< prev index next >

src/java.base/share/classes/java/util/jar/JarFile.java

Print this page
rev 17627 : 8186334: JarFile throws ArrayIndexOutOfBoundsException when the manifest contains certain characters
Reviewed-by: rriggs


   8  * particular file as subject to the "Classpath" exception as provided
   9  * by Oracle in the LICENSE file that accompanied this code.
  10  *
  11  * This code is distributed in the hope that it will be useful, but WITHOUT
  12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * version 2 for more details (a copy is included in the LICENSE file that
  15  * accompanied this code).
  16  *
  17  * You should have received a copy of the GNU General Public License version
  18  * 2 along with this work; if not, write to the Free Software Foundation,
  19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  20  *
  21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  22  * or visit www.oracle.com if you need additional information or have any
  23  * questions.
  24  */
  25 
  26 package java.util.jar;
  27 
  28 import java.io.*;
  29 import java.lang.ref.SoftReference;
  30 import java.net.URL;
  31 import java.util.*;
  32 import java.util.stream.Stream;
  33 import java.util.stream.StreamSupport;
  34 import java.util.zip.*;
  35 import java.security.CodeSigner;
  36 import java.security.cert.Certificate;
  37 import java.security.CodeSource;
  38 import jdk.internal.misc.SharedSecrets;
  39 import sun.security.action.GetPropertyAction;
  40 import sun.security.util.ManifestEntryVerifier;
  41 import sun.security.util.SignatureFileVerifier;
  42 

























  43 /**
  44  * The {@code JarFile} class is used to read the contents of a jar file
  45  * from any file that can be opened with {@code java.io.RandomAccessFile}.
  46  * It extends the class {@code java.util.zip.ZipFile} with support
  47  * for reading an optional {@code Manifest} entry, and support for
  48  * processing multi-release jar files.  The {@code Manifest} can be used
  49  * to specify meta-information about the jar file and its entries.
  50  *
  51  * <p><a id="multirelease">A multi-release jar file</a> is a jar file that
  52  * contains a manifest with a main attribute named "Multi-Release",
  53  * a set of "base" entries, some of which are public classes with public
  54  * or protected methods that comprise the public interface of the jar file,
  55  * and a set of "versioned" entries contained in subdirectories of the
  56  * "META-INF/versions" directory.  The versioned entries are partitioned by the
  57  * major version of the Java platform.  A versioned entry, with a version
  58  * {@code n}, {@code 8 < n}, in the "META-INF/versions/{n}" directory overrides
  59  * the base entry as well as any entry with a version number {@code i} where
  60  * {@code 8 < i < n}.
  61  *
  62  * <p>By default, a {@code JarFile} for a multi-release jar file is configured


