undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions

View file

@ -0,0 +1,133 @@
/*
* Copyright (c) 1998, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4109894 4239646 4785453
* @summary Verify that class modifiers bits written into class
* file are correct, including those within InnerClasses attributes.
* @author John Rose (jrose). Entered as a regression test by Bill Maddox (maddox).
*
* @compile/ref=ClassModifiers.out --debug=dumpmodifiers=ci ClassModifiers.java
*
*/
class T {
//all "protected" type members are transformed to "public"
//all "private" type members are transformed to package-scope
//all "static" type members are transformed to non-static
//a class is one of {,public,private,protected}x{,static}x{,abstract,final}
//all of these 24 combinations are legal
//all of these 24 combinations generate distinct InnerClasses modifiers
//transformed class modifiers can be {,public}x{,abstract,final}
//thus, each of the next 6 groups of 4 have identical transformed modifiers
class iC{}
static class iSC{}
private class iVC{}
static private class iSVC{}
final class iFC{}
static final class iSFC{}
final private class iFVC{}
static final private class iSFVC{}
abstract class iAC{}
static abstract class iSAC{}
abstract private class iAVC{}
static abstract private class iSAVC{}
protected class iRC{}
static protected class iSRC{}
public class iUC{}
static public class iSUC{}
final protected class iFRC{}
static final protected class iSFRC{}
final public class iFUC{}
static final public class iSFUC{}
abstract protected class iARC{}
static abstract protected class iSARC{}
abstract public class iAUC{}
static abstract public class iSAUC{}
//all interface members are automatically "static" whether marked so or not
//all interfaces are automatically "abstract" whether marked so or not
//thus, interface modifiers are only distinguished by access permissions
//thus, each of the next 4 groups of 4 classes have identical modifiers
interface iI{}
static interface iSI{}
abstract interface iAI{}
static abstract interface iSAI{}
protected interface iRI{}
static protected interface iSRI{}
abstract protected interface iARI{}
static abstract protected interface iSARI{}
private interface iVI{}
static private interface iSVI{}
abstract private interface iAVI{}
static abstract private interface iSAVI{}
public interface iUI{}
static public interface iSUI{}
abstract public interface iAUI{}
static abstract public interface iSAUI{}
}
interface U {
//no members can be "protected" or "private"
//all type members are automatically "public" whether marked so or not
//all type members are automatically "static" whether marked so or not
//thus, each of the next 3 groups of 4 classes have identical modifiers
class jC{}
static class jSC{}
public class jUC{}
static public class jSUC{}
final class jFC{}
static final class jSFC{}
final public class jFUC{}
static final public class jSFUC{}
abstract class jAC{}
static abstract class jSAC{}
abstract public class jAUC{}
static abstract public class jSAUC{}
//all interface members are automatically "static" whether marked so or not
//all interfaces are automatically "abstract" whether marked so or not
//thus, all 8 of the following classes have identical modifiers:
interface jI{}
static interface jSI{}
abstract interface jAI{}
static abstract interface jSAI{}
public interface jUI{}
static public interface jSUI{}
abstract public interface jAUI{}
static abstract public interface jSAUI{}
}

