OpenJDK / jdk / hs

changeset 41120:c730063ccd48

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
8049516: sun.security.provider.SeedGenerator throws ArrayIndexOutOfBoundsException Summary: Prevent the latch inside ThreadedSeedGenerator.run() from overflowing into a negative value causing a negative index array lookup. Reviewed-by: xuelei, weijun
author jnimeh
date Thu, 22 Sep 2016 07:28:40 -0700
parents 2ca17e55ddf2
children 91734a3ed04b
files jdk/src/java.base/share/classes/sun/security/provider/SeedGenerator.java
diffstat 1 files changed, 6 insertions(+), 4 deletions(-) [+]
line wrap: on
line diff
--- a/jdk/src/java.base/share/classes/sun/security/provider/SeedGenerator.java	Wed Sep 21 09:29:30 2016 -0700
+++ b/jdk/src/java.base/share/classes/sun/security/provider/SeedGenerator.java	Thu Sep 22 07:28:40 2016 -0700
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2015, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -344,7 +344,8 @@
                         try {
                             BogusThread bt = new BogusThread();
                             Thread t = new Thread
-                                (seedGroup, bt, "SeedGenerator Thread", 0, false);
+                                (seedGroup, bt, "SeedGenerator Thread", 0,
+                                        false);
                             t.start();
                         } catch (Exception e) {
                             throw new InternalError("internal error: " +
@@ -357,7 +358,8 @@
                         long startTime = System.nanoTime();
                         while (System.nanoTime() - startTime < 250000000) {
                             synchronized(this){};
-                            latch++;
+                            // Mask the sign bit and keep latch non-negative
+                            latch = (latch + 1) & 0x1FFFFFFF;
                         }
 
                         // Translate the value using the permutation, and xor
@@ -431,7 +433,7 @@
         // data and using it to mix the trivial permutation.
         // It should be evenly distributed. The specific values
         // are not crucial to the security of this class.
-        private static byte[] rndTab = {
+        private static final byte[] rndTab = {
             56, 30, -107, -6, -86, 25, -83, 75, -12, -64,
             5, -128, 78, 21, 16, 32, 70, -81, 37, -51,
             -43, -46, -108, 87, 29, 17, -55, 22, -11, -111,
© 2007, 2021 Oracle and/or its affiliates
Terms of Use · Privacy · Trademarks