--- a/.hgtags	Mon Oct 19 09:22:51 2015 +0100
+++ b/.hgtags	Mon Oct 19 09:48:09 2015 +0100
@@ -644,3 +644,4 @@
 7a91bf11c82bd794b7d6f63187345ebcbe07f37c jdk7u85-b02
 10bb9df77e39518afc9f65e7fdc7328bb0fb80dd icedtea-2.6.2pre01
 0445c54dcfb6cd523525a07eec0f2b26c43eb3c4 icedtea-2.6.2pre02
+f9630ed441a06612f61a88bd3da39075015213a7 jdk7u91-b00

--- a/src/share/classes/com/sun/corba/se/impl/io/IIOPInputStream.java	Mon Oct 19 09:22:51 2015 +0100
+++ b/src/share/classes/com/sun/corba/se/impl/io/IIOPInputStream.java	Mon Oct 19 09:48:09 2015 +0100
@@ -567,6 +567,11 @@
                 // XXX I18N, logging needed.
                 throw new NotActiveException("defaultReadObjectDelegate");
 
+            if (!currentClassDesc.forClass().isAssignableFrom(
+                    currentObject.getClass())) {
+                throw new IOException("Object Type mismatch");
+            }
+
             // The array will be null unless fields were retrieved
             // remotely because of a serializable version difference.
             // Bug fix for 4365188.  See the definition of
@@ -1063,6 +1068,9 @@
 
             int spBase = spClass;       // current top of stack
 
+            if (currentClass.getName().equals("java.lang.String")) {
+                return this.readUTF();
+            }
             /* The object's classes should be processed from supertype to subtype
              * Push all the clases of the current object onto a stack.
              * Note that only the serializable classes are represented
@@ -2244,6 +2252,27 @@
 
                 try {
                     Class fieldCl = fields[i].getClazz();
+                    if ((objectValue != null)
+                            && (!fieldCl.isAssignableFrom(
+                                    objectValue.getClass()))) {
+                        throw new IllegalArgumentException("Field mismatch");
+                    }
+                   Field classField = null;
+                    try {
+                        classField = cl.getDeclaredField(fields[i].getName());
+                    } catch (NoSuchFieldException nsfEx) {
+                        throw new IllegalArgumentException(nsfEx);
+                    } catch (SecurityException secEx) {
+                        throw new IllegalArgumentException(secEx.getCause());
+                    }
+                    Class<?> declaredFieldClass = classField.getType();
+
+                    // check input field type is a declared field type
+                    // input field is a subclass of the declared field
+                    if (!declaredFieldClass.isAssignableFrom(fieldCl)) {
+                        throw new IllegalArgumentException(
+                                "Field Type mismatch");
+                    }
                     if (objectValue != null && !fieldCl.isInstance(objectValue)) {
                         throw new IllegalArgumentException();
                     }

--- a/src/share/classes/com/sun/corba/se/impl/io/IIOPOutputStream.java	Mon Oct 19 09:22:51 2015 +0100
+++ b/src/share/classes/com/sun/corba/se/impl/io/IIOPOutputStream.java	Mon Oct 19 09:48:09 2015 +0100
@@ -559,6 +559,10 @@
              * Push all the clases of the current object onto a stack.
              * Remember the stack pointer where this set of classes is being pushed.
              */
+            if (currentClassDesc.forClass().getName().equals("java.lang.String")) {
+                    this.writeUTF((String)obj);
+                    return;
+            }
             int stackMark = classDescStack.size();
             try {
                 ObjectStreamClass next;

--- a/src/share/classes/sun/rmi/rmic/iiop/StubGenerator.java	Mon Oct 19 09:22:51 2015 +0100
+++ b/src/share/classes/sun/rmi/rmic/iiop/StubGenerator.java	Mon Oct 19 09:48:09 2015 +0100
@@ -446,6 +446,9 @@
         if (emitPermissionCheck) {
 
             // produce the following generated code
+            //
+            // private transient boolean _instantiated = false;
+            //
             // private static Void checkPermission() {
             // SecurityManager sm = System.getSecurityManager();
             // if (sm != null) {
@@ -460,10 +463,21 @@
             //
             // public _XXXXXX_Stub() {
             // this(checkPermission());
+            // _instantiated = true;
             // }
+            //
+            // private void readObject(java.io.ObjectInputStream s) throws IOException, ClassNotFoundException {
+            //    checkPermission();
+            //    s.defaultReadObject();
+            //    _instantiated = true;
+            // }
+            //
             // where XXXXXX is the name of the remote interface
 
                 p.pln();
+                p.plnI("private transient boolean _instantiated = false;");
+                p.pln();
+                p.pO();
                 p.plnI("private static Void checkPermission() {");
                 p.plnI("SecurityManager sm = System.getSecurityManager();");
                 p.pln("if (sm != null) {");
@@ -480,13 +494,23 @@
                 p.pO();
 
                 p.pI();
-                p.pln("private " + currentClass + "(Void ignore) {  }");
+                p.plnI("private " + currentClass + "(Void ignore) {  }");
                 p.pln();
-
-                p.plnI("public " + currentClass + "() { ");
+                p.pO();
+
+                p.plnI("public " + currentClass + "() {");
                 p.pln("this(checkPermission());");
+                p.pln("_instantiated = true;");
                 p.pOln("}");
                 p.pln();
+                p.plnI("private void readObject(java.io.ObjectInputStream s) throws IOException, ClassNotFoundException {");
+                p.plnI("checkPermission();");
+                p.pO();
+                p.pln("s.defaultReadObject();");
+                p.pln("_instantiated = true;");
+                p.pOln("}");
+                p.pln();
+                //p.pO();
         }
 
        if (!emitPermissionCheck) {
@@ -893,6 +917,7 @@
         String paramNames[] = method.getArgumentNames();
         Type returnType = method.getReturnType();
         ValueType[] exceptions = getStubExceptions(method,false);
+        boolean hasIOException = false;
 
         addNamesInUse(method);
         addNameInUse("_type_ids");
@@ -920,6 +945,13 @@
         p.plnI(" {");
 
         // Now create the method body...
+        if (emitPermissionCheck) {
+            p.pln("if ((System.getSecurityManager() != null) && (!_instantiated)) {");
+            p.plnI("    throw new java.io.IOError(new java.io.IOException(\"InvalidObject \"));");
+            p.pOln("}");
+            p.pln();
+        }
+
 
         if (localStubs) {
             writeLocalStubMethodBody(p,method,theType);