View file

@ -0,0 +1,426 @@
CLASSFILE T.iC
--- SUPER
INNERCLASS iC
---
CLASSFILE T.iSC
--- SUPER
INNERCLASS iSC
--- STATIC
CLASSFILE T.iVC
--- SUPER
INNERCLASS iVC
--- PRIVATE
CLASSFILE T.iSVC
--- SUPER
INNERCLASS iSVC
--- PRIVATE STATIC
CLASSFILE T.iFC
--- FINAL SUPER
INNERCLASS iFC
--- FINAL
CLASSFILE T.iSFC
--- FINAL SUPER
INNERCLASS iSFC
--- STATIC FINAL
CLASSFILE T.iFVC
--- FINAL SUPER
INNERCLASS iFVC
--- PRIVATE FINAL
CLASSFILE T.iSFVC
--- FINAL SUPER
INNERCLASS iSFVC
--- PRIVATE STATIC FINAL
CLASSFILE T.iAC
--- SUPER ABSTRACT
INNERCLASS iAC
--- ABSTRACT
CLASSFILE T.iSAC
--- SUPER ABSTRACT
INNERCLASS iSAC
--- STATIC ABSTRACT
CLASSFILE T.iAVC
--- SUPER ABSTRACT
INNERCLASS iAVC
--- PRIVATE ABSTRACT
CLASSFILE T.iSAVC
--- SUPER ABSTRACT
INNERCLASS iSAVC
--- PRIVATE STATIC ABSTRACT
CLASSFILE T.iRC
--- PUBLIC SUPER
INNERCLASS iRC
--- PROTECTED
CLASSFILE T.iSRC
--- PUBLIC SUPER
INNERCLASS iSRC
--- PROTECTED STATIC
CLASSFILE T.iUC
--- PUBLIC SUPER
INNERCLASS iUC
--- PUBLIC
CLASSFILE T.iSUC
--- PUBLIC SUPER
INNERCLASS iSUC
--- PUBLIC STATIC
CLASSFILE T.iFRC
--- PUBLIC FINAL SUPER
INNERCLASS iFRC
--- PROTECTED FINAL
CLASSFILE T.iSFRC
--- PUBLIC FINAL SUPER
INNERCLASS iSFRC
--- PROTECTED STATIC FINAL
CLASSFILE T.iFUC
--- PUBLIC FINAL SUPER
INNERCLASS iFUC
--- PUBLIC FINAL
CLASSFILE T.iSFUC
--- PUBLIC FINAL SUPER
INNERCLASS iSFUC
--- PUBLIC STATIC FINAL
CLASSFILE T.iARC
--- PUBLIC SUPER ABSTRACT
INNERCLASS iARC
--- PROTECTED ABSTRACT
CLASSFILE T.iSARC
--- PUBLIC SUPER ABSTRACT
INNERCLASS iSARC
--- PROTECTED STATIC ABSTRACT
CLASSFILE T.iAUC
--- PUBLIC SUPER ABSTRACT
INNERCLASS iAUC
--- PUBLIC ABSTRACT
CLASSFILE T.iSAUC
--- PUBLIC SUPER ABSTRACT
INNERCLASS iSAUC
--- PUBLIC STATIC ABSTRACT
CLASSFILE T.iI
--- INTERFACE ABSTRACT
INNERCLASS iI
--- STATIC INTERFACE ABSTRACT
CLASSFILE T.iSI
--- INTERFACE ABSTRACT
INNERCLASS iSI
--- STATIC INTERFACE ABSTRACT
CLASSFILE T.iAI
--- INTERFACE ABSTRACT
INNERCLASS iAI
--- STATIC INTERFACE ABSTRACT
CLASSFILE T.iSAI
--- INTERFACE ABSTRACT
INNERCLASS iSAI
--- STATIC INTERFACE ABSTRACT
CLASSFILE T.iRI
--- PUBLIC INTERFACE ABSTRACT
INNERCLASS iRI
--- PROTECTED STATIC INTERFACE ABSTRACT
CLASSFILE T.iSRI
--- PUBLIC INTERFACE ABSTRACT
INNERCLASS iSRI
--- PROTECTED STATIC INTERFACE ABSTRACT
CLASSFILE T.iARI
--- PUBLIC INTERFACE ABSTRACT
INNERCLASS iARI
--- PROTECTED STATIC INTERFACE ABSTRACT
CLASSFILE T.iSARI
--- PUBLIC INTERFACE ABSTRACT
INNERCLASS iSARI
--- PROTECTED STATIC INTERFACE ABSTRACT
CLASSFILE T.iVI
--- INTERFACE ABSTRACT
INNERCLASS iVI
--- PRIVATE STATIC INTERFACE ABSTRACT
CLASSFILE T.iSVI
--- INTERFACE ABSTRACT
INNERCLASS iSVI
--- PRIVATE STATIC INTERFACE ABSTRACT
CLASSFILE T.iAVI
--- INTERFACE ABSTRACT
INNERCLASS iAVI
--- PRIVATE STATIC INTERFACE ABSTRACT
CLASSFILE T.iSAVI
--- INTERFACE ABSTRACT
INNERCLASS iSAVI
--- PRIVATE STATIC INTERFACE ABSTRACT
CLASSFILE T.iUI
--- PUBLIC INTERFACE ABSTRACT
INNERCLASS iUI
--- PUBLIC STATIC INTERFACE ABSTRACT
CLASSFILE T.iSUI
--- PUBLIC INTERFACE ABSTRACT
INNERCLASS iSUI
--- PUBLIC STATIC INTERFACE ABSTRACT
CLASSFILE T.iAUI
--- PUBLIC INTERFACE ABSTRACT
INNERCLASS iAUI
--- PUBLIC STATIC INTERFACE ABSTRACT
CLASSFILE T.iSAUI
--- PUBLIC INTERFACE ABSTRACT
INNERCLASS iSAUI
--- PUBLIC STATIC INTERFACE ABSTRACT
CLASSFILE T
--- SUPER
INNERCLASS iSAUI
--- PUBLIC STATIC INTERFACE ABSTRACT
INNERCLASS iAUI
--- PUBLIC STATIC INTERFACE ABSTRACT
INNERCLASS iSUI
--- PUBLIC STATIC INTERFACE ABSTRACT
INNERCLASS iUI
--- PUBLIC STATIC INTERFACE ABSTRACT
INNERCLASS iSAVI
--- PRIVATE STATIC INTERFACE ABSTRACT
INNERCLASS iAVI
--- PRIVATE STATIC INTERFACE ABSTRACT
INNERCLASS iSVI
--- PRIVATE STATIC INTERFACE ABSTRACT
INNERCLASS iVI
--- PRIVATE STATIC INTERFACE ABSTRACT
INNERCLASS iSARI
--- PROTECTED STATIC INTERFACE ABSTRACT
INNERCLASS iARI
--- PROTECTED STATIC INTERFACE ABSTRACT
INNERCLASS iSRI
--- PROTECTED STATIC INTERFACE ABSTRACT
INNERCLASS iRI
--- PROTECTED STATIC INTERFACE ABSTRACT
INNERCLASS iSAI
--- STATIC INTERFACE ABSTRACT
INNERCLASS iAI
--- STATIC INTERFACE ABSTRACT
INNERCLASS iSI
--- STATIC INTERFACE ABSTRACT
INNERCLASS iI
--- STATIC INTERFACE ABSTRACT
INNERCLASS iSAUC
--- PUBLIC STATIC ABSTRACT
INNERCLASS iAUC
--- PUBLIC ABSTRACT
INNERCLASS iSARC
--- PROTECTED STATIC ABSTRACT
INNERCLASS iARC
--- PROTECTED ABSTRACT
INNERCLASS iSFUC
--- PUBLIC STATIC FINAL
INNERCLASS iFUC
--- PUBLIC FINAL
INNERCLASS iSFRC
--- PROTECTED STATIC FINAL
INNERCLASS iFRC
--- PROTECTED FINAL
INNERCLASS iSUC
--- PUBLIC STATIC
INNERCLASS iUC
--- PUBLIC
INNERCLASS iSRC
--- PROTECTED STATIC
INNERCLASS iRC
--- PROTECTED
INNERCLASS iSAVC
--- PRIVATE STATIC ABSTRACT
INNERCLASS iAVC
--- PRIVATE ABSTRACT
INNERCLASS iSAC
--- STATIC ABSTRACT
INNERCLASS iAC
--- ABSTRACT
INNERCLASS iSFVC
--- PRIVATE STATIC FINAL
INNERCLASS iFVC
--- PRIVATE FINAL
INNERCLASS iSFC
--- STATIC FINAL
INNERCLASS iFC
--- FINAL
INNERCLASS iSVC
--- PRIVATE STATIC
INNERCLASS iVC
--- PRIVATE
INNERCLASS iSC
--- STATIC
INNERCLASS iC
---
CLASSFILE U.jC
--- PUBLIC SUPER
INNERCLASS jC
--- PUBLIC STATIC
CLASSFILE U.jSC
--- PUBLIC SUPER
INNERCLASS jSC
--- PUBLIC STATIC
CLASSFILE U.jUC
--- PUBLIC SUPER
INNERCLASS jUC
--- PUBLIC STATIC
CLASSFILE U.jSUC
--- PUBLIC SUPER
INNERCLASS jSUC
--- PUBLIC STATIC
CLASSFILE U.jFC
--- PUBLIC FINAL SUPER
INNERCLASS jFC
--- PUBLIC STATIC FINAL
CLASSFILE U.jSFC
--- PUBLIC FINAL SUPER
INNERCLASS jSFC
--- PUBLIC STATIC FINAL
CLASSFILE U.jFUC
--- PUBLIC FINAL SUPER
INNERCLASS jFUC
--- PUBLIC STATIC FINAL
CLASSFILE U.jSFUC
--- PUBLIC FINAL SUPER
INNERCLASS jSFUC
--- PUBLIC STATIC FINAL
CLASSFILE U.jAC
--- PUBLIC SUPER ABSTRACT
INNERCLASS jAC
--- PUBLIC STATIC ABSTRACT
CLASSFILE U.jSAC
--- PUBLIC SUPER ABSTRACT
INNERCLASS jSAC
--- PUBLIC STATIC ABSTRACT
CLASSFILE U.jAUC
--- PUBLIC SUPER ABSTRACT
INNERCLASS jAUC
--- PUBLIC STATIC ABSTRACT
CLASSFILE U.jSAUC
--- PUBLIC SUPER ABSTRACT
INNERCLASS jSAUC
--- PUBLIC STATIC ABSTRACT
CLASSFILE U.jI
--- PUBLIC INTERFACE ABSTRACT
INNERCLASS jI
--- PUBLIC STATIC INTERFACE ABSTRACT
CLASSFILE U.jSI
--- PUBLIC INTERFACE ABSTRACT
INNERCLASS jSI
--- PUBLIC STATIC INTERFACE ABSTRACT
CLASSFILE U.jAI
--- PUBLIC INTERFACE ABSTRACT
INNERCLASS jAI
--- PUBLIC STATIC INTERFACE ABSTRACT
CLASSFILE U.jSAI
--- PUBLIC INTERFACE ABSTRACT
INNERCLASS jSAI
--- PUBLIC STATIC INTERFACE ABSTRACT
CLASSFILE U.jUI
--- PUBLIC INTERFACE ABSTRACT
INNERCLASS jUI
--- PUBLIC STATIC INTERFACE ABSTRACT
CLASSFILE U.jSUI
--- PUBLIC INTERFACE ABSTRACT
INNERCLASS jSUI
--- PUBLIC STATIC INTERFACE ABSTRACT
CLASSFILE U.jAUI
--- PUBLIC INTERFACE ABSTRACT
INNERCLASS jAUI
--- PUBLIC STATIC INTERFACE ABSTRACT
CLASSFILE U.jSAUI
--- PUBLIC INTERFACE ABSTRACT
INNERCLASS jSAUI
--- PUBLIC STATIC INTERFACE ABSTRACT
CLASSFILE U
--- INTERFACE ABSTRACT
INNERCLASS jSAUI
--- PUBLIC STATIC INTERFACE ABSTRACT
INNERCLASS jAUI
--- PUBLIC STATIC INTERFACE ABSTRACT
INNERCLASS jSUI
--- PUBLIC STATIC INTERFACE ABSTRACT
INNERCLASS jUI
--- PUBLIC STATIC INTERFACE ABSTRACT
INNERCLASS jSAI
--- PUBLIC STATIC INTERFACE ABSTRACT
INNERCLASS jAI
--- PUBLIC STATIC INTERFACE ABSTRACT
INNERCLASS jSI
--- PUBLIC STATIC INTERFACE ABSTRACT
INNERCLASS jI
--- PUBLIC STATIC INTERFACE ABSTRACT
INNERCLASS jSAUC
--- PUBLIC STATIC ABSTRACT
INNERCLASS jAUC
--- PUBLIC STATIC ABSTRACT
INNERCLASS jSAC
--- PUBLIC STATIC ABSTRACT
INNERCLASS jAC
--- PUBLIC STATIC ABSTRACT
INNERCLASS jSFUC
--- PUBLIC STATIC FINAL
INNERCLASS jFUC
--- PUBLIC STATIC FINAL
INNERCLASS jSFC
--- PUBLIC STATIC FINAL
INNERCLASS jFC
--- PUBLIC STATIC FINAL
INNERCLASS jSUC
--- PUBLIC STATIC
INNERCLASS jUC
--- PUBLIC STATIC
INNERCLASS jSC
--- PUBLIC STATIC
INNERCLASS jC
--- PUBLIC STATIC

