Mercurial > hg > release > icedtea6-1.10
changeset 2555:4e7a700d4ecc
Add 2012/02/14 security patches.
2012-02-08 Omair Majid <omajid@redhat.com>
* NEWS: Update with security fixes.
* Makefile.am
(SECURITY_PATCHES): Add security patches.
(SPECIAL_SECURITY_PATCH): Add new variable.
(ICEDTEA_PATCHES): Add security patch that epends on backport.
* patches/security/20120214/7082299.patch,
* patches/security/20120214/7088367.patch,
* patches/security/20120214/7110683.patch,
* patches/security/20120214/7110687.patch,
* patches/security/20120214/7110700.patch,
* patches/security/20120214/7110704.patch,
* patches/security/20120214/7112642.patch,
* patches/security/20120214/7118283.patch,
* patches/security/20120214/7126960.patch: New security fixes.
| author | Andrew John Hughes <ahughes@redhat.com> |
|---|---|
| date | Thu, 09 Feb 2012 17:05:26 +0000 |
| parents | 4dc8a468dbc0 |
| children | 9b7bac9bc49d |
| files | ChangeLog Makefile.am NEWS patches/security/20120214/7082299.patch patches/security/20120214/7088367.patch patches/security/20120214/7110683.patch patches/security/20120214/7110687.patch patches/security/20120214/7110700.patch patches/security/20120214/7110704.patch patches/security/20120214/7112642.patch patches/security/20120214/7118283.patch patches/security/20120214/7126960.patch |
| diffstat | 12 files changed, 1657 insertions(+), 2 deletions(-) [+] |
line wrap: on
line diff
--- a/ChangeLog Thu Feb 09 12:45:55 2012 +0000 +++ b/ChangeLog Thu Feb 09 17:05:26 2012 +0000 @@ -1,3 +1,20 @@ +2012-02-08 Omair Majid <omajid@redhat.com> + + * NEWS: Update with security fixes. + * Makefile.am + (SECURITY_PATCHES): Add security patches. + (SPECIAL_SECURITY_PATCH): Add new variable. + (ICEDTEA_PATCHES): Add security patch that epends on backport. + * patches/security/20120214/7082299.patch, + * patches/security/20120214/7088367.patch, + * patches/security/20120214/7110683.patch, + * patches/security/20120214/7110687.patch, + * patches/security/20120214/7110700.patch, + * patches/security/20120214/7110704.patch, + * patches/security/20120214/7112642.patch, + * patches/security/20120214/7118283.patch, + * patches/security/20120214/7126960.patch: New security fixes. + 2012-02-09 Andrew John Hughes <ahughes@redhat.com> * NEWS: Mention RH580478. @@ -12,7 +29,7 @@ to be substituted during configure * policytool.desktop: removed, replaced by policytool.desktop.in * policytool.desktop.in: new file, stub for desktop file, have variable - to be substituted during configure + to be substituted during configure 2012-01-12 Andrew John Hughes <ahughes@redhat.com>
--- a/Makefile.am Thu Feb 09 12:45:55 2012 +0000 +++ b/Makefile.am Thu Feb 09 17:05:26 2012 +0000 @@ -207,7 +207,17 @@ patches/security/20111018/7083012.patch \ patches/security/20111018/7096936.patch \ patches/security/20111018/7046794.patch \ - patches/security/20111018/7077466.patch + patches/security/20111018/7077466.patch \ + patches/security/20120214/7082299.patch \ + patches/security/20120214/7088367.patch \ + patches/security/20120214/7110683.patch \ + patches/security/20120214/7110687.patch \ + patches/security/20120214/7110700.patch \ + patches/security/20120214/7110704.patch \ + patches/security/20120214/7118283.patch \ + patches/security/20120214/7126960.patch + +SPECIAL_SECURITY_PATCH = patches/security/20120214/7112642.patch if WITH_ALT_HSBUILD SECURITY_PATCHES += \ @@ -229,6 +239,7 @@ patches/openjdk/6797195-hw_lw_mixing.patch \ patches/openjdk/6725214-direct3d-01.patch \ patches/openjdk/6633275-shaped_translucent_windows.patch \ + $(SPECIAL_SECURITY_PATCH) \ patches/openjdk/6769607-modal-hangs.patch \ patches/openjdk/6791612-opengl-jni-fix.patch \ patches/openjdk/6755274-glgetstring-crash.patch \
--- a/NEWS Thu Feb 09 12:45:55 2012 +0000 +++ b/NEWS Thu Feb 09 17:05:26 2012 +0000 @@ -11,6 +11,16 @@ New in release 1.10.6 (2012-02-XX): +* Security fixes + - S7082299: Fix in AtomicReferenceArray + - S7088367: Fix issues in java sound + - S7110683: Issues with some KeyboardFocusManager method + - S7110687: Issues with TimeZone class + - S7110700: Enhance exception throwing mechanism in ObjectStreamClass + - S7110704: Issues with some method in corba + - S7112642: Incorrect checking for graphics rendering object + - S7118283: Better input parameter checking in zip file processing + - S7126960: Add property to limit number of request headers to the HTTP Server * Bug fixes - RH580478: Desktop files should not use hardcoded path
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/patches/security/20120214/7082299.patch Thu Feb 09 17:05:26 2012 +0000 @@ -0,0 +1,201 @@ +# HG changeset patch +# User robm +# Date 1322691030 0 +# Node ID ee0f12b18cb8d20c3fb61e96817bde6318a29221 +# Parent dd8956e41b892ed7102e1d5668781f2c68ea9ac5 +7082299: AtomicReferenceArray should ensure that array is Object[] +Summary: java.util.concurrent.AtomicReferenceArray needs to ensure that internal array is always Object[]. +Reviewed-by: chegar, coffeys + +diff --git a/src/share/classes/java/util/concurrent/atomic/AtomicReferenceArray.java b/src/share/classes/java/util/concurrent/atomic/AtomicReferenceArray.java +--- openjdk/jdk/src/share/classes/java/util/concurrent/atomic/AtomicReferenceArray.java ++++ openjdk/jdk/src/share/classes/java/util/concurrent/atomic/AtomicReferenceArray.java +@@ -34,8 +34,9 @@ + */ + + package java.util.concurrent.atomic; ++import java.lang.reflect.Array; ++import java.util.Arrays; + import sun.misc.Unsafe; +-import java.util.*; + + /** + * An array of object references in which elements may be updated +@@ -49,15 +50,37 @@ public class AtomicReferenceArray<E> imp + public class AtomicReferenceArray<E> implements java.io.Serializable { + private static final long serialVersionUID = -6209656149925076980L; + +- private static final Unsafe unsafe = Unsafe.getUnsafe(); +- private static final int base = unsafe.arrayBaseOffset(Object[].class); +- private static final int scale = unsafe.arrayIndexScale(Object[].class); +- private final Object[] array; ++ private static final Unsafe unsafe; ++ private static final int base; ++ private static final int shift; ++ private static final long arrayFieldOffset; ++ private final Object[] array; // must have exact type Object[] + +- private long rawIndex(int i) { ++ static { ++ int scale; ++ try { ++ unsafe = Unsafe.getUnsafe(); ++ arrayFieldOffset = unsafe.objectFieldOffset ++ (AtomicReferenceArray.class.getDeclaredField("array")); ++ base = unsafe.arrayBaseOffset(Object[].class); ++ scale = unsafe.arrayIndexScale(Object[].class); ++ } catch (Exception e) { ++ throw new Error(e); ++ } ++ if ((scale & (scale - 1)) != 0) ++ throw new Error("data type scale not a power of two"); ++ shift = 31 - Integer.numberOfLeadingZeros(scale); ++ } ++ ++ private long checkedByteOffset(int i) { + if (i < 0 || i >= array.length) + throw new IndexOutOfBoundsException("index " + i); +- return base + (long) i * scale; ++ ++ return byteOffset(i); ++ } ++ ++ private static long byteOffset(int i) { ++ return ((long) i << shift) + base; + } + + /** +@@ -66,9 +89,6 @@ public class AtomicReferenceArray<E> imp + */ + public AtomicReferenceArray(int length) { + array = new Object[length]; +- // must perform at least one volatile write to conform to JMM +- if (length > 0) +- unsafe.putObjectVolatile(array, rawIndex(0), null); + } + + /** +@@ -79,18 +99,8 @@ public class AtomicReferenceArray<E> imp + * @throws NullPointerException if array is null + */ + public AtomicReferenceArray(E[] array) { +- if (array == null) +- throw new NullPointerException(); +- int length = array.length; +- this.array = new Object[length]; +- if (length > 0) { +- int last = length-1; +- for (int i = 0; i < last; ++i) +- this.array[i] = array[i]; +- // Do the last write as volatile +- E e = array[last]; +- unsafe.putObjectVolatile(this.array, rawIndex(last), e); +- } ++ // Visibility guaranteed by final field guarantees ++ this.array = Arrays.copyOf(array, array.length, Object[].class); + } + + /** +@@ -109,7 +119,11 @@ public class AtomicReferenceArray<E> imp + * @return the current value + */ + public final E get(int i) { +- return (E) unsafe.getObjectVolatile(array, rawIndex(i)); ++ return getRaw(checkedByteOffset(i)); ++ } ++ ++ private E getRaw(long offset) { ++ return (E) unsafe.getObjectVolatile(array, offset); + } + + /** +@@ -119,7 +133,7 @@ public class AtomicReferenceArray<E> imp + * @param newValue the new value + */ + public final void set(int i, E newValue) { +- unsafe.putObjectVolatile(array, rawIndex(i), newValue); ++ unsafe.putObjectVolatile(array, checkedByteOffset(i), newValue); + } + + /** +@@ -130,7 +144,7 @@ public class AtomicReferenceArray<E> imp + * @since 1.6 + */ + public final void lazySet(int i, E newValue) { +- unsafe.putOrderedObject(array, rawIndex(i), newValue); ++ unsafe.putOrderedObject(array, checkedByteOffset(i), newValue); + } + + +@@ -143,9 +157,10 @@ public class AtomicReferenceArray<E> imp + * @return the previous value + */ + public final E getAndSet(int i, E newValue) { ++ long offset = checkedByteOffset(i); + while (true) { +- E current = get(i); +- if (compareAndSet(i, current, newValue)) ++ E current = getRaw(offset); ++ if (compareAndSetRaw(offset, current, newValue)) + return current; + } + } +@@ -153,6 +168,7 @@ public class AtomicReferenceArray<E> imp + /** + * Atomically sets the element at position {@code i} to the given + * updated value if the current value {@code ==} the expected value. ++ * + * @param i the index + * @param expect the expected value + * @param update the new value +@@ -160,8 +176,11 @@ public class AtomicReferenceArray<E> imp + * the actual value was not equal to the expected value. + */ + public final boolean compareAndSet(int i, E expect, E update) { +- return unsafe.compareAndSwapObject(array, rawIndex(i), +- expect, update); ++ return compareAndSetRaw(checkedByteOffset(i), expect, update); ++ } ++ ++ private boolean compareAndSetRaw(long offset, E expect, E update) { ++ return unsafe.compareAndSwapObject(array, offset, expect, update); + } + + /** +@@ -186,9 +205,33 @@ public class AtomicReferenceArray<E> imp + * @return the String representation of the current values of array. + */ + public String toString() { +- if (array.length > 0) // force volatile read +- get(0); +- return Arrays.toString(array); ++ int iMax = array.length - 1; ++ if (iMax == -1) ++ return "[]"; ++ ++ StringBuilder b = new StringBuilder(); ++ b.append('['); ++ for (int i = 0; ; i++) { ++ b.append(getRaw(byteOffset(i))); ++ if (i == iMax) ++ return b.append(']').toString(); ++ b.append(',').append(' '); ++ } ++ } ++ ++ /** ++ * Reconstitutes the instance from a stream (that is, deserializes it). ++ * @param s the stream ++ */ ++ private void readObject(java.io.ObjectInputStream s) ++ throws java.io.IOException, ClassNotFoundException { ++ // Note: This must be changed if any additional fields are defined ++ Object a = s.readFields().get("array", null); ++ if (a == null || !a.getClass().isArray()) ++ throw new java.io.InvalidObjectException("Not array type"); ++ if (a.getClass() != Object[].class) ++ a = Arrays.copyOf((Object[])a, Array.getLength(a), Object[].class); ++ unsafe.putObjectVolatile(this, arrayFieldOffset, a); + } + + }
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/patches/security/20120214/7088367.patch Thu Feb 09 17:05:26 2012 +0000 @@ -0,0 +1,45 @@ +# HG changeset patch +# User amenkov +# Date 1319622989 -14400 +# Node ID b34a3ed0c8f2f6b9121d38ed330430d913f8a385 +# Parent cdc68d7a17dd412402b100dc427abbe0a90cf2ab +7088367: JavaSound security issue (12865443) +Reviewed-by: denis + +diff --git a/src/share/classes/com/sun/media/sound/DirectAudioDevice.java b/src/share/classes/com/sun/media/sound/DirectAudioDevice.java +--- openjdk/jdk/src/share/classes/com/sun/media/sound/DirectAudioDevice.java ++++ openjdk/jdk/src/share/classes/com/sun/media/sound/DirectAudioDevice.java +@@ -771,7 +771,7 @@ class DirectAudioDevice extends Abstract + if (off < 0) { + throw new ArrayIndexOutOfBoundsException(off); + } +- if (off + len > b.length) { ++ if ((long)off + (long)len > (long)b.length) { + throw new ArrayIndexOutOfBoundsException(b.length); + } + +@@ -1000,7 +1000,7 @@ class DirectAudioDevice extends Abstract + if (off < 0) { + throw new ArrayIndexOutOfBoundsException(off); + } +- if (off + len > b.length) { ++ if ((long)off + (long)len > (long)b.length) { + throw new ArrayIndexOutOfBoundsException(b.length); + } + if (!isActive() && doIO) { +diff --git a/src/share/classes/com/sun/media/sound/SoftMixingSourceDataLine.java b/src/share/classes/com/sun/media/sound/SoftMixingSourceDataLine.java +--- openjdk/jdk/src/share/classes/com/sun/media/sound/SoftMixingSourceDataLine.java ++++ openjdk/jdk/src/share/classes/com/sun/media/sound/SoftMixingSourceDataLine.java +@@ -130,6 +130,12 @@ public class SoftMixingSourceDataLine ex + if (len % framesize != 0) + throw new IllegalArgumentException( + "Number of bytes does not represent an integral number of sample frames."); ++ if (off < 0) { ++ throw new ArrayIndexOutOfBoundsException(off); ++ } ++ if ((long)off + (long)len > (long)b.length) { ++ throw new ArrayIndexOutOfBoundsException(b.length); ++ } + + byte[] buff = cycling_buffer; + int buff_len = cycling_buffer.length;
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/patches/security/20120214/7110683.patch Thu Feb 09 17:05:26 2012 +0000 @@ -0,0 +1,170 @@ +# HG changeset patch +# User skoppar +# Date 1324575564 28800 +# Node ID e05eb7bee1ce0a44f3e414454e44cd49d77ba9de +# Parent bfaa99d5bef813217cdbc6eddcdd511cf53327e7 +7110683: Issues with some KeyboardFocusManager method +7116384: backout the unallowed changes in the KeyboardFocusManager.java javadoc +Reviewed-by: ant + +diff --git a/src/share/classes/java/awt/KeyboardFocusManager.java b/src/share/classes/java/awt/KeyboardFocusManager.java +--- openjdk/jdk/src/share/classes/java/awt/KeyboardFocusManager.java ++++ openjdk/jdk/src/share/classes/java/awt/KeyboardFocusManager.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2000, 2007, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -476,14 +476,8 @@ public abstract class KeyboardFocusManag + */ + protected Component getGlobalFocusOwner() throws SecurityException { + synchronized (KeyboardFocusManager.class) { +- if (this == getCurrentKeyboardFocusManager()) { +- return focusOwner; +- } else { +- if (focusLog.isLoggable(Level.FINER)) { +- focusLog.log(Level.FINER, "This manager is " + this + ", current is " + getCurrentKeyboardFocusManager()); +- } +- throw new SecurityException(notPrivileged); +- } ++ checkCurrentKFMSecurity(); ++ return focusOwner; + } + } + +@@ -517,6 +511,7 @@ public abstract class KeyboardFocusManag + + if (focusOwner == null || focusOwner.isFocusable()) { + synchronized (KeyboardFocusManager.class) { ++ checkCurrentKFMSecurity(); + oldFocusOwner = getFocusOwner(); + + try { +@@ -566,6 +561,10 @@ public abstract class KeyboardFocusManag + * @see java.awt.event.FocusEvent#FOCUS_LOST + */ + public void clearGlobalFocusOwner() { ++ synchronized (KeyboardFocusManager.class) { ++ checkCurrentKFMSecurity(); ++ } ++ + if (!GraphicsEnvironment.isHeadless()) { + // Toolkit must be fully initialized, otherwise + // _clearGlobalFocusOwner will crash or throw an exception +@@ -645,14 +644,8 @@ public abstract class KeyboardFocusManag + throws SecurityException + { + synchronized (KeyboardFocusManager.class) { +- if (this == getCurrentKeyboardFocusManager()) { +- return permanentFocusOwner; +- } else { +- if (focusLog.isLoggable(Level.FINER)) { +- focusLog.log(Level.FINER, "This manager is " + this + ", current is " + getCurrentKeyboardFocusManager()); +- } +- throw new SecurityException(notPrivileged); +- } ++ checkCurrentKFMSecurity(); ++ return permanentFocusOwner; + } + } + +@@ -688,6 +681,7 @@ public abstract class KeyboardFocusManag + + if (permanentFocusOwner == null || permanentFocusOwner.isFocusable()) { + synchronized (KeyboardFocusManager.class) { ++ checkCurrentKFMSecurity(); + oldPermanentFocusOwner = getPermanentFocusOwner(); + + try { +@@ -753,14 +747,8 @@ public abstract class KeyboardFocusManag + */ + protected Window getGlobalFocusedWindow() throws SecurityException { + synchronized (KeyboardFocusManager.class) { +- if (this == getCurrentKeyboardFocusManager()) { +- return focusedWindow; +- } else { +- if (focusLog.isLoggable(Level.FINER)) { +- focusLog.log(Level.FINER, "This manager is " + this + ", current is " + getCurrentKeyboardFocusManager()); +- } +- throw new SecurityException(notPrivileged); +- } ++ checkCurrentKFMSecurity(); ++ return focusedWindow; + } + } + +@@ -791,6 +779,7 @@ public abstract class KeyboardFocusManag + + if (focusedWindow == null || focusedWindow.isFocusableWindow()) { + synchronized (KeyboardFocusManager.class) { ++ checkCurrentKFMSecurity(); + oldFocusedWindow = getFocusedWindow(); + + try { +@@ -857,14 +846,8 @@ public abstract class KeyboardFocusManag + */ + protected Window getGlobalActiveWindow() throws SecurityException { + synchronized (KeyboardFocusManager.class) { +- if (this == getCurrentKeyboardFocusManager()) { +- return activeWindow; +- } else { +- if (focusLog.isLoggable(Level.FINER)) { +- focusLog.log(Level.FINER, "This manager is " + this + ", current is " + getCurrentKeyboardFocusManager()); +- } +- throw new SecurityException(notPrivileged); +- } ++ checkCurrentKFMSecurity(); ++ return activeWindow; + } + } + +@@ -893,6 +876,7 @@ public abstract class KeyboardFocusManag + protected void setGlobalActiveWindow(Window activeWindow) { + Window oldActiveWindow; + synchronized (KeyboardFocusManager.class) { ++ checkCurrentKFMSecurity(); + oldActiveWindow = getActiveWindow(); + if (focusLog.isLoggable(Level.FINER)) { + focusLog.log(Level.FINER, "Setting global active window to " + activeWindow + ", old active " + oldActiveWindow); +@@ -1187,14 +1171,8 @@ public abstract class KeyboardFocusManag + throws SecurityException + { + synchronized (KeyboardFocusManager.class) { +- if (this == getCurrentKeyboardFocusManager()) { +- return currentFocusCycleRoot; +- } else { +- if (focusLog.isLoggable(Level.FINER)) { +- focusLog.log(Level.FINER, "This manager is " + this + ", current is " + getCurrentKeyboardFocusManager()); +- } +- throw new SecurityException(notPrivileged); +- } ++ checkCurrentKFMSecurity(); ++ return currentFocusCycleRoot; + } + } + +@@ -1218,6 +1196,7 @@ public abstract class KeyboardFocusManag + Container oldFocusCycleRoot; + + synchronized (KeyboardFocusManager.class) { ++ checkCurrentKFMSecurity(); + oldFocusCycleRoot = getCurrentFocusCycleRoot(); + currentFocusCycleRoot = newFocusCycleRoot; + } +@@ -3102,4 +3081,14 @@ public abstract class KeyboardFocusManag + : null; + } + } ++ ++ private void checkCurrentKFMSecurity() { ++ if (this != getCurrentKeyboardFocusManager()) { ++ if (focusLog.isLoggable(Level.FINER)) { ++ focusLog.finer("This manager is " + this + ++ ", current is " + getCurrentKeyboardFocusManager()); ++ } ++ throw new SecurityException(notPrivileged); ++ } ++ } + }
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/patches/security/20120214/7110687.patch Thu Feb 09 17:05:26 2012 +0000 @@ -0,0 +1,237 @@ +# HG changeset patch +# User coffeys +# Date 1321351078 0 +# Node ID dd8956e41b892ed7102e1d5668781f2c68ea9ac5 +# Parent e11df26be5fc2c18af5601afc3793f9abc3e2c45 +7110687: (tz) java.util.TimeZone.setDefault() should be controlled by a security manager +Reviewed-by: okutsu + +diff --git a/make/java/java/FILES_java.gmk b/make/java/java/FILES_java.gmk +--- openjdk/jdk/make/java/java/FILES_java.gmk ++++ openjdk/jdk/make/java/java/FILES_java.gmk +@@ -1,5 +1,5 @@ + # +-# Copyright (c) 1996, 2010, Oracle and/or its affiliates. All rights reserved. ++# Copyright (c) 1996, 2011, Oracle and/or its affiliates. All rights reserved. + # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + # + # This code is free software; you can redistribute it and/or modify it +@@ -448,6 +448,7 @@ JAVA_JAVA_java = \ + sun/misc/MessageUtils.java \ + sun/misc/GC.java \ + sun/misc/Service.java \ ++ sun/misc/JavaAWTAccess.java \ + sun/misc/JavaLangAccess.java \ + sun/misc/JavaIOAccess.java \ + sun/misc/JavaIODeleteOnExitAccess.java \ +diff --git a/src/share/classes/java/util/TimeZone.java b/src/share/classes/java/util/TimeZone.java +--- openjdk/jdk/src/share/classes/java/util/TimeZone.java ++++ openjdk/jdk/src/share/classes/java/util/TimeZone.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 1996, 2005, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 1996, 2011, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -43,6 +43,8 @@ import java.security.AccessController; + import java.security.AccessController; + import java.security.PrivilegedAction; + import java.util.concurrent.ConcurrentHashMap; ++import sun.misc.SharedSecrets; ++import sun.misc.JavaAWTAccess; + import sun.security.action.GetPropertyAction; + import sun.util.TimeZoneNameUtility; + import sun.util.calendar.ZoneInfo; +@@ -542,7 +544,7 @@ abstract public class TimeZone implement + * method doesn't create a clone. + */ + static TimeZone getDefaultRef() { +- TimeZone defaultZone = defaultZoneTL.get(); ++ TimeZone defaultZone = getDefaultInAppContext(); + if (defaultZone == null) { + defaultZone = defaultTimeZone; + if (defaultZone == null) { +@@ -633,10 +635,53 @@ abstract public class TimeZone implement + if (hasPermission()) { + synchronized (TimeZone.class) { + defaultTimeZone = zone; +- defaultZoneTL.set(null); ++ setDefaultInAppContext(null); + } + } else { +- defaultZoneTL.set(zone); ++ setDefaultInAppContext(zone); ++ } ++ } ++ ++ /** ++ * Returns the default TimeZone in an AppContext if any AppContext ++ * has ever used. null is returned if any AppContext hasn't been ++ * used or if the AppContext doesn't have the default TimeZone. ++ */ ++ private synchronized static TimeZone getDefaultInAppContext() { ++ javaAWTAccess = SharedSecrets.getJavaAWTAccess(); ++ if (javaAWTAccess == null) { ++ return mainAppContextDefault; ++ } else { ++ if (!javaAWTAccess.isDisposed()) { ++ TimeZone tz = (TimeZone) ++ javaAWTAccess.get(TimeZone.class); ++ if (tz == null && javaAWTAccess.isMainAppContext()) { ++ return mainAppContextDefault; ++ } else { ++ return tz; ++ } ++ } ++ } ++ return null; ++ } ++ ++ /** ++ * Sets the default TimeZone in the AppContext to the given ++ * tz. null is handled special: do nothing if any AppContext ++ * hasn't been used, remove the default TimeZone in the ++ * AppContext otherwise. ++ */ ++ private synchronized static void setDefaultInAppContext(TimeZone tz) { ++ javaAWTAccess = SharedSecrets.getJavaAWTAccess(); ++ if (javaAWTAccess == null) { ++ mainAppContextDefault = tz; ++ } else { ++ if (!javaAWTAccess.isDisposed()) { ++ javaAWTAccess.put(TimeZone.class, tz); ++ if (javaAWTAccess.isMainAppContext()) { ++ mainAppContextDefault = null; ++ } ++ } + } + } + +@@ -687,11 +732,23 @@ abstract public class TimeZone implement + */ + private String ID; + private static volatile TimeZone defaultTimeZone; +- private static final InheritableThreadLocal<TimeZone> defaultZoneTL +- = new InheritableThreadLocal<TimeZone>(); + + static final String GMT_ID = "GMT"; + private static final int GMT_ID_LENGTH = 3; ++ ++ /* ++ * Provides access implementation-private methods without using reflection ++ * ++ * Note that javaAWTAccess may be null if sun.awt.AppContext class hasn't ++ * been loaded. If so, it implies that AWTSecurityManager is not our ++ * SecurityManager and we can use a local static variable. ++ * This works around a build time issue. ++ */ ++ private static JavaAWTAccess javaAWTAccess; ++ ++ // a static TimeZone we can reference if no AppContext is in place ++ private static TimeZone mainAppContextDefault; ++ + + /** + * Parses a custom time zone identifier and returns a corresponding zone. +diff --git a/src/share/classes/sun/awt/AppContext.java b/src/share/classes/sun/awt/AppContext.java +--- openjdk/jdk/src/share/classes/sun/awt/AppContext.java ++++ openjdk/jdk/src/share/classes/sun/awt/AppContext.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 1998, 2007, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 1998, 2011, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -767,6 +767,27 @@ public final class AppContext { + } + return changeSupport.getPropertyChangeListeners(propertyName); + } ++ ++ // Set up JavaAWTAccess in SharedSecrets ++ static { ++ sun.misc.SharedSecrets.setJavaAWTAccess(new sun.misc.JavaAWTAccess() { ++ public Object get(Object key) { ++ return getAppContext().get(key); ++ } ++ public void put(Object key, Object value) { ++ getAppContext().put(key, value); ++ } ++ public void remove(Object key) { ++ getAppContext().remove(key); ++ } ++ public boolean isDisposed() { ++ return getAppContext().isDisposed(); ++ } ++ public boolean isMainAppContext() { ++ return (numAppContexts == 1); ++ } ++ }); ++ } + } + + final class MostRecentThreadAppContext { +diff --git a/src/share/classes/sun/misc/JavaAWTAccess.java b/src/share/classes/sun/misc/JavaAWTAccess.java +new file mode 100644 +--- /dev/null ++++ openjdk/jdk/src/share/classes/sun/misc/JavaAWTAccess.java +@@ -0,0 +1,32 @@ ++/* ++ * Copyright (c) 2011, Oracle and/or its affiliates. All rights reserved. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++package sun.misc; ++ ++public interface JavaAWTAccess { ++ public Object get(Object key); ++ public void put(Object key, Object value); ++ public void remove(Object key); ++ public boolean isDisposed(); ++ public boolean isMainAppContext(); ++} +diff --git a/src/share/classes/sun/misc/SharedSecrets.java b/src/share/classes/sun/misc/SharedSecrets.java +--- openjdk/jdk/src/share/classes/sun/misc/SharedSecrets.java ++++ openjdk/jdk/src/share/classes/sun/misc/SharedSecrets.java +@@ -52,6 +52,7 @@ public class SharedSecrets { + private static JavaIOFileDescriptorAccess javaIOFileDescriptorAccess; + private static JavaSecurityProtectionDomainAccess javaSecurityProtectionDomainAccess; + private static JavaSecurityAccess javaSecurityAccess; ++ private static JavaAWTAccess javaAWTAccess; + + public static JavaUtilJarAccess javaUtilJarAccess() { + if (javaUtilJarAccess == null) { +@@ -138,4 +139,14 @@ public class SharedSecrets { + } + return javaSecurityAccess; + } ++ ++ public static void setJavaAWTAccess(JavaAWTAccess jaa) { ++ javaAWTAccess = jaa; ++ } ++ ++ public static JavaAWTAccess getJavaAWTAccess() { ++ // this may return null in which case calling code needs to ++ // provision for. ++ return javaAWTAccess; ++ } + }
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/patches/security/20120214/7110700.patch Thu Feb 09 17:05:26 2012 +0000 @@ -0,0 +1,42 @@ +# HG changeset patch +# User dmeetry +# Date 1325175900 -14400 +# Node ID 3c11966c3da3ec95c80008e4a4cc2ae4ab0e59fc +# Parent e05eb7bee1ce0a44f3e414454e44cd49d77ba9de +7110700: Enhance exception throwing mechanism in ObjectStreamClass +Reviewed-by: smarks + +diff --git a/src/share/classes/java/io/ObjectStreamClass.java b/src/share/classes/java/io/ObjectStreamClass.java +--- openjdk/jdk/src/share/classes/java/io/ObjectStreamClass.java ++++ openjdk/jdk/src/share/classes/java/io/ObjectStreamClass.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 1996, 2010, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 1996, 2011, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -730,7 +730,6 @@ public class ObjectStreamClass implement + InvalidClassException ice = + new InvalidClassException(deserializeEx.classname, + deserializeEx.getMessage()); +- ice.initCause(deserializeEx); + throw ice; + } + } +@@ -745,7 +744,6 @@ public class ObjectStreamClass implement + InvalidClassException ice = + new InvalidClassException(serializeEx.classname, + serializeEx.getMessage()); +- ice.initCause(serializeEx); + throw ice; + } + } +@@ -762,7 +760,6 @@ public class ObjectStreamClass implement + InvalidClassException ice = + new InvalidClassException(defaultSerializeEx.classname, + defaultSerializeEx.getMessage()); +- ice.initCause(defaultSerializeEx); + throw ice; + } + }
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/patches/security/20120214/7110704.patch Thu Feb 09 17:05:26 2012 +0000 @@ -0,0 +1,63 @@ +# HG changeset patch +# User coffeys +# Date 1321351683 0 +# Node ID c971de26dc9c900ff5a5ecb799dcc84cf9769ef0 +# Parent 23f471142a033a47b6b60506c2749f9caad0a4f8 +7110704: Issues with some method in corba +Reviewed-by: dmeetry + +diff --git a/src/share/classes/com/sun/corba/se/impl/dynamicany/DynAnyFactoryImpl.java b/src/share/classes/com/sun/corba/se/impl/dynamicany/DynAnyFactoryImpl.java +--- openjdk/corba/src/share/classes/com/sun/corba/se/impl/dynamicany/DynAnyFactoryImpl.java ++++ openjdk/corba/src/share/classes/com/sun/corba/se/impl/dynamicany/DynAnyFactoryImpl.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2000, 2003, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -82,6 +82,6 @@ public class DynAnyFactoryImpl + private String[] __ids = { "IDL:omg.org/DynamicAny/DynAnyFactory:1.0" }; + + public String[] _ids() { +- return __ids; ++ return (String[])__ids.clone(); + } + } +diff --git a/src/share/classes/com/sun/corba/se/impl/dynamicany/DynAnyImpl.java b/src/share/classes/com/sun/corba/se/impl/dynamicany/DynAnyImpl.java +--- openjdk/corba/src/share/classes/com/sun/corba/se/impl/dynamicany/DynAnyImpl.java ++++ openjdk/corba/src/share/classes/com/sun/corba/se/impl/dynamicany/DynAnyImpl.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2000, 2003, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -195,6 +195,6 @@ abstract class DynAnyImpl extends org.om + private String[] __ids = { "IDL:omg.org/DynamicAny/DynAny:1.0" }; + + public String[] _ids() { +- return __ids; ++ return (String[])__ids.clone(); + } + } +diff --git a/src/share/classes/com/sun/org/omg/SendingContext/_CodeBaseImplBase.java b/src/share/classes/com/sun/org/omg/SendingContext/_CodeBaseImplBase.java +--- openjdk/corba/src/share/classes/com/sun/org/omg/SendingContext/_CodeBaseImplBase.java ++++ openjdk/corba/src/share/classes/com/sun/org/omg/SendingContext/_CodeBaseImplBase.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 1999, 2011, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -138,7 +138,7 @@ public abstract class _CodeBaseImplBase + + public String[] _ids () + { +- return __ids; ++ return (String[])__ids.clone(); + } + +
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/patches/security/20120214/7112642.patch Thu Feb 09 17:05:26 2012 +0000 @@ -0,0 +1,750 @@ +# HG changeset patch +# User bagiras +# Date 1322689157 28800 +# Node ID 17eb322778160cc1463875e2b429211cf7966997 +# Parent 42706fbe23df228d55c454d0fbf8c3fb36fc4bc6 +7112642: Incorrect checking for graphics rendering object +Reviewed-by: art, bae, flar, prr + +diff --git a/src/share/classes/sun/java2d/SunGraphics2D.java b/src/share/classes/sun/java2d/SunGraphics2D.java +--- openjdk/jdk/src/share/classes/sun/java2d/SunGraphics2D.java ++++ openjdk/jdk/src/share/classes/sun/java2d/SunGraphics2D.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 1996, 2008, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 1996, 2011, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -370,6 +370,17 @@ public final class SunGraphics2D + } + + public void validatePipe() { ++ /* This workaround is for the situation when we update the Pipelines ++ * for invalid SurfaceData and run further code when the current ++ * pipeline doesn't support the type of new SurfaceData created during ++ * the current pipeline's work (in place of the invalid SurfaceData). ++ * Usually SurfaceData and Pipelines are repaired (through revalidateAll) ++ * and called again in the exception handlers */ ++ ++ if (!surfaceData.isValid()) { ++ throw new InvalidPipeException("attempt to validate Pipe with invalid SurfaceData"); ++ } ++ + surfaceData.validatePipe(this); + } + +diff --git a/src/share/classes/sun/java2d/opengl/OGLRenderer.java b/src/share/classes/sun/java2d/opengl/OGLRenderer.java +--- openjdk/jdk/src/share/classes/sun/java2d/opengl/OGLRenderer.java ++++ openjdk/jdk/src/share/classes/sun/java2d/opengl/OGLRenderer.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2003, 2008, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 2003, 2011, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -27,6 +27,7 @@ package sun.java2d.opengl; + + import java.awt.Transparency; + import java.awt.geom.Path2D; ++import sun.java2d.InvalidPipeException; + import sun.java2d.SunGraphics2D; + import sun.java2d.loops.GraphicsPrimitive; + import sun.java2d.pipe.BufferedRenderPipe; +@@ -46,7 +47,12 @@ class OGLRenderer extends BufferedRender + int ctxflags = + sg2d.paint.getTransparency() == Transparency.OPAQUE ? + OGLContext.SRC_IS_OPAQUE : OGLContext.NO_CONTEXT_FLAGS; +- OGLSurfaceData dstData = (OGLSurfaceData)sg2d.surfaceData; ++ OGLSurfaceData dstData; ++ try { ++ dstData = (OGLSurfaceData)sg2d.surfaceData; ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + OGLContext.validateContext(dstData, dstData, + sg2d.getCompClip(), sg2d.composite, + null, sg2d.paint, sg2d, ctxflags); +@@ -55,7 +61,12 @@ class OGLRenderer extends BufferedRender + @Override + protected void validateContextAA(SunGraphics2D sg2d) { + int ctxflags = OGLContext.NO_CONTEXT_FLAGS; +- OGLSurfaceData dstData = (OGLSurfaceData)sg2d.surfaceData; ++ OGLSurfaceData dstData; ++ try { ++ dstData = (OGLSurfaceData)sg2d.surfaceData; ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + OGLContext.validateContext(dstData, dstData, + sg2d.getCompClip(), sg2d.composite, + null, sg2d.paint, sg2d, ctxflags); +@@ -69,7 +80,12 @@ class OGLRenderer extends BufferedRender + int ctxflags = + sg2d.surfaceData.getTransparency() == Transparency.OPAQUE ? + OGLContext.SRC_IS_OPAQUE : OGLContext.NO_CONTEXT_FLAGS; +- OGLSurfaceData dstData = (OGLSurfaceData)sg2d.surfaceData; ++ OGLSurfaceData dstData; ++ try { ++ dstData = (OGLSurfaceData)sg2d.surfaceData; ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + OGLContext.validateContext(dstData, dstData, + sg2d.getCompClip(), sg2d.composite, + null, null, null, ctxflags); +diff --git a/src/share/classes/sun/java2d/pipe/BufferedContext.java b/src/share/classes/sun/java2d/pipe/BufferedContext.java +--- openjdk/jdk/src/share/classes/sun/java2d/pipe/BufferedContext.java ++++ openjdk/jdk/src/share/classes/sun/java2d/pipe/BufferedContext.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 2005, 2011, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -111,6 +111,8 @@ public abstract class BufferedContext { + * + * Note: must be called while the RenderQueue lock is held. + * ++ * It's assumed that the type of surfaces has been checked by the Renderer ++ * + * @throws InvalidPipeException if either src or dest surface is not valid + * or lost + * @see RenderQueue#lock +@@ -134,6 +136,8 @@ public abstract class BufferedContext { + * and disables all context state settings. + * + * Note: must be called while the RenderQueue lock is held. ++ * ++ * It's assumed that the type of surfaces has been checked by the Renderer + * + * @throws InvalidPipeException if the surface is not valid + * or lost +@@ -159,6 +163,8 @@ public abstract class BufferedContext { + * is safe to pass a null SunGraphics2D and it will be ignored. + * + * Note: must be called while the RenderQueue lock is held. ++ * ++ * It's assumed that the type of surfaces has been checked by the Renderer + * + * @throws InvalidPipeException if either src or dest surface is not valid + * or lost +diff --git a/src/windows/classes/sun/java2d/d3d/D3DRenderer.java b/src/windows/classes/sun/java2d/d3d/D3DRenderer.java +--- openjdk/jdk/src/windows/classes/sun/java2d/d3d/D3DRenderer.java ++++ openjdk/jdk/src/windows/classes/sun/java2d/d3d/D3DRenderer.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2007, 2008, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 2007, 2011, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -27,6 +27,7 @@ package sun.java2d.d3d; + + import java.awt.Transparency; + import java.awt.geom.Path2D; ++import sun.java2d.InvalidPipeException; + import sun.java2d.SunGraphics2D; + import sun.java2d.loops.GraphicsPrimitive; + import sun.java2d.pipe.BufferedPaints; +@@ -47,7 +48,12 @@ class D3DRenderer extends BufferedRender + int ctxflags = + sg2d.paint.getTransparency() == Transparency.OPAQUE ? + D3DContext.SRC_IS_OPAQUE : D3DContext.NO_CONTEXT_FLAGS; +- D3DSurfaceData dstData = (D3DSurfaceData)sg2d.surfaceData; ++ D3DSurfaceData dstData; ++ try { ++ dstData = (D3DSurfaceData)sg2d.surfaceData; ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + D3DContext.validateContext(dstData, dstData, + sg2d.getCompClip(), sg2d.composite, + null, sg2d.paint, sg2d, ctxflags); +@@ -56,7 +62,12 @@ class D3DRenderer extends BufferedRender + @Override + protected void validateContextAA(SunGraphics2D sg2d) { + int ctxflags = D3DContext.NO_CONTEXT_FLAGS; +- D3DSurfaceData dstData = (D3DSurfaceData)sg2d.surfaceData; ++ D3DSurfaceData dstData; ++ try { ++ dstData = (D3DSurfaceData)sg2d.surfaceData; ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + D3DContext.validateContext(dstData, dstData, + sg2d.getCompClip(), sg2d.composite, + null, sg2d.paint, sg2d, ctxflags); +@@ -70,7 +81,12 @@ class D3DRenderer extends BufferedRender + int ctxflags = + sg2d.surfaceData.getTransparency() == Transparency.OPAQUE ? + D3DContext.SRC_IS_OPAQUE : D3DContext.NO_CONTEXT_FLAGS; +- D3DSurfaceData dstData = (D3DSurfaceData)sg2d.surfaceData; ++ D3DSurfaceData dstData; ++ try { ++ dstData = (D3DSurfaceData)sg2d.surfaceData; ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + D3DContext.validateContext(dstData, dstData, + sg2d.getCompClip(), sg2d.composite, + null, null, null, ctxflags); +diff --git a/src/windows/classes/sun/java2d/windows/GDIRenderer.java b/src/windows/classes/sun/java2d/windows/GDIRenderer.java +--- openjdk/jdk/src/windows/classes/sun/java2d/windows/GDIRenderer.java ++++ openjdk/jdk/src/windows/classes/sun/java2d/windows/GDIRenderer.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 1999, 2006, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 1999, 2011, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -29,6 +29,7 @@ import java.awt.Shape; + import java.awt.Shape; + import java.awt.geom.Path2D; + import java.awt.geom.PathIterator; ++import sun.java2d.InvalidPipeException; + import sun.java2d.SunGraphics2D; + import sun.java2d.SurfaceData; + import sun.java2d.pipe.Region; +@@ -45,7 +46,7 @@ public class GDIRenderer implements + PixelFillPipe, + ShapeDrawPipe + { +- native void doDrawLine(SurfaceData sData, ++ native void doDrawLine(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int x1, int y1, int x2, int y2); + +@@ -54,24 +55,32 @@ public class GDIRenderer implements + { + int transx = sg2d.transX; + int transy = sg2d.transY; +- doDrawLine(sg2d.surfaceData, +- sg2d.getCompClip(), sg2d.composite, sg2d.eargb, +- x1+transx, y1+transy, x2+transx, y2+transy); ++ try { ++ doDrawLine((GDIWindowSurfaceData)sg2d.surfaceData, ++ sg2d.getCompClip(), sg2d.composite, sg2d.eargb, ++ x1+transx, y1+transy, x2+transx, y2+transy); ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + } + +- native void doDrawRect(SurfaceData sData, ++ native void doDrawRect(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int x, int y, int w, int h); + + public void drawRect(SunGraphics2D sg2d, + int x, int y, int width, int height) + { +- doDrawRect(sg2d.surfaceData, +- sg2d.getCompClip(), sg2d.composite, sg2d.eargb, +- x+sg2d.transX, y+sg2d.transY, width, height); ++ try { ++ doDrawRect((GDIWindowSurfaceData)sg2d.surfaceData, ++ sg2d.getCompClip(), sg2d.composite, sg2d.eargb, ++ x+sg2d.transX, y+sg2d.transY, width, height); ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + } + +- native void doDrawRoundRect(SurfaceData sData, ++ native void doDrawRoundRect(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int x, int y, int w, int h, + int arcW, int arcH); +@@ -80,25 +89,33 @@ public class GDIRenderer implements + int x, int y, int width, int height, + int arcWidth, int arcHeight) + { +- doDrawRoundRect(sg2d.surfaceData, +- sg2d.getCompClip(), sg2d.composite, sg2d.eargb, +- x+sg2d.transX, y+sg2d.transY, width, height, +- arcWidth, arcHeight); ++ try { ++ doDrawRoundRect((GDIWindowSurfaceData)sg2d.surfaceData, ++ sg2d.getCompClip(), sg2d.composite, sg2d.eargb, ++ x+sg2d.transX, y+sg2d.transY, width, height, ++ arcWidth, arcHeight); ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + } + +- native void doDrawOval(SurfaceData sData, ++ native void doDrawOval(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int x, int y, int w, int h); + + public void drawOval(SunGraphics2D sg2d, + int x, int y, int width, int height) + { +- doDrawOval(sg2d.surfaceData, +- sg2d.getCompClip(), sg2d.composite, sg2d.eargb, +- x+sg2d.transX, y+sg2d.transY, width, height); ++ try { ++ doDrawOval((GDIWindowSurfaceData)sg2d.surfaceData, ++ sg2d.getCompClip(), sg2d.composite, sg2d.eargb, ++ x+sg2d.transX, y+sg2d.transY, width, height); ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + } + +- native void doDrawArc(SurfaceData sData, ++ native void doDrawArc(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int x, int y, int w, int h, + int angleStart, int angleExtent); +@@ -107,13 +124,17 @@ public class GDIRenderer implements + int x, int y, int width, int height, + int startAngle, int arcAngle) + { +- doDrawArc(sg2d.surfaceData, +- sg2d.getCompClip(), sg2d.composite, sg2d.eargb, +- x+sg2d.transX, y+sg2d.transY, width, height, +- startAngle, arcAngle); ++ try { ++ doDrawArc((GDIWindowSurfaceData)sg2d.surfaceData, ++ sg2d.getCompClip(), sg2d.composite, sg2d.eargb, ++ x+sg2d.transX, y+sg2d.transY, width, height, ++ startAngle, arcAngle); ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + } + +- native void doDrawPoly(SurfaceData sData, ++ native void doDrawPoly(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int transx, int transy, + int[] xpoints, int[] ypoints, +@@ -123,33 +144,45 @@ public class GDIRenderer implements + int xpoints[], int ypoints[], + int npoints) + { +- doDrawPoly(sg2d.surfaceData, +- sg2d.getCompClip(), sg2d.composite, sg2d.eargb, +- sg2d.transX, sg2d.transY, xpoints, ypoints, npoints, false); ++ try { ++ doDrawPoly((GDIWindowSurfaceData)sg2d.surfaceData, ++ sg2d.getCompClip(), sg2d.composite, sg2d.eargb, ++ sg2d.transX, sg2d.transY, xpoints, ypoints, npoints, false); ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + } + + public void drawPolygon(SunGraphics2D sg2d, + int xpoints[], int ypoints[], + int npoints) + { +- doDrawPoly(sg2d.surfaceData, +- sg2d.getCompClip(), sg2d.composite, sg2d.eargb, +- sg2d.transX, sg2d.transY, xpoints, ypoints, npoints, true); ++ try { ++ doDrawPoly((GDIWindowSurfaceData)sg2d.surfaceData, ++ sg2d.getCompClip(), sg2d.composite, sg2d.eargb, ++ sg2d.transX, sg2d.transY, xpoints, ypoints, npoints, true); ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + } + +- native void doFillRect(SurfaceData sData, ++ native void doFillRect(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int x, int y, int w, int h); + + public void fillRect(SunGraphics2D sg2d, + int x, int y, int width, int height) + { +- doFillRect(sg2d.surfaceData, +- sg2d.getCompClip(), sg2d.composite, sg2d.eargb, +- x+sg2d.transX, y+sg2d.transY, width, height); ++ try { ++ doFillRect((GDIWindowSurfaceData)sg2d.surfaceData, ++ sg2d.getCompClip(), sg2d.composite, sg2d.eargb, ++ x+sg2d.transX, y+sg2d.transY, width, height); ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + } + +- native void doFillRoundRect(SurfaceData sData, ++ native void doFillRoundRect(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int x, int y, int w, int h, + int arcW, int arcH); +@@ -158,25 +191,33 @@ public class GDIRenderer implements + int x, int y, int width, int height, + int arcWidth, int arcHeight) + { +- doFillRoundRect(sg2d.surfaceData, +- sg2d.getCompClip(), sg2d.composite, sg2d.eargb, +- x+sg2d.transX, y+sg2d.transY, width, height, +- arcWidth, arcHeight); ++ try { ++ doFillRoundRect((GDIWindowSurfaceData)sg2d.surfaceData, ++ sg2d.getCompClip(), sg2d.composite, sg2d.eargb, ++ x+sg2d.transX, y+sg2d.transY, width, height, ++ arcWidth, arcHeight); ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + } + +- native void doFillOval(SurfaceData sData, ++ native void doFillOval(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int x, int y, int w, int h); + + public void fillOval(SunGraphics2D sg2d, + int x, int y, int width, int height) + { +- doFillOval(sg2d.surfaceData, +- sg2d.getCompClip(), sg2d.composite, sg2d.eargb, +- x+sg2d.transX, y+sg2d.transY, width, height); ++ try { ++ doFillOval((GDIWindowSurfaceData)sg2d.surfaceData, ++ sg2d.getCompClip(), sg2d.composite, sg2d.eargb, ++ x+sg2d.transX, y+sg2d.transY, width, height); ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + } + +- native void doFillArc(SurfaceData sData, ++ native void doFillArc(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int x, int y, int w, int h, + int angleStart, int angleExtent); +@@ -185,13 +226,17 @@ public class GDIRenderer implements + int x, int y, int width, int height, + int startAngle, int arcAngle) + { +- doFillArc(sg2d.surfaceData, +- sg2d.getCompClip(), sg2d.composite, sg2d.eargb, +- x+sg2d.transX, y+sg2d.transY, width, height, +- startAngle, arcAngle); ++ try { ++ doFillArc((GDIWindowSurfaceData)sg2d.surfaceData, ++ sg2d.getCompClip(), sg2d.composite, sg2d.eargb, ++ x+sg2d.transX, y+sg2d.transY, width, height, ++ startAngle, arcAngle); ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + } + +- native void doFillPoly(SurfaceData sData, ++ native void doFillPoly(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int transx, int transy, + int[] xpoints, int[] ypoints, +@@ -201,12 +246,16 @@ public class GDIRenderer implements + int xpoints[], int ypoints[], + int