--- a/make/Makefile	Thu Feb 15 19:53:06 2018 +0000
+++ b/make/Makefile	Thu Mar 29 02:47:57 2018 +0100
@@ -136,6 +136,8 @@
 CLASSES_JAR = $(LIB_DIR)/classes.jar
 $(CLASSES_JAR):
 	$(MKDIR) -p $(@D)
+# Avoid including stubs of sun.misc.* classes; real versions are in jdk tree
+	$(RM) -r $(CLASSES_DIR)/sun/misc
 	$(BOOT_JAR_CMD) -cf $@ -C $(CLASSES_DIR) .
 
 #----- src.zip

--- a/src/share/classes/com/sun/corba/se/impl/ior/StubIORImpl.java	Thu Feb 15 19:53:06 2018 +0000
+++ b/src/share/classes/com/sun/corba/se/impl/ior/StubIORImpl.java	Thu Mar 29 02:47:57 2018 +0100
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2018, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -34,7 +34,6 @@
 import java.io.ObjectInputStream ;
 import java.io.ObjectOutputStream ;
 import java.io.IOException ;
-import java.io.StringWriter ;
 
 import org.omg.CORBA.ORB ;
 
@@ -47,6 +46,7 @@
 // other vendor's ORBs.
 import com.sun.corba.se.spi.presentation.rmi.StubAdapter ;
 import com.sun.corba.se.impl.orbutil.HexOutputStream ;
+import sun.corba.SharedSecrets;
 
 /**
  * This class implements a very simply IOR representation
@@ -125,14 +125,20 @@
     {
         // read the IOR from the ObjectInputStream
         int typeLength = stream.readInt();
+        SharedSecrets.getJavaOISAccess().checkArray(stream, byte[].class, typeLength);
         typeData = new byte[typeLength];
         stream.readFully(typeData);
+
         int numProfiles = stream.readInt();
+        SharedSecrets.getJavaOISAccess().checkArray(stream, int[].class, numProfiles);
+        SharedSecrets.getJavaOISAccess().checkArray(stream, byte[].class, numProfiles);
         profileTags = new int[numProfiles];
         profileData = new byte[numProfiles][];
         for (int i = 0; i < numProfiles; i++) {
             profileTags[i] = stream.readInt();
-            profileData[i] = new byte[stream.readInt()];
+            int dataSize = stream.readInt();
+            SharedSecrets.getJavaOISAccess().checkArray(stream, byte[].class, dataSize);
+            profileData[i] = new byte[dataSize];
             stream.readFully(profileData[i]);
         }
     }

--- a/src/share/classes/sun/corba/SharedSecrets.java	Thu Feb 15 19:53:06 2018 +0000
+++ b/src/share/classes/sun/corba/SharedSecrets.java	Thu Mar 29 02:47:57 2018 +0100
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -26,8 +26,10 @@
 package sun.corba;
 
 import com.sun.corba.se.impl.io.ValueUtility;
+import sun.misc.JavaOISAccess;
 import sun.misc.Unsafe;
 
+import java.io.ObjectInputStream;
 import java.security.AccessController;
 
 /** A repository of "shared secrets", which are a mechanism for
@@ -43,6 +45,7 @@
 public class SharedSecrets {
     private static final Unsafe unsafe = Unsafe.getUnsafe();
     private static JavaCorbaAccess javaCorbaAccess;
+    private static JavaOISAccess javaOISAccess;
 
     public static JavaCorbaAccess getJavaCorbaAccess() {
         if (javaCorbaAccess == null) {
@@ -57,4 +60,15 @@
         javaCorbaAccess = access;
     }
 
+    public static void setJavaOISAccess(JavaOISAccess access) {
+        javaOISAccess = access;
+    }
+
+    public static JavaOISAccess getJavaOISAccess() {
+        if (javaOISAccess == null)
+            unsafe.ensureClassInitialized(ObjectInputStream.class);
+
+        return javaOISAccess;
+    }
+
 }

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/share/classes/sun/misc/JavaOISAccess.java	Thu Mar 29 02:47:57 2018 +0100
@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package sun.misc;
+
+import java.io.InvalidClassException;
+import java.io.ObjectInputStream;
+
+/*
+ * Skeleton interface added so com.sun.corba.se.impl.ior.StubIORImpl will compile.
+ * JDK implementation will be used at runtime.
+ */
+public interface JavaOISAccess {
+    void setObjectInputFilter(ObjectInputStream stream, ObjectInputFilter filter);
+    ObjectInputFilter getObjectInputFilter(ObjectInputStream stream);
+    void checkArray(ObjectInputStream stream, Class<?> arrayType, int arrayLength)
+        throws InvalidClassException;
+}

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/share/classes/sun/misc/ObjectInputFilter.java	Thu Mar 29 02:47:57 2018 +0100
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package sun.misc;
+
+import java.io.InvalidClassException;
+import java.io.ObjectInputStream;
+
+/*
+ * Skeleton interface added so com.sun.corba.se.impl.ior.StubIORImpl will compile.
+ * JDK implementation will be used at runtime.
+ */
+public interface ObjectInputFilter {
+}