Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8016252

More defensive HashSet.readObject

    Details

    • Type: Bug
    • Status: Closed
    • Priority: P3
    • Resolution: Fixed
    • Affects Version/s: 8
    • Fix Version/s: 8
    • Component/s: core-libs
    • Labels:
    • Subcomponent:
    • Resolved In Build:
      b113
    • Verification:
      Verified

      Backports

        Description

        HashSet.readObject should validate its serial data, similar to what is done in HashMap.

        diff --git a/src/share/classes/java/util/HashSet.java b/src/share/classes/java/util/HashSet.java
        --- a/src/share/classes/java/util/HashSet.java
        +++ b/src/share/classes/java/util/HashSet.java
        @@ -24,6 +24,8 @@
          */

         package java.util;
        +
        +import java.io.InvalidObjectException;

         /**
          * This class implements the <tt>Set</tt> interface, backed by a hash table
        @@ -293,17 +295,20 @@ public class HashSet<E>
                 throws java.io.IOException, ClassNotFoundException {
                 // Read in any hidden serialization magic
                 s.defaultReadObject();
        -
        - // Read in HashMap capacity and load factor and create backing HashMap
        - int capacity = s.readInt();
        + s.readInt(); // Read and ignore capacity
                 float loadFactor = s.readFloat();
        + if (loadFactor <= 0 || Float.isNaN(loadFactor))
        + throw new InvalidObjectException("Illegal load factor: " +
        + loadFactor);
        + int size = s.readInt();
        + if (size < 0)
        + throw new InvalidObjectException("Illegal element count: " + size);
        + // Compute capacity by number of elements and desired load (if >= 0.25)
        + int capacity = (int)Math.min(size * Math.min(1 / loadFactor, 4.0f),
        + HashMap.MAXIMUM_CAPACITY);
                 map = (((HashSet<?>)this) instanceof LinkedHashSet ?
                        new LinkedHashMap<E,Object>(capacity, loadFactor) :
                        new HashMap<E,Object>(capacity, loadFactor));
        -
        - // Read in size
        - int size = s.readInt();
        -
                 // Read in all elements in the proper order.
                 for (int i=0; i<size; i++) {
                     @SuppressWarnings("unchecked")

          Attachments

            Issue Links

              Activity

                People

                • Assignee:
                  bpb Brian Burkhalter
                  Reporter:
                  chegar Chris Hegarty
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  6 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved: