly contested question, but at one point one of the
* proposed (and rejected) resolutions to 4200096 had the potential to
* throw a NPE when addConsumer(null) was called. That would be a
* significant change that we want to avoid.
* </p>
*/
public class AddNullConsumerTest {
public static void main(String[] args) throws Exception {
try (AutoCloseable setup = bug4200096.setupTest(false)) {
BufferedImage bufferedImage = new BufferedImage(1, 1, BufferedImage.TYPE_INT_ARGB);
bufferedImage.getSource().addConsumer(null);
}
}
}

88
test/jdk/sun/awt/image/OffScreenImageSource/bug4200096/ImageSizeTest.java Normal file
View file

@ -0,0 +1,88 @@
/*
* Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.awt.Image;
import java.awt.image.BufferedImage;
import java.awt.image.ImageObserver;
/**
* @test
* @bug 4200096
* @summary this real-world example detaches an ImageConsumer from an OSIS immediately after it learns the dimensions.
* @author Jeremy Wood
*/
/**
* This adds an ImageObserver that is only interested in identifying the dimensions of an ImageProducer.
* <p>
* Once it has the dimensions: {@link java.awt.image.ImageObserver#imageUpdate(Image, int, int, int, int, int)}
* returns false. This triggers the caller to remove the ImageObserver for us. And removing an ImageObserver
* while an OffScreenImageSource is mid-production triggers the NPE that is JDK-4200096.
* <p>
* The expected behavior is for this method to complete without OffScreenImageSource throwing/catching a NPE.
* <p>
* What's interesting about this test is: we never even explicitly call {@link java.awt.image.ImageProducer#addConsumer(ImageConsumer)}
* or {@link java.awt.image.ImageProducer#removeConsumer(ImageConsumer)} (ImageConsumer)}.
* </p>
*/
public class ImageSizeTest {
public static void main(String[] args) throws Exception {
try (AutoCloseable setup = bug4200096.setupTest(false)) {
Image img = createAbstractImage();
ImageObserver observer = new ImageObserver() {
Integer imageWidth, imageHeight;
@Override
public boolean imageUpdate(Image img, int infoflags, int x, int y, int width, int height) {
if ( (infoflags | ImageObserver.WIDTH) > 0) {
imageWidth = width;
}
if ( (infoflags | ImageObserver.HEIGHT) > 0) {
imageHeight = height;
}
if (imageWidth != null || imageHeight != null)
return false;
return true;
}
};
img.getWidth(observer);
}
}
/**
* This creates a ToolkitImage, so it is not a BufferedImage.
* <p>
* This specific implementation happens to rely on scaling an existing
* BufferedImage, because that seemed like an easy way to avoid bundling a
* JPG/PNG with this unit test. But this return value still happens to be
* a ToolkitImage, which is what a JPG/PNG would also be (when loaded
* via the Toolkit class and not ImageIO).
* </p>
*/
private static Image createAbstractImage() {
BufferedImage bufferedImage = new BufferedImage(1, 1, BufferedImage.TYPE_INT_ARGB);
Image img = bufferedImage.getScaledInstance(2, 2, Image.SCALE_SMOOTH);
return img;
}
}

91
test/jdk/sun/awt/image/OffScreenImageSource/bug4200096/LegitimateNullPointerTest.java Normal file
View file

@ -0,0 +1,91 @@
/*
* Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.awt.image.BufferedImage;
import java.awt.image.ColorModel;
import java.awt.image.ImageConsumer;
import java.util.Hashtable;
/**
* @test
* @bug 4200096
* @summary This makes sure NPE's that come from the ImageConsumer are still printed to System.err
* @author Jeremy Wood
*/
/**
* This test makes sure that if an ImageConsumer throws a NullPointerException: that NPE
* should be printed to System.err.
* <p>
* Most of the discussion around JDK-4200096 focuses on how we handle NPE's that come from
* OffScreenImageSource itself, but this test checks how we handle NPE's that come from
* the ImageConsumer that's listening to an OffScreenImageSource.
* </p>
* <p>
* This test is enforcing a legacy behavior.
* </p>
*/
public class LegitimateNullPointerTest {
public static void main(String[] args) throws Exception {
try (AutoCloseable setup = bug4200096.setupTest(true)) {
BufferedImage bufferedImage = new BufferedImage(10, 10, BufferedImage.TYPE_INT_ARGB);
bufferedImage.getSource().addConsumer(new ImageConsumer() {
@Override
public void setDimensions(int width, int height) {
throw new NullPointerException();
}
@Override
public void setProperties(Hashtable<?, ?> props) {
// intentionally empty
}
@Override
public void setColorModel(ColorModel model) {
// intentionally empty
}
@Override
public void setHints(int hintflags) {
// intentionally empty
}
@Override
public void setPixels(int x, int y, int w, int h, ColorModel model, byte[] pixels, int off, int scansize) {
// intentionally empty
}
@Override
public void setPixels(int x, int y, int w, int h, ColorModel model, int[] pixels, int off, int scansize) {
// intentionally empty
}
@Override
public void imageComplete(int status) {
// intentionally empty
}
});
}
}
}

