1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
|
/*
* Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* @test
* @bug 8306461
* @summary ObjectInputStream::readObject() should handle negative array sizes without throwing NegativeArraySizeExceptions
* @run main/othervm NegativeArraySizeTest
*/
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.InvalidClassException;
import java.io.IOException;
import java.io.ObjectInputFilter;
import java.io.ObjectInputFilter.Status;
import java.util.PriorityQueue;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.ObjectStreamException;
public class NegativeArraySizeTest {
private static byte[] buildArrayPayload() throws IOException {
// Serialize to bytes
ByteArrayOutputStream baos = new ByteArrayOutputStream();
ObjectOutputStream oos = new ObjectOutputStream(baos);
oos.writeObject(new String[1]);
oos.close();
byte[] serializedData = baos.toByteArray();
// Find the right location to modify, looking for the first instance of TC_ENDBLOCKDATA
int firstPos = 0;
for (int i = 0; i < serializedData.length - 1; i++) {
// 0x78 = TC_ENDBLOCKDATA
if (serializedData[i] == 0x78) {
// Replace array length with -2
serializedData[i + 2] = (byte) 0xff;
serializedData[i + 3] = (byte) 0xff;
serializedData[i + 4] = (byte) 0xff;
serializedData[i + 5] = (byte) 0xfe;
return serializedData;
}
}
throw new RuntimeException("Can't find TC_ENDBLOCKDATA in object output stream");
}
private static byte[] buildPriorityQueuePayload() throws IOException {
// Serialize to bytes
ByteArrayOutputStream baos = new ByteArrayOutputStream();
ObjectOutputStream oos = new ObjectOutputStream(baos);
oos.writeObject(new PriorityQueue<>());
oos.close();
byte[] serializedData = baos.toByteArray();
// Find the right location to modify, looking for the first instance of TC_BLOCKDATA
int firstPos = 0;
for (int i = 0; i < serializedData.length - 1; i++) {
// 0x77 = TC_BLOCKDATA
if (serializedData[i] == 0x77) {
// Replace array length with -3
serializedData[i - 5] = (byte) 0xff;
serializedData[i - 4] = (byte) 0xff;
serializedData[i - 3] = (byte) 0xff;
serializedData[i - 2] = (byte) 0xfd;
return serializedData;
}
}
throw new RuntimeException("Can't find TC_BLOCKDATA in object output stream");
}
private static class CustomFilter implements ObjectInputFilter {
@Override
public Status checkInput(FilterInfo filterInfo) {
Class<?> cl = filterInfo.serialClass();
if (cl != null && cl.isArray() && filterInfo.arrayLength() < -1) {
throw new RuntimeException("FilterInfo.arrayLength() must be >= -1 for arrays (was " + filterInfo.arrayLength() + ")");
}
return Status.ALLOWED;
}
}
public static void main(String[] args) throws Exception {
// Test object input stream with negative sized array
try (ByteArrayInputStream bais = new ByteArrayInputStream(buildArrayPayload());
ObjectInputStream ois = new ObjectInputStream(bais)) {
ois.readObject();
} catch (NegativeArraySizeException nase) {
throw new Exception("ObjectInputStream::readObject() shouldn't throw a NegativeArraySizeException", nase);
} catch (ObjectStreamException ose) {
// OK, because a NegativeArraySizeException should be converted into an ObjectStreamException
if (!"Array length is negative".equals(ose.getMessage())) {
throw new Exception("Expected \"Array length is negative\" as exception message", ose);
}
}
// Test object input stream with negative sized array and custom object input filter
try (ByteArrayInputStream bais = new ByteArrayInputStream(buildArrayPayload());
ObjectInputStream ois = new ObjectInputStream(bais)) {
ois.setObjectInputFilter(new CustomFilter());
ois.readObject();
} catch (NegativeArraySizeException nase) {
throw new Exception("ObjectInputStream::readObject() shouldn't throw a NegativeArraySizeException", nase);
} catch (ObjectStreamException ose) {
if (ose instanceof InvalidClassException ice && ice.getMessage().contains("filter status: REJECTED")) {
throw new Exception("ObjectInputStream::readObject() should catch NegativeArraySizeExceptions before filtering", ice);
}
// OK, because a NegativeArraySizeException should be converted into an ObjectStreamException *before* filtering
if (!"Array length is negative".equals(ose.getMessage())) {
throw new Exception("Expected \"Array length is negative\" as exception message", ose);
}
}
// Test object input stream with negative sized PriorityQueue
try (ByteArrayInputStream bais = new ByteArrayInputStream(buildPriorityQueuePayload());
ObjectInputStream ois = new ObjectInputStream(bais)) {
ois.readObject();
} catch (NegativeArraySizeException nase) {
throw new Exception("ObjectInputStream::readObject() shouldn't throw a NegativeArraySizeException", nase);
} catch (ObjectStreamException ose) {
// OK, because a NegativeArraySizeException should be converted into an ObjectStreamException
if (!"Array length is negative".equals(ose.getMessage())) {
throw new Exception("Expected \"Array length is negative\" as exception message", ose);
}
}
}
}
|
