infernap12/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2026-05-23 03:48:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

6686215: Some mutables not defensively copied when deserializing java.security.CodeSource & Timestamp objects

Browse Source 
Reviewed-by: mullan
This commit is contained in:
Vinnie Ryan 2011-03-14 17:50:52 +00:00
parent 31942cda2c
commit 1dc9c053c4
2 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
jdk/src/share/classes/java/security/CodeSource.java
View File

@ -1,5 +1,5 @@
/*
* Copyright (c) 1997, 2006, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 1997, 2011, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -578,7 +578,7 @@ public class CodeSource implements java.io.Serializable {
// Deserialize array of code signers (if any)
try {
this.signers = (CodeSigner[])ois.readObject();
this.signers = ((CodeSigner[])ois.readObject()).clone();
} catch (IOException ioe) {
// no signers present
}

7
jdk/src/share/classes/java/security/Timestamp.java
View File

@ -1,5 +1,5 @@
/*
* Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2003, 2011, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -157,7 +157,8 @@ public final class Timestamp implements Serializable {
// Explicitly reset hash code value to -1
private void readObject(ObjectInputStream ois)
throws IOException, ClassNotFoundException {
ois.defaultReadObject();
myhash = -1;
ois.defaultReadObject();
myhash = -1;
timestamp = new Date(timestamp.getTime());
}
}