 831     private static final byte[] CLASSPATH_CHARS =
 832             {'C','L','A','S','S','-','P','A','T','H', ':', ' '};
 833 
 834     // The bad character shift for "class-path: "
 835     private static final byte[] CLASSPATH_LASTOCC;
 836 
 837     // The good suffix shift for "class-path: "
 838     private static final byte[] CLASSPATH_OPTOSFT;
 839 
 840     private static final byte[] MULTIRELEASE_CHARS =
 841             {'M','U','L','T','I','-','R','E','L','E', 'A', 'S', 'E', ':',
 842                     ' ', 'T', 'R', 'U', 'E'};
 843 
 844     // The bad character shift for "multi-release: true"
 845     private static final byte[] MULTIRELEASE_LASTOCC;
 846 
 847     // The good suffix shift for "multi-release: true"
 848     private static final byte[] MULTIRELEASE_OPTOSFT;
 849 
 850     static {
 851         CLASSPATH_LASTOCC = new byte[64];
 852         CLASSPATH_OPTOSFT = new byte[12];
 853         CLASSPATH_LASTOCC[(int)'C' - 32] = 1;
 854         CLASSPATH_LASTOCC[(int)'L' - 32] = 2;
 855         CLASSPATH_LASTOCC[(int)'S' - 32] = 5;
 856         CLASSPATH_LASTOCC[(int)'-' - 32] = 6;
 857         CLASSPATH_LASTOCC[(int)'P' - 32] = 7;
 858         CLASSPATH_LASTOCC[(int)'A' - 32] = 8;
 859         CLASSPATH_LASTOCC[(int)'T' - 32] = 9;
 860         CLASSPATH_LASTOCC[(int)'H' - 32] = 10;
 861         CLASSPATH_LASTOCC[(int)':' - 32] = 11;
 862         CLASSPATH_LASTOCC[(int)' ' - 32] = 12;
 863         for (int i = 0; i < 11; i++) {
 864             CLASSPATH_OPTOSFT[i] = 12;
 865         }
 866         CLASSPATH_OPTOSFT[11] = 1;
 867 
 868         MULTIRELEASE_LASTOCC = new byte[64];
 869         MULTIRELEASE_OPTOSFT = new byte[19];
 870         MULTIRELEASE_LASTOCC[(int)'M' - 32] = 1;
 871         MULTIRELEASE_LASTOCC[(int)'I' - 32] = 5;
 872         MULTIRELEASE_LASTOCC[(int)'-' - 32] = 6;
 873         MULTIRELEASE_LASTOCC[(int)'L' - 32] = 9;
 874         MULTIRELEASE_LASTOCC[(int)'A' - 32] = 11;
 875         MULTIRELEASE_LASTOCC[(int)'S' - 32] = 12;
 876         MULTIRELEASE_LASTOCC[(int)':' - 32] = 14;
 877         MULTIRELEASE_LASTOCC[(int)' ' - 32] = 15;
 878         MULTIRELEASE_LASTOCC[(int)'T' - 32] = 16;
 879         MULTIRELEASE_LASTOCC[(int)'R' - 32] = 17;
 880         MULTIRELEASE_LASTOCC[(int)'U' - 32] = 18;
 881         MULTIRELEASE_LASTOCC[(int)'E' - 32] = 19;
 882         for (int i = 0; i < 17; i++) {
 883             MULTIRELEASE_OPTOSFT[i] = 19;
 884         }
 885         MULTIRELEASE_OPTOSFT[17] = 6;
 886         MULTIRELEASE_OPTOSFT[18] = 1;
 887     }
 888 




   8  * particular file as subject to the "Classpath" exception as provided
   9  * by Oracle in the LICENSE file that accompanied this code.
  10  *
  11  * This code is distributed in the hope that it will be useful, but WITHOUT
  12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * version 2 for more details (a copy is included in the LICENSE file that
  15  * accompanied this code).
  16  *
  17  * You should have received a copy of the GNU General Public License version
  18  * 2 along with this work; if not, write to the Free Software Foundation,
  19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  20  *
  21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  22  * or visit www.oracle.com if you need additional information or have any
  23  * questions.
  24  */
  25 
  26 package java.util.jar;
  27 










  28 import jdk.internal.misc.SharedSecrets;
  29 import sun.security.action.GetPropertyAction;
  30 import sun.security.util.ManifestEntryVerifier;
  31 import sun.security.util.SignatureFileVerifier;
  32 
  33 import java.io.ByteArrayInputStream;
  34 import java.io.EOFException;
  35 import java.io.File;
  36 import java.io.IOException;
  37 import java.io.InputStream;
  38 import java.lang.ref.SoftReference;
  39 import java.net.URL;
  40 import java.security.CodeSigner;
  41 import java.security.CodeSource;
  42 import java.security.cert.Certificate;
  43 import java.util.ArrayList;
  44 import java.util.Enumeration;
  45 import java.util.Iterator;
  46 import java.util.List;
  47 import java.util.Locale;
  48 import java.util.NoSuchElementException;
  49 import java.util.Objects;
  50 import java.util.Spliterator;
  51 import java.util.Spliterators;
  52 import java.util.stream.Stream;
  53 import java.util.stream.StreamSupport;
  54 import java.util.zip.ZipEntry;
  55 import java.util.zip.ZipException;
  56 import java.util.zip.ZipFile;
  57 
  58 /**
  59  * The {@code JarFile} class is used to read the contents of a jar file
  60  * from any file that can be opened with {@code java.io.RandomAccessFile}.
  61  * It extends the class {@code java.util.zip.ZipFile} with support
  62  * for reading an optional {@code Manifest} entry, and support for
  63  * processing multi-release jar files.  The {@code Manifest} can be used
  64  * to specify meta-information about the jar file and its entries.
  65  *
  66  * <p><a id="multirelease">A multi-release jar file</a> is a jar file that
  67  * contains a manifest with a main attribute named "Multi-Release",
  68  * a set of "base" entries, some of which are public classes with public
  69  * or protected methods that comprise the public interface of the jar file,
  70  * and a set of "versioned" entries contained in subdirectories of the
  71  * "META-INF/versions" directory.  The versioned entries are partitioned by the
  72  * major version of the Java platform.  A versioned entry, with a version
  73  * {@code n}, {@code 8 < n}, in the "META-INF/versions/{n}" directory overrides
  74  * the base entry as well as any entry with a version number {@code i} where
  75  * {@code 8 < i < n}.
  76  *
  77  * <p>By default, a {@code JarFile} for a multi-release jar file is configured


 846     private static final byte[] CLASSPATH_CHARS =
 847             {'C','L','A','S','S','-','P','A','T','H', ':', ' '};
 848 
 849     // The bad character shift for "class-path: "
 850     private static final byte[] CLASSPATH_LASTOCC;
 851 
 852     // The good suffix shift for "class-path: "
 853     private static final byte[] CLASSPATH_OPTOSFT;
 854 
 855     private static final byte[] MULTIRELEASE_CHARS =
 856             {'M','U','L','T','I','-','R','E','L','E', 'A', 'S', 'E', ':',
 857                     ' ', 'T', 'R', 'U', 'E'};
 858 
 859     // The bad character shift for "multi-release: true"
 860     private static final byte[] MULTIRELEASE_LASTOCC;
 861 
 862     // The good suffix shift for "multi-release: true"
 863     private static final byte[] MULTIRELEASE_OPTOSFT;
 864 
 865     static {
 866         CLASSPATH_LASTOCC = new byte[65];
 867         CLASSPATH_OPTOSFT = new byte[12];
 868         CLASSPATH_LASTOCC[(int)'C' - 32] = 1;
 869         CLASSPATH_LASTOCC[(int)'L' - 32] = 2;
 870         CLASSPATH_LASTOCC[(int)'S' - 32] = 5;
 871         CLASSPATH_LASTOCC[(int)'-' - 32] = 6;
 872         CLASSPATH_LASTOCC[(int)'P' - 32] = 7;
 873         CLASSPATH_LASTOCC[(int)'A' - 32] = 8;
 874         CLASSPATH_LASTOCC[(int)'T' - 32] = 9;
 875         CLASSPATH_LASTOCC[(int)'H' - 32] = 10;
 876         CLASSPATH_LASTOCC[(int)':' - 32] = 11;
 877         CLASSPATH_LASTOCC[(int)' ' - 32] = 12;
 878         for (int i = 0; i < 11; i++) {
 879             CLASSPATH_OPTOSFT[i] = 12;
 880         }
 881         CLASSPATH_OPTOSFT[11] = 1;
 882 
 883         MULTIRELEASE_LASTOCC = new byte[65];
 884         MULTIRELEASE_OPTOSFT = new byte[19];
 885         MULTIRELEASE_LASTOCC[(int)'M' - 32] = 1;
 886         MULTIRELEASE_LASTOCC[(int)'I' - 32] = 5;
 887         MULTIRELEASE_LASTOCC[(int)'-' - 32] = 6;
 888         MULTIRELEASE_LASTOCC[(int)'L' - 32] = 9;
 889         MULTIRELEASE_LASTOCC[(int)'A' - 32] = 11;
 890         MULTIRELEASE_LASTOCC[(int)'S' - 32] = 12;
 891         MULTIRELEASE_LASTOCC[(int)':' - 32] = 14;
 892         MULTIRELEASE_LASTOCC[(int)' ' - 32] = 15;
 893         MULTIRELEASE_LASTOCC[(int)'T' - 32] = 16;
 894         MULTIRELEASE_LASTOCC[(int)'R' - 32] = 17;
 895         MULTIRELEASE_LASTOCC[(int)'U' - 32] = 18;
 896         MULTIRELEASE_LASTOCC[(int)'E' - 32] = 19;
 897         for (int i = 0; i < 17; i++) {
 898             MULTIRELEASE_OPTOSFT[i] = 19;
 899         }
 900         MULTIRELEASE_OPTOSFT[17] = 6;
 901         MULTIRELEASE_OPTOSFT[18] = 1;
 902     }
 903 


< prev index next >