Skip to content

Commit 18438d2

Browse files
committed
Merge
2 parents 652f7a7 + d5ac2ad commit 18438d2

File tree

22 files changed

+781
-158
lines changed

22 files changed

+781
-158
lines changed

hotspot/src/share/vm/classfile/stackMapTable.cpp

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,8 +122,16 @@ bool StackMapTable::match_stackmap(
122122
}
123123

124124
void StackMapTable::check_jump_target(
125-
StackMapFrame* frame, int32_t target, TRAPS) const {
125+
StackMapFrame* frame, int bci, int offset, TRAPS) const {
126126
ErrorContext ctx;
127+
// Jump targets must be within the method and the method size is limited. See JVMS 4.11
128+
int min_offset = -1 * max_method_code_size;
129+
if (offset < min_offset || offset > max_method_code_size) {
130+
frame->verifier()->verify_error(ErrorContext::bad_stackmap(bci, frame),
131+
"Illegal target of jump or branch (bci %d + offset %d)", bci, offset);
132+
return;
133+
}
134+
int target = bci + offset;
127135
bool match = match_stackmap(
128136
frame, target, true, false, &ctx, CHECK_VERIFY(frame->verifier()));
129137
if (!match || (target < 0 || target >= _code_length)) {

hotspot/src/share/vm/classfile/stackMapTable.hpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ class StackMapTable : public StackObj {
8686

8787
// Check jump instructions. Make sure there are no uninitialized
8888
// instances on backward branch.
89-
void check_jump_target(StackMapFrame* frame, int32_t target, TRAPS) const;
89+
void check_jump_target(StackMapFrame* frame, int bci, int offset, TRAPS) const;
9090

9191
// The following methods are only used inside this class.
9292

hotspot/src/share/vm/classfile/verifier.cpp

Lines changed: 19 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -668,7 +668,6 @@ void ClassVerifier::verify_method(methodHandle m, TRAPS) {
668668
// Merge with the next instruction
669669
{
670670
u2 index;
671-
int target;
672671
VerificationType type, type2;
673672
VerificationType atype;
674673

@@ -1480,9 +1479,8 @@ void ClassVerifier::verify_method(methodHandle m, TRAPS) {
14801479
case Bytecodes::_ifle:
14811480
current_frame.pop_stack(
14821481
VerificationType::integer_type(), CHECK_VERIFY(this));
1483-
target = bcs.dest();
14841482
stackmap_table.check_jump_target(
1485-
&current_frame, target, CHECK_VERIFY(this));
1483+
&current_frame, bcs.bci(), bcs.get_offset_s2(), CHECK_VERIFY(this));
14861484
no_control_flow = false; break;
14871485
case Bytecodes::_if_acmpeq :
14881486
case Bytecodes::_if_acmpne :
@@ -1493,19 +1491,16 @@ void ClassVerifier::verify_method(methodHandle m, TRAPS) {
14931491
case Bytecodes::_ifnonnull :
14941492
current_frame.pop_stack(
14951493
VerificationType::reference_check(), CHECK_VERIFY(this));
1496-
target = bcs.dest();
14971494
stackmap_table.check_jump_target
1498-
(&current_frame, target, CHECK_VERIFY(this));
1495+
(&current_frame, bcs.bci(), bcs.get_offset_s2(), CHECK_VERIFY(this));
14991496
no_control_flow = false; break;
15001497
case Bytecodes::_goto :
1501-
target = bcs.dest();
15021498
stackmap_table.check_jump_target(
1503-
&current_frame, target, CHECK_VERIFY(this));
1499+
&current_frame, bcs.bci(), bcs.get_offset_s2(), CHECK_VERIFY(this));
15041500
no_control_flow = true; break;
15051501
case Bytecodes::_goto_w :
1506-
target = bcs.dest_w();
15071502
stackmap_table.check_jump_target(
1508-
&current_frame, target, CHECK_VERIFY(this));
1503+
&current_frame, bcs.bci(), bcs.get_offset_s4(), CHECK_VERIFY(this));
15091504
no_control_flow = true; break;
15101505
case Bytecodes::_tableswitch :
15111506
case Bytecodes::_lookupswitch :
@@ -2107,15 +2102,14 @@ void ClassVerifier::verify_switch(
21072102
}
21082103
}
21092104
}
2110-
int target = bci + default_offset;
2111-
stackmap_table->check_jump_target(current_frame, target, CHECK_VERIFY(this));
2105+
stackmap_table->check_jump_target(current_frame, bci, default_offset, CHECK_VERIFY(this));
21122106
for (int i = 0; i < keys; i++) {
21132107
// Because check_jump_target() may safepoint, the bytecode could have
21142108
// moved, which means 'aligned_bcp' is no good and needs to be recalculated.
21152109
aligned_bcp = (address)round_to((intptr_t)(bcs->bcp() + 1), jintSize);
2116-
target = bci + (jint)Bytes::get_Java_u4(aligned_bcp+(3+i*delta)*jintSize);
2110+
int offset = (jint)Bytes::get_Java_u4(aligned_bcp+(3+i*delta)*jintSize);
21172111
stackmap_table->check_jump_target(
2118-
current_frame, target, CHECK_VERIFY(this));
2112+
current_frame, bci, offset, CHECK_VERIFY(this));
21192113
}
21202114
NOT_PRODUCT(aligned_bcp = NULL); // no longer valid at this point
21212115
}
@@ -2376,8 +2370,13 @@ bool ClassVerifier::ends_in_athrow(u4 start_bc_offset) {
23762370
break;
23772371