158
test/jdk/sun/awt/image/OffScreenImageSource/bug4200096/bug4200096.java Normal file
View file

@ -0,0 +1,158 @@
/*
* Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.awt.Image;
import java.awt.image.BufferedImage;
import java.awt.image.ColorModel;
import java.awt.image.ImageConsumer;
import java.io.PrintStream;
import java.lang.AutoCloseable;
import java.lang.AutoCloseable;
import java.util.Hashtable;
/**
* @test
* @bug 4200096
* @summary if an ImageConsumer detaches from OffScreenImageSource mid-production: we shouldn't print a NPE to System.err
* @author Jeremy Wood
*/
/**
* This detaches an ImageConsumer at different points and checks to see if a
* NullPointerException is thrown by the OffScreenImageSource as a result.
*/
public class bug4200096 {
/**
* This hijacks System.err so we can detect if a NullPointerException is printed to it.
* <p>
* When this AutoCloseable is closed: we throw an exception based on whether we observed
* a NPE vs whether a NPE is expected or not.
* </p>
*
* @param expectPrintedNPE this is consulted when {@link java.lang.AutoCloseable#close()} is called,
* and if the expectation doesn't match what happened then a RuntimeException is thrown.
* @return an AutoCloseable that restores System.err and tests whether a NPE was observed or not.
*/
public static AutoCloseable setupTest(boolean expectPrintedNPE) {
NullPointerException[] wrapper = new NullPointerException[] { null };
PrintStream origErr = System.err;
System.setErr(new PrintStream(origErr) {
@Override
public void println(Object x) {
super.println(x);
if (x instanceof NullPointerException e)
wrapper[0] = e;
}
});
return new AutoCloseable() {
@Override
public void close() {
System.setErr(origErr);
if (expectPrintedNPE) {
if (wrapper[0] == null)
throw new RuntimeException("This test expected a NullPointerException to be printed to System.err, but that didn't happen.");
} else {
if (wrapper[0] != null)
throw new RuntimeException("This test expected no NullPointerExceptions to be printed to System.err, but (at least) one was.)");
}
}
};
}
/**
* This enumerates the different notifications that OffScreenImageSource issues.
* <p>
* There is no SET_HINTS because (as of this writing) OSIS doesn't call setHints(int).
* </p>
*/
public enum TestCase {
SET_DIMENSIONS, SET_PROPERTIES, SET_COLOR_MODEL, SET_PIXELS, IMAGE_COMPLETE
}
public static void main(String[] args) throws Exception {
try (AutoCloseable setup = setupTest(false)) {
for (TestCase testCase : TestCase.values()) {
BufferedImage bufferedImage = new BufferedImage(10, 10, BufferedImage.TYPE_INT_ARGB);
if (!"sun.awt.image.OffScreenImageSource".equals(
bufferedImage.getSource().getClass().getName())) {
throw new IllegalStateException("If BufferedImage#getSource() is not an OffScreenImageSource: that isn't necessarily a problem, but it invalidates the usefulness of this test.");
}
ImageConsumer consumer = new ImageConsumer() {
private void run(TestCase methodInvocation) {
if (!bufferedImage.getSource().isConsumer(this))
throw new IllegalStateException();
if (testCase == methodInvocation)
bufferedImage.getSource().removeConsumer(this);
}
@Override
public void setDimensions(int width, int height) {
run(TestCase.SET_DIMENSIONS);
}
@Override
public void setProperties(Hashtable<?, ?> props) {
run(TestCase.SET_PROPERTIES);
}
@Override
public void setColorModel(ColorModel model) {
run(TestCase.SET_COLOR_MODEL);
}
@Override
public void setHints(int hintflags) {
// intentionally empty.
}
@Override
public void setPixels(int x, int y, int w, int h, ColorModel model, byte[] pixels, int off, int scansize) {
throw new UnsupportedOperationException("this test should use int[] pixels");
}
@Override
public void setPixels(int x, int y, int w, int h, ColorModel model, int[] pixels, int off, int scansize) {
if (y == 5) {
run(TestCase.SET_PIXELS);
}
}
@Override
public void imageComplete(int status) {
run(TestCase.IMAGE_COMPLETE);
}
};
bufferedImage.getSource().startProduction(consumer);
if (bufferedImage.getSource().isConsumer(consumer)) {
// this confirms our calls to .removeConsumer above were being invoked as expected
throw new IllegalStateException("This test is not executing as expected.");
}
}
}
}
}