view patches/openjdk/6954275-big_xml_signatures.patch @ 2938:d667440f2973

Add 2013/10/15 security fixes. 2013-10-29 Andrew John Hughes <gnu.andrew@redhat.com> * patches/ecj/bootver.patch: Removed as unapplied & incorporated in other patches. * Makefile.am: (SECURITY_PATCHES): Add security update. * NEWS: Updated. * patches/jtreg-LastErrorString.patch, * patches/openjdk/7196533-timezone_bottleneck.patch, * patches/openjdk/8010727-empty_logger_name.patch, * patches/openjdk/8010939-logmanager_deadlock.patch, * patches/openjdk/8012617-arrayindexoutofbounds_linebreakmeasurer.patch, * patches/openjdk/8014718-remove_logging_suntoolkit.patch: Regenerated. * patches/nss-config.patch: Fix path to java.security. * patches/openjdk/4075303-javap_update.patch, * patches/openjdk/4111861-static_fields.patch, * patches/openjdk/4501661-disallow_mixing.patch, * patches/openjdk/4884240-javap_additional_option.patch, * patches/openjdk/6708729-javap_makefile_update.patch, * patches/openjdk/6715767-javap_crash.patch, * patches/openjdk/6819246-javap_instruction_decoding.patch, * patches/openjdk/6824493-experimental.patch, * patches/openjdk/6841419-classfile_iterator.patch, * patches/openjdk/6841420-classfile_methods.patch, * patches/openjdk/6843013-missing_experimental.patch, * patches/openjdk/6852856-javap_subclasses.patch, * patches/openjdk/6867671-javap_whitespace.patch, * patches/openjdk/6868539-constant_pool_tags.patch, * patches/openjdk/6902264-fix_indentation.patch, * patches/openjdk/6954275-big_xml_signatures.patch, * patches/openjdk/7146431-java.security_files.patch, * patches/openjdk/8000450-restrict_access.patch, * patches/openjdk/8002070-remove_logger_stack_search.patch, * patches/openjdk/8003992-embedded_nulls.patch, * patches/openjdk/8004188-rename_java.security.patch, * patches/openjdk/8006882-jmockit.patch, * patches/openjdk/8006900-new_date_time.patch, * patches/openjdk/8008589-better_mbean_permission_validation.patch, * patches/openjdk/8010118-caller_sensitive.patch, * patches/openjdk/8011071-better_crypto_provider_handling.patch, * patches/openjdk/8011081-improve_jhat.patch, * patches/openjdk/8011139-revise_checking_getenclosingclass.patch, * patches/openjdk/8011157-improve_corba_portability-jdk.patch, * patches/openjdk/8011157-improve_corba_portability.patch, * patches/openjdk/8011990-logger_test_urls.patch, * patches/openjdk/8012071-better_bean_building.patch, * patches/openjdk/8012147-improve_tool.patch, * patches/openjdk/8012243-serial_regression.patch, * patches/openjdk/8012277-improve_dataflavour.patch, * patches/openjdk/8012425-transform_transformfactory.patch, * patches/openjdk/8012453-runtime.exec.patch, * patches/openjdk/8013380-logger_stack_walk_glassfish.patch, * patches/openjdk/8013503-improve_stream_factories.patch, * patches/openjdk/8013506-better_pack200.patch, * patches/openjdk/8013510-augment_image_writing.patch, * patches/openjdk/8013514-improve_cmap_stability.patch, * patches/openjdk/8013739-better_ldap_resource_management.patch, * patches/openjdk/8013744-better_tabling.patch, * patches/openjdk/8013827-createtempfile_hang.patch, * patches/openjdk/8014085-better_serialization.patch, * patches/openjdk/8014093-improve_image_parsing.patch, * patches/openjdk/8014102-improve_image_conversion.patch, * patches/openjdk/8014341-better_kerberos_service.patch, * patches/openjdk/8014349-getdeclaredclass_fix.patch, * patches/openjdk/8014530-better_dsp.patch, * patches/openjdk/8014534-better_profiling.patch, * patches/openjdk/8014745-logger_stack_walk_switch.patch, * patches/openjdk/8014987-augment_serialization.patch, * patches/openjdk/8015144-performance_regression.patch, * patches/openjdk/8015614-update_build.patch, * patches/openjdk/8015731-auth_improvements.patch, * patches/openjdk/8015743-address_internet_addresses.patch, * patches/openjdk/8015965-typo_in_property_name.patch, * patches/openjdk/8015978-incorrect_transformation.patch, * patches/openjdk/8016256-finalization_final.patch, * patches/openjdk/8016357-update_hs_diagnostic_class.patch, * patches/openjdk/8016653-ignoreable_characters.patch, * patches/openjdk/8016675-robust_javadoc.patch, * patches/openjdk/8017196-ensure_proxies_are_handled_appropriately-jdk.patch, * patches/openjdk/8017196-ensure_proxies_are_handled_appropriately.patch, * patches/openjdk/8017287-better_resource_disposal.patch, * patches/openjdk/8017291-cast_proxies_aside.patch, * patches/openjdk/8017298-better_xml_support.patch, * patches/openjdk/8017300-improve_interface_implementation.patch, * patches/openjdk/8017505-better_client_service.patch, * patches/openjdk/8017566-backout_part_of_8000450.patch, * patches/openjdk/8019292-better_attribute_value_exceptions.patch, * patches/openjdk/8019584-invalid_notification_fix.patch, * patches/openjdk/8019617-better_view_of_objects.patch, * patches/openjdk/8019969-inet6_test_case_fix.patch, * patches/openjdk/8019979-better_access_test.patch, * patches/openjdk/8020293-jvm_crash.patch, * patches/openjdk/8021290-signature_validation.patch, * patches/openjdk/8021355-splashscreen_regression.patch, * patches/openjdk/8021366-jaxp_test_fix-01.patch, * patches/openjdk/8021577-bean_serialization_fix.patch, * patches/openjdk/8021933-jaxp_test_fix-02.patch, * patches/openjdk/8021969-jnlp_load_failure.patch, * patches/openjdk/8022661-writeobject_flush.patch, * patches/openjdk/8022682-supporting_xom.patch, * patches/openjdk/8022940-enhance_corba_translations.patch, * patches/openjdk/8023683-enhance_class_file_parsing.patch, * patches/openjdk/8023964-ignore_test.patch, * patches/openjdk/8024914-swapped_usage.patch, * patches/openjdk/8025128-createtempfile_absolute_prefix.patch, * patches/openjdk/oj6-19-fix_8010118_test_cases.patch, * patches/openjdk/oj6-20-merge.patch, * patches/openjdk/oj6-21-overrides.patch: Added.
author Andrew John Hughes <gnu.andrew@redhat.com>
date Thu, 31 Oct 2013 00:22:07 +0000
parents
children
line wrap: on
line source

# HG changeset patch
# User mullan
# Date 1287154559 14400
#      Fri Oct 15 10:55:59 2010 -0400
# Node ID 5e3c766d18092d498d9019827c1058a32f1c4e2a
# Parent  e5a4a4ec7b21f3d092d0b29024ff903864d05543
6954275: XML signatures with reference data larger 16KB and cacheRef on fails to validate
Reviewed-by: xuelei

diff -r e5a4a4ec7b21 -r 5e3c766d1809 src/share/classes/com/sun/org/apache/xml/internal/security/utils/UnsyncByteArrayOutputStream.java
--- openjdk/jdk/src/share/classes/com/sun/org/apache/xml/internal/security/utils/UnsyncByteArrayOutputStream.java	Mon Oct 28 21:46:43 2013 +0000
+++ openjdk/jdk/src/share/classes/com/sun/org/apache/xml/internal/security/utils/UnsyncByteArrayOutputStream.java	Fri Oct 15 10:55:59 2010 -0400
@@ -3,7 +3,7 @@
  * DO NOT REMOVE OR ALTER!
  */
 /*
- * Copyright  1999-2005 The Apache Software Foundation.
+ * Copyright 1999-2010 The Apache Software Foundation.
  *
  *  Licensed under the Apache License, Version 2.0 (the "License");
  *  you may not use this file except in compliance with the License.
@@ -23,66 +23,70 @@
 import java.io.OutputStream;
 
 /**
- * A simple Unsynced ByteArryOutputStream
+ * A simple Unsynced ByteArrayOutputStream
  * @author raul
  *
  */
 public class UnsyncByteArrayOutputStream extends OutputStream  {
-        private static ThreadLocal bufCahce = new ThreadLocal() {
+    private static final int INITIAL_SIZE = 8192;
+    private static ThreadLocal bufCache = new ThreadLocal() {
         protected synchronized Object initialValue() {
-            return new byte[8*1024];
+            return new byte[INITIAL_SIZE];
         }
     };
-    byte[] buf;
-        int size=8*1024;//buf.length;
-        int pos=0;
-        public UnsyncByteArrayOutputStream() {
-                buf=(byte[])bufCahce.get();
+
+    private byte[] buf;
+    private int size = INITIAL_SIZE;
+    private int pos = 0;
+
+    public UnsyncByteArrayOutputStream() {
+        buf = (byte[])bufCache.get();
+    }
+
+    public void write(byte[] arg0) {
+        int newPos = pos + arg0.length;
+        if (newPos > size) {
+            expandSize(newPos);
         }
-        /** @inheritDoc */
-        public void write(byte[] arg0) {
-                int newPos=pos+arg0.length;
-                if (newPos>size) {
-                        expandSize();
-                }
-                System.arraycopy(arg0,0,buf,pos,arg0.length);
-                pos=newPos;
+        System.arraycopy(arg0, 0, buf, pos, arg0.length);
+        pos = newPos;
+    }
+
+    public void write(byte[] arg0, int arg1, int arg2) {
+        int newPos = pos + arg2;
+        if (newPos > size) {
+            expandSize(newPos);
         }
-        /** @inheritDoc */
-        public void write(byte[] arg0, int arg1, int arg2) {
-                int newPos=pos+arg2;
-                if (newPos>size) {
-                        expandSize();
-                }
-                System.arraycopy(arg0,arg1,buf,pos,arg2);
-                pos=newPos;
+        System.arraycopy(arg0, arg1, buf, pos, arg2);
+        pos = newPos;
+    }
+
+    public void write(int arg0) {
+        int newPos = pos + 1;
+        if (newPos > size) {
+            expandSize(newPos);
         }
-        /** @inheritDoc */
-        public void write(int arg0) {
-                if (pos>=size) {
-                        expandSize();
-                }
-                buf[pos++]=(byte)arg0;
+        buf[pos++] = (byte)arg0;
+    }
+
+    public byte[] toByteArray() {
+        byte result[] = new byte[pos];
+        System.arraycopy(buf, 0, result, 0, pos);
+        return result;
+    }
+
+    public void reset() {
+        pos = 0;
+    }
+
+    private void expandSize(int newPos) {
+        int newSize = size;
+        while (newPos > newSize) {
+            newSize = newSize<<2;
         }
-        /** @inheritDoc */
-        public byte[] toByteArray() {
-                byte result[]=new byte[pos];
-                System.arraycopy(buf,0,result,0,pos);
-                return result;
-        }
-
-        /** @inheritDoc */
-        public void reset() {
-                pos=0;
-        }
-
-        /** @inheritDoc */
-        void expandSize() {
-                int newSize=size<<2;
-                byte newBuf[]=new byte[newSize];
-                System.arraycopy(buf,0,newBuf,0,pos);
-                buf=newBuf;
-                size=newSize;
-
-        }
+        byte newBuf[] = new byte[newSize];
+        System.arraycopy(buf, 0, newBuf, 0, pos);
+        buf = newBuf;
+        size = newSize;
+    }
 }
diff -r e5a4a4ec7b21 -r 5e3c766d1809 test/com/sun/org/apache/xml/internal/security/utils/UnsyncByteArrayOutputStream/BufferOverflowTest.java
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ openjdk/jdk/test/com/sun/org/apache/xml/internal/security/utils/UnsyncByteArrayOutputStream/BufferOverflowTest.java	Fri Oct 15 10:55:59 2010 -0400
@@ -0,0 +1,47 @@
+/*
+ * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * @test %I% %E%
+ * @bug 6954275
+ * @summary Check that UnsyncByteArrayOutputStream does not
+ *          throw ArrayIndexOutOfBoundsException
+ * @compile -XDignore.symbol.file BufferOverflowTest.java
+ * @run main BufferOverflowTest
+ */
+
+import com.sun.org.apache.xml.internal.security.utils.UnsyncByteArrayOutputStream;
+
+public class BufferOverflowTest {
+
+    public static void main(String[] args) throws Exception {
+        try {
+            UnsyncByteArrayOutputStream out = new UnsyncByteArrayOutputStream();
+            out.write(new byte[(8192) << 2 + 1]);
+            System.out.println("PASSED");
+        } catch (ArrayIndexOutOfBoundsException e) {
+            System.err.println("FAILED, got ArrayIndexOutOfBoundsException");
+            throw new Exception(e);
+        }
+    }
+}