23782372
case Bytecodes::_goto:
2379-
case Bytecodes::_goto_w:
2380-
target = (opcode == Bytecodes::_goto ? bcs.dest() : bcs.dest_w());
2373+
case Bytecodes::_goto_w: {
2374+
int offset = (opcode == Bytecodes::_goto ? bcs.get_offset_s2() : bcs.get_offset_s4());
2375+
int min_offset = -1 * max_method_code_size;
2376+
// Check offset for overflow
2377+
if (offset < min_offset || offset > max_method_code_size) return false;
2378+
2379+
target = bci + offset;
23812380
if (visited_branches->contains(bci)) {
23822381
if (bci_stack->is_empty()) {
23832382
if (handler_stack->is_empty()) {
@@ -2398,6 +2397,7 @@ bool ClassVerifier::ends_in_athrow(u4 start_bc_offset) {
23982397
visited_branches->append(bci);
23992398
}
24002399
break;
2400+
}
24012401

24022402
// Check that all switch alternatives end in 'athrow' bytecodes. Since it
24032403
// is difficult to determine where each switch alternative ends, parse
@@ -2434,7 +2434,10 @@ bool ClassVerifier::ends_in_athrow(u4 start_bc_offset) {
24342434

24352435
// Push the switch alternatives onto the stack.
24362436
for (int i = 0; i < keys; i++) {
2437-
u4 target = bci + (jint)Bytes::get_Java_u4(aligned_bcp+(3+i*delta)*jintSize);
2437+
int min_offset = -1 * max_method_code_size;
2438+
int offset = (jint)Bytes::get_Java_u4(aligned_bcp+(3+i*delta)*jintSize);
2439+
if (offset < min_offset || offset > max_method_code_size) return false;
2440+
u4 target = bci + offset;
24382441
if (target > code_length) return false;
24392442
bci_stack->push(target);
24402443
}

hotspot/src/share/vm/interpreter/bytecodeStream.hpp

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -121,8 +121,23 @@ class BaseBytecodeStream: StackObj {
121121
void set_next_bci(int bci) { assert(0 <= bci && bci <= method()->code_size(), "illegal bci"); _next_bci = bci; }
122122

123123
// Bytecode-specific attributes
124-
int dest() const { return bci() + bytecode().get_offset_s2(raw_code()); }
125-
int dest_w() const { return bci() + bytecode().get_offset_s4(raw_code()); }
124+
int get_offset_s2() const { return bytecode().get_offset_s2(raw_code()); }
125+
int get_offset_s4() const { return bytecode().get_offset_s4(raw_code()); }
126+
127+
// These methods are not safe to use before or during verification as they may
128+
// have large offsets and cause overflows
129+
int dest() const {
130+
int min_offset = -1 * max_method_code_size;
131+
int offset = bytecode().get_offset_s2(raw_code());
132+
guarantee(offset >= min_offset && offset <= max_method_code_size, "must be");
133+
return bci() + offset;
134+
}
135+
int dest_w() const {
136+
int min_offset = -1 * max_method_code_size;
137+
int offset = bytecode().get_offset_s4(raw_code());
138+
guarantee(offset >= min_offset && offset <= max_method_code_size, "must be");
139+
return bci() + offset;
140+
}
126141

127142
// One-byte indices.
128143
int get_index_u1() const { assert_raw_index_size(1); return *(jubyte*)(bcp()+1); }

jaxp/src/com/sun/org/apache/xpath/internal/jaxp/XPathFactoryImpl.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,7 @@ public void setFeature(String name, boolean value)
187187
if (value && _featureManager != null) {
188188
_featureManager.setFeature(JdkXmlFeatures.XmlFeature.ENABLE_EXTENSION_FUNCTION,
189189
JdkXmlFeatures.State.FSP, false);
190+
_xmlSecMgr.setSecureProcessing(value);
190191
}
191192

192193
// all done processing feature

jaxp/src/com/sun/org/apache/xpath/internal/jaxp/XPathImpl.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020

2121
package com.sun.org.apache.xpath.internal.jaxp;
2222

23+
import javax.xml.XMLConstants;
2324
import javax.xml.namespace.QName;
2425
import javax.xml.namespace.NamespaceContext;
2526
import javax.xml.xpath.XPathExpressionException;
@@ -180,6 +181,10 @@ private DocumentBuilder getParser() {
180181
// so we really have to create a fresh DocumentBuilder every time we need one
181182
// - KK
182183
DocumentBuilderFactory dbf = JdkXmlUtils.getDOMFactory(overrideDefaultParser);
184+
if (xmlSecMgr != null && xmlSecMgr.isSecureProcessingSet()) {
185+
dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING,
186+
xmlSecMgr.isSecureProcessing());
187+
}
183188
return dbf.newDocumentBuilder();
184189
} catch (ParserConfigurationException e) {
185190
// this should never happen with a well-behaving JAXP implementation.

jaxp/src/jdk/xml/internal/XMLSecurityManager.java

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,12 @@ public static enum Processor {
189189
*/
190190
boolean secureProcessing;
191191

192+
/**
193+
* Flag indicating the secure processing is set explicitly through factories'
194+
* setFeature method and then the setSecureProcessing method
195+
*/
196+
boolean secureProcessingSet;
197+
192198
/**
193199
* States that determine if properties are set explicitly
194200
*/
@@ -236,6 +242,7 @@ public XMLSecurityManