Mercurial > hg > release > icedtea7-forest-2.0 > jdk

changeset 4579:962ddd5ea2d9

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
7088367: JavaSound security issue (12865443) Reviewed-by: denis
author amenkov
date Wed, 26 Oct 2011 13:35:15 +0400
parents d063a88899f9
children 4fe44cde3384
files src/share/classes/com/sun/media/sound/DirectAudioDevice.java src/share/classes/com/sun/media/sound/SoftMixingSourceDataLine.java
diffstat 2 files changed, 8 insertions(+), 2 deletions(-) [+]
line wrap: on
line diff
--- a/src/share/classes/com/sun/media/sound/DirectAudioDevice.java	Thu Oct 13 11:44:40 2011 +0100
+++ b/src/share/classes/com/sun/media/sound/DirectAudioDevice.java	Wed Oct 26 13:35:15 2011 +0400
@@ -736,7 +736,7 @@
             if (off < 0) {
                 throw new ArrayIndexOutOfBoundsException(off);
             }
-            if (off + len > b.length) {
+            if ((long)off + (long)len > (long)b.length) {
                 throw new ArrayIndexOutOfBoundsException(b.length);
             }
 
@@ -964,7 +964,7 @@
             if (off < 0) {
                 throw new ArrayIndexOutOfBoundsException(off);
             }
-            if (off + len > b.length) {
+            if ((long)off + (long)len > (long)b.length) {
                 throw new ArrayIndexOutOfBoundsException(b.length);
             }
             if (!isActive() && doIO) {
--- a/src/share/classes/com/sun/media/sound/SoftMixingSourceDataLine.java	Thu Oct 13 11:44:40 2011 +0100
+++ b/src/share/classes/com/sun/media/sound/SoftMixingSourceDataLine.java	Wed Oct 26 13:35:15 2011 +0400
@@ -130,6 +130,12 @@
         if (len % framesize != 0)
             throw new IllegalArgumentException(
                     "Number of bytes does not represent an integral number of sample frames.");
+        if (off < 0) {
+            throw new ArrayIndexOutOfBoundsException(off);
+        }
+        if ((long)off + (long)len > (long)b.length) {
+            throw new ArrayIndexOutOfBoundsException(b.length);
+        }
 
         byte[] buff = cycling_buffer;
         int buff_len = cycling_buffer.length;