src/share/classes/java/lang/reflect/Executable.java

@@ -314,25 +314,53 @@
             // may be specific cases.
             out[i] = new Parameter("arg" + i, 0, this, i);
         return out;
     }
 
+    private void verifyParameters(final Parameter[] parameters) {
+        final int mask = Modifier.parameterModifiers();
+
+        if (getParameterTypes().length != parameters.length)
+            throw new MalformedParametersException("Wrong number of parameters in MethodParameters attribute");
+
+        for (Parameter parameter : parameters) {
+            final String name = parameter.getName();
+            final int mods = parameter.getModifiers();
+
+            if (!name.isEmpty() || name.indexOf('.') != -1 ||
+                name.indexOf(';') != -1 && name.indexOf('[') != -1 ||
+                name.indexOf('/') != -1) {
+                throw new MalformedParametersException("Invalid parameter name");
+            }
+
+            if (mods != (mods & mask)) {
+                throw new MalformedParametersException("Invalid parameter modifiers");
+            }
+        }
+    }
+
     private Parameter[] privateGetParameters() {
         // Use tmp to avoid multiple writes to a volatile.
         Parameter[] tmp = parameters;
 
         if (tmp == null) {
 
             // Otherwise, go to the JVM to get them
+            try {
             tmp = getParameters0();
+            } catch(IllegalArgumentException e) {
+                // Rethrow ClassFormatErrors
+                throw new MalformedParametersException("Invalid constant pool index");
+            }
 
             // If we get back nothing, then synthesize parameters
             if (tmp == null) {
                 hasRealParameterData = false;
                 tmp = synthesizeAllParams();
             } else {
                 hasRealParameterData = true;
+                verifyParameters(tmp);
             }
 
             parameters = tmp;
         }