undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions

View file

@ -0,0 +1,59 @@
/*
* Copyright (c) 2006, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4494762 6491939
* @summary Request for Clarification of JLS 15.12.2.2
* @author Peter von der Ahé
* @compile T4494762.java
*/
public class T4494762 {
static class Homer {
float doh(float f) {
System.out.println("doh(float)");
return 1.0f;
}
char doh(char c) {
System.out.println("doh(string)");
return 'd';
}
}
static class Bart extends Homer {
float doh(float f) {
System.out.println("doh(float)");
return 1.0f;
}
}
public static void main(String[] args) {
Bart b = new Bart();
b.doh('x');//compiler error in this line
b.doh(1);
b.doh(1.0f);
}
}

View file

@ -0,0 +1,49 @@
/*
* Copyright (c) 2002, 2003, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4723909 4758654 4839284
* @summary class methods do not conform to JLS 15.12.2.2 definition of most specific method
* @author gafter
*
* @compile T4723909.java
*/
class T4723909 {
static class Test {
public static void main(String[] args) {
new Subclass().test(0);
}
}
static class Superclass {
static void test(int i) {
System.out.println("test(int i)");
}
}
static class Subclass extends Superclass {
static void test(long l) {
System.out.println("test(long l)");
}
}
}

View file

@ -0,0 +1,24 @@
/*
* @test /nodynamiccopyright/
* @bug 4743490
* @summary overloading versus super.f(args) versus interfaces
* @author gafter
* @compile/fail/ref=T4743490.out -XDrawDiagnostics T4743490.java
*/
class T4743490 {
static class A {
public void m(Object o, String s) {}
}
interface B {
void m(String s, Object o);
}
static abstract class C extends A implements B {
}
static abstract class D extends C {
void foo() {
C c = null;
super.m("", ""); // should be ambiguous.
}
}
}

View file

@ -0,0 +1,2 @@
T4743490.java:21:18: compiler.err.ref.ambiguous: m, kindname.method, m(java.lang.String,java.lang.Object), T4743490.B, kindname.method, m(java.lang.Object,java.lang.String), T4743490.A
1 error

View file

@ -0,0 +1,18 @@
/*
* @test /nodynamiccopyright/
* @bug 5090220
* @summary Autoboxing applied when calculating most-specific method
* @compile/fail/ref=T5090220.out -XDrawDiagnostics T5090220.java
*/
class T5090220 {
static void foo(int i1, Integer i2) {
System.out.println("Integer");
}
static void foo(Integer i1, double d) {
System.out.println("double");
}
public static void meth() {
foo(5, 5);
}
}

View file

@ -0,0 +1,2 @@
T5090220.java:16:9: compiler.err.ref.ambiguous: foo, kindname.method, foo(int,java.lang.Integer), T5090220, kindname.method, foo(java.lang.Integer,double), T5090220
1 error

View file

@ -0,0 +1,42 @@
/*
* Copyright (c) 2008, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 6776289
* @summary Regression: javac7 doesnt resolve method calls properly
* @compile T6776289.java
*/
class A {
private void m(int a, int b) { }
}
class T6776289 {
static void m(int a, String s) { }
class B extends A {
public void test() {
m(1, "");
}
}
}

View file

@ -0,0 +1,42 @@
/*
* Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8176265
* @summary Method overload resolution on a covariant base type doesn't work in 9
* @compile T8176265.java
*/
class T8176265<T> {
static class Sup<E> { }
static class Sub<E> extends Sup<E> { }
void method(Sup<? super T> f) { }
void method(Sub<? super T> f) { }
static <Z> void m(T8176265<? extends Z> test, Sub<Z> sz) {
test.method(sz);
}
}