npoints) + { +- doFillPoly(sg2d.surfaceData, +- sg2d.getCompClip(), sg2d.composite, sg2d.eargb, +- sg2d.transX, sg2d.transY, xpoints, ypoints, npoints); ++ try { ++ doFillPoly((GDIWindowSurfaceData)sg2d.surfaceData, ++ sg2d.getCompClip(), sg2d.composite, sg2d.eargb, ++ sg2d.transX, sg2d.transY, xpoints, ypoints, npoints); ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + } + +- native void doShape(SurfaceData sData, ++ native void doShape(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int transX, int transY, + Path2D.Float p2df, boolean isfill); +@@ -228,9 +277,13 @@ public class GDIRenderer implements + transX = 0; + transY = 0; + } +- doShape(sg2d.surfaceData, +- sg2d.getCompClip(), sg2d.composite, sg2d.eargb, +- transX, transY, p2df, isfill); ++ try { ++ doShape((GDIWindowSurfaceData)sg2d.surfaceData, ++ sg2d.getCompClip(), sg2d.composite, sg2d.eargb, ++ transX, transY, p2df, isfill); ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + } + + // REMIND: This is just a hack to get WIDE lines to honor the +@@ -239,7 +292,12 @@ public class GDIRenderer implements + // method that could be filled by the doShape method more quickly. + public void doFillSpans(SunGraphics2D sg2d, SpanIterator si) { + int box[] = new int[4]; +- SurfaceData sd = sg2d.surfaceData; ++ GDIWindowSurfaceData sd; ++ try { ++ sd = (GDIWindowSurfaceData)sg2d.surfaceData; ++ } catch (ClassCastException e) { ++ throw new InvalidPipeException("wrong surface data type: " + sg2d.surfaceData); ++ } + Region clip = sg2d.getCompClip(); + Composite comp = sg2d.composite; + int eargb = sg2d.eargb; +@@ -268,7 +326,7 @@ public class GDIRenderer implements + doShape(sg2d, s, true); + } + +- public native void devCopyArea(SurfaceData sData, ++ public native void devCopyArea(GDIWindowSurfaceData sData, + int srcx, int srcy, + int dx, int dy, + int w, int h); +@@ -278,21 +336,21 @@ public class GDIRenderer implements + } + + public static class Tracer extends GDIRenderer { +- void doDrawLine(SurfaceData sData, ++ void doDrawLine(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int x1, int y1, int x2, int y2) + { + GraphicsPrimitive.tracePrimitive("GDIDrawLine"); + super.doDrawLine(sData, clip, comp, color, x1, y1, x2, y2); + } +- void doDrawRect(SurfaceData sData, ++ void doDrawRect(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int x, int y, int w, int h) + { + GraphicsPrimitive.tracePrimitive("GDIDrawRect"); + super.doDrawRect(sData, clip, comp, color, x, y, w, h); + } +- void doDrawRoundRect(SurfaceData sData, ++ void doDrawRoundRect(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int x, int y, int w, int h, + int arcW, int arcH) +@@ -301,14 +359,14 @@ public class GDIRenderer implements + super.doDrawRoundRect(sData, clip, comp, color, + x, y, w, h, arcW, arcH); + } +- void doDrawOval(SurfaceData sData, ++ void doDrawOval(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int x, int y, int w, int h) + { + GraphicsPrimitive.tracePrimitive("GDIDrawOval"); + super.doDrawOval(sData, clip, comp, color, x, y, w, h); + } +- void doDrawArc(SurfaceData sData, ++ void doDrawArc(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int x, int y, int w, int h, + int angleStart, int angleExtent) +@@ -317,7 +375,7 @@ public class GDIRenderer implements + super.doDrawArc(sData, clip, comp, color, x, y, w, h, + angleStart, angleExtent); + } +- void doDrawPoly(SurfaceData sData, ++ void doDrawPoly(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int transx, int transy, + int[] xpoints, int[] ypoints, +@@ -327,14 +385,14 @@ public class GDIRenderer implements + super.doDrawPoly(sData, clip, comp, color, transx, transy, + xpoints, ypoints, npoints, isclosed); + } +- void doFillRect(SurfaceData sData, ++ void doFillRect(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int x, int y, int w, int h) + { + GraphicsPrimitive.tracePrimitive("GDIFillRect"); + super.doFillRect(sData, clip, comp, color, x, y, w, h); + } +- void doFillRoundRect(SurfaceData sData, ++ void doFillRoundRect(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int x, int y, int w, int h, + int arcW, int arcH) +@@ -343,14 +401,14 @@ public class GDIRenderer implements + super.doFillRoundRect(sData, clip, comp, color, + x, y, w, h, arcW, arcH); + } +- void doFillOval(SurfaceData sData, ++ void doFillOval(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int x, int y, int w, int h) + { + GraphicsPrimitive.tracePrimitive("GDIFillOval"); + super.doFillOval(sData, clip, comp, color, x, y, w, h); + } +- void doFillArc(SurfaceData sData, ++ void doFillArc(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int x, int y, int w, int h, + int angleStart, int angleExtent) +@@ -359,7 +417,7 @@ public class GDIRenderer implements + super.doFillArc(sData, clip, comp, color, x, y, w, h, + angleStart, angleExtent); + } +- void doFillPoly(SurfaceData sData, ++ void doFillPoly(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int transx, int transy, + int[] xpoints, int[] ypoints, +@@ -369,7 +427,7 @@ public class GDIRenderer implements + super.doFillPoly(sData, clip, comp, color, transx, transy, + xpoints, ypoints, npoints); + } +- void doShape(SurfaceData sData, ++ void doShape(GDIWindowSurfaceData sData, + Region clip, Composite comp, int color, + int transX, int transY, + Path2D.Float p2df, boolean isfill) +@@ -380,7 +438,7 @@ public class GDIRenderer implements + super.doShape(sData, clip, comp, color, + transX, transY, p2df, isfill); + } +- public void devCopyArea(SurfaceData sData, ++ public void devCopyArea(GDIWindowSurfaceData sData, + int srcx, int srcy, + int dx, int dy, + int w, int h) +diff --git a/src/windows/native/sun/java2d/windows/GDIRenderer.cpp b/src/windows/native/sun/java2d/windows/GDIRenderer.cpp +--- openjdk/jdk/src/windows/native/sun/java2d/windows/GDIRenderer.cpp ++++ openjdk/jdk/src/windows/native/sun/java2d/windows/GDIRenderer.cpp +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 1999, 2008, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 1999, 2011, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -117,7 +117,7 @@ static POINT *TransformPoly(jint *xpoint + /* + * Class: sun_java2d_windows_GDIRenderer + * Method: doDrawLine +- * Signature: (Lsun/java2d/SurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;IIIII)V ++ * Signature: (Lsun/java2d/windows/GDIWindowSurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;IIIII)V + */ + JNIEXPORT void JNICALL + Java_sun_java2d_windows_GDIRenderer_doDrawLine +@@ -164,7 +164,7 @@ Java_sun_java2d_windows_GDIRenderer_doDr + /* + * Class: sun_java2d_windows_GDIRenderer + * Method: doDrawRect +- * Signature: (Lsun/java2d/SurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;IIIII)V ++ * Signature: (Lsun/java2d/windows/GDIWindowSurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;IIIII)V + */ + JNIEXPORT void JNICALL + Java_sun_java2d_windows_GDIRenderer_doDrawRect +@@ -209,7 +209,7 @@ Java_sun_java2d_windows_GDIRenderer_doDr + /* + * Class: sun_java2d_windows_GDIRenderer + * Method: doDrawRoundRect +- * Signature: (Lsun/java2d/SurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;IIIIIII)V ++ * Signature: (Lsun/java2d/windows/GDIWindowSurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;IIIIIII)V + */ + JNIEXPORT void JNICALL + Java_sun_java2d_windows_GDIRenderer_doDrawRoundRect +@@ -253,7 +253,7 @@ Java_sun_java2d_windows_GDIRenderer_doDr + /* + * Class: sun_java2d_windows_GDIRenderer + * Method: doDrawOval +- * Signature: (Lsun/java2d/SurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;IIIII)V ++ * Signature: (Lsun/java2d/windows/GDIWindowSurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;IIIII)V + */ + JNIEXPORT void JNICALL + Java_sun_java2d_windows_GDIRenderer_doDrawOval +@@ -291,7 +291,7 @@ Java_sun_java2d_windows_GDIRenderer_doDr + /* + * Class: sun_java2d_windows_GDIRenderer + * Method: doDrawArc +- * Signature: (Lsun/java2d/SurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;IIIIIII)V ++ * Signature: (Lsun/java2d/windows/GDIWindowSurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;IIIIIII)V + */ + JNIEXPORT void JNICALL + Java_sun_java2d_windows_GDIRenderer_doDrawArc +@@ -347,7 +347,7 @@ Java_sun_java2d_windows_GDIRenderer_doDr + /* + * Class: sun_java2d_windows_GDIRenderer + * Method: doDrawPoly +- * Signature: (Lsun/java2d/SurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;III[I[IIZ)V ++ * Signature: (Lsun/java2d/windows/GDIWindowSurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;III[I[IIZ)V + */ + JNIEXPORT void JNICALL + Java_sun_java2d_windows_GDIRenderer_doDrawPoly +@@ -412,7 +412,7 @@ Java_sun_java2d_windows_GDIRenderer_doDr + /* + * Class: sun_java2d_windows_GDIRenderer + * Method: doFillRect +- * Signature: (Lsun/java2d/SurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;IIIII)V ++ * Signature: (Lsun/java2d/windows/GDIWindowSurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;IIIII)V + */ + JNIEXPORT void JNICALL + Java_sun_java2d_windows_GDIRenderer_doFillRect +@@ -445,7 +445,7 @@ Java_sun_java2d_windows_GDIRenderer_doFi + /* + * Class: sun_java2d_windows_GDIRenderer + * Method: doFillRoundRect +- * Signature: (Lsun/java2d/SurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;IIIIIII)V ++ * Signature: (Lsun/java2d/windows/GDIWindowSurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;IIIIIII)V + */ + JNIEXPORT void JNICALL + Java_sun_java2d_windows_GDIRenderer_doFillRoundRect +@@ -488,7 +488,7 @@ Java_sun_java2d_windows_GDIRenderer_doFi + /* + * Class: sun_java2d_windows_GDIRenderer + * Method: doFillOval +- * Signature: (Lsun/java2d/SurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;IIIII)V ++ * Signature: (Lsun/java2d/windows/GDIWindowSurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;IIIII)V + */ + JNIEXPORT void JNICALL + Java_sun_java2d_windows_GDIRenderer_doFillOval +@@ -555,7 +555,7 @@ Java_sun_java2d_windows_GDIRenderer_doFi + /* + * Class: sun_java2d_windows_GDIRenderer + * Method: doFillArc +- * Signature: (Lsun/java2d/SurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;IIIIIII)V ++ * Signature: (Lsun/java2d/windows/GDIWindowSurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;IIIIIII)V + */ + JNIEXPORT void JNICALL + Java_sun_java2d_windows_GDIRenderer_doFillArc +@@ -615,7 +615,7 @@ Java_sun_java2d_windows_GDIRenderer_doFi + /* + * Class: sun_java2d_windows_GDIRenderer + * Method: doFillPoly +- * Signature: (Lsun/java2d/SurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;III[I[II)V ++ * Signature: (Lsun/java2d/windows/GDIWindowSurfaceData;Lsun/java2d/pipe/Region;Ljava/awt/Composite;III[I[II)V + */ + JNIEXPORT void JNICALL + Java_sun_java2d_windows_GDIRenderer_doFillPoly +@@ -680,7 +680,7 @@ Java_sun_java2d_windows_GDIRenderer_doFi + /* + * Class: sun_java2d_windows_GDIRenderer + * Method: doShape +- * Signature: (Lsun/java2d/SurfaceData;Lsun/java2d/pipe/Region; ++ * Signature: (Lsun/java2d/windows/GDIWindowSurfaceData;Lsun/java2d/pipe/Region; + * Ljava/awt/Composite;IIILjava/awt/geom/Path2D.Float;Z)V + */ + JNIEXPORT void JNICALL +@@ -863,7 +863,7 @@ INLINE BOOL RectInMonitorRect(RECT *rChe + /* + * Class: sun_java2d_windows_GDIRenderer + * Method: devCopyArea +- * Signature: (Lsun/awt/windows/SurfaceData;IIIIII)V ++ * Signature: (Lsun/java2d/windows/GDIWindowSurfaceData;IIIIII)V + */ + JNIEXPORT void JNICALL + Java_sun_java2d_windows_GDIRenderer_devCopyArea
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/patches/security/20120214/7118283.patch Thu Feb 09 17:05:26 2012 +0000 @@ -0,0 +1,27 @@ +# HG changeset patch +# User asaha +# Date 1323826839 28800 +# Node ID 71ca2b40fdc9fd542d565ccd9f2f14861556a417 +# Parent ee0f12b18cb8d20c3fb61e96817bde6318a29221 +7118283: Better input parameter checking in zip file processing +Reviewed-by: sherman + +diff --git a/src/share/native/java/util/zip/zip_util.c b/src/share/native/java/util/zip/zip_util.c +--- openjdk/jdk/src/share/native/java/util/zip/zip_util.c ++++ openjdk/jdk/src/share/native/java/util/zip/zip_util.c +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 1995, 2006, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 1995, 2011, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -450,7 +450,7 @@ countCENHeaders(unsigned char *beg, unsi + { + jint count = 0; + ptrdiff_t i; +- for (i = 0; i + CENHDR < end - beg; i += CENSIZE(beg + i)) ++ for (i = 0; i + CENHDR <= end - beg; i += CENSIZE(beg + i)) + count++; + return count; + }
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/patches/security/20120214/7126960.patch Thu Feb 09 17:05:26 2012 +0000 @@ -0,0 +1,82 @@ +# HG changeset patch +# User coffeys +# Date 1326712887 0 +# Node ID 2d8dead332cbe169d486ecc70239475ebe3a77f7 +# Parent a224904d42db1f54139257221e9b545bd1c90b2e +7126960: Add property to limit number of request headers to the HTTP Server +Reviewed-by: chegar + +diff --git a/src/share/classes/sun/net/httpserver/Request.java b/src/share/classes/sun/net/httpserver/Request.java +--- openjdk/jdk/src/share/classes/sun/net/httpserver/Request.java ++++ openjdk/jdk/src/share/classes/sun/net/httpserver/Request.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2005, 2006, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 2005, 2012, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -190,6 +190,13 @@ class Request { + v = new String(); + else + v = String.copyValueOf(s, keyend, len - keyend); ++ ++ if (hdrs.size() >= ServerConfig.getMaxReqHeaders()) { ++ throw new IOException("Maximum number of request headers (" + ++ "sun.net.httpserver.maxReqHeaders) exceeded, " + ++ ServerConfig.getMaxReqHeaders() + "."); ++ } ++ + hdrs.add (k,v); + } + return hdrs; +diff --git a/src/share/classes/sun/net/httpserver/ServerConfig.java b/src/share/classes/sun/net/httpserver/ServerConfig.java +--- openjdk/jdk/src/share/classes/sun/net/httpserver/ServerConfig.java ++++ openjdk/jdk/src/share/classes/sun/net/httpserver/ServerConfig.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2005, 2006, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 2005, 2012, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -45,6 +45,8 @@ class ServerConfig { + static long defaultIdleInterval = 300 ; // 5 min + static long defaultSelCacheTimeout = 120 ; // seconds + static int defaultMaxIdleConnections = 200 ; ++ static int defaultMaxReqHeaders = 200 ; ++ + + static long defaultDrainAmount = 64 * 1024; + +@@ -54,6 +56,9 @@ class ServerConfig { + static long selCacheTimeout; + static long drainAmount; // max # of bytes to drain from an inputstream + static int maxIdleConnections; ++ // The maximum number of request headers allowable ++ private static int maxReqHeaders; ++ + static boolean debug = false; + + static { +@@ -93,6 +98,11 @@ class ServerConfig { + "sun.net.httpserver.drainAmount", + defaultDrainAmount))).longValue(); + ++ maxReqHeaders = ((Integer)java.security.AccessController.doPrivileged( ++ new sun.security.action.GetIntegerAction( ++ "sun.net.httpserver.maxReqHeaders", ++ defaultMaxReqHeaders))).intValue(); ++ + debug = ((Boolean)java.security.AccessController.doPrivileged( + new sun.security.action.GetBooleanAction( + "sun.net.httpserver.debug"))).booleanValue(); +@@ -129,4 +139,8 @@ class ServerConfig { + static long getDrainAmount () { + return drainAmount; + } ++ ++ static int getMaxReqHeaders() { ++ return maxReqHeaders; ++ } + }