View file

@ -0,0 +1,60 @@
/*
* Copyright (c) 1999, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4249112 4785453
* @summary Verify that implicit member modifiers are set correctly.
*
* @compile/ref=MemberModifiers.out --debug=dumpmodifiers=cfm MemberModifiers.java
*/
// Currently, we check only that members of final classes are not final.
// Originally, we tested that methods were final, per the fix for 4249112.
// This fix was backed out, however, based on a determination that the
// ACC_FINAL bit need not actually be set, and should not be for compatibility
// reasons.
public final class MemberModifiers {
//Should not be final.
int f;
void m() {};
class c {};
interface i {}
}
class MemberModifiersAux {
final class Foo {
//Should not be final.
int f;
void m() {};
class c {};
}
}

View file

@ -0,0 +1,36 @@
CLASSFILE MemberModifiers.c
--- SUPER
METHOD <init>
---
CLASSFILE MemberModifiers.i
--- INTERFACE ABSTRACT
CLASSFILE MemberModifiers
--- PUBLIC FINAL SUPER
FIELD f
---
METHOD <init>
--- PUBLIC
METHOD m
---
CLASSFILE MemberModifiersAux.Foo.c
--- SUPER
METHOD <init>
---
CLASSFILE MemberModifiersAux.Foo
--- FINAL SUPER
FIELD f
---
METHOD <init>
---
METHOD m
---
CLASSFILE MemberModifiersAux
--- SUPER
METHOD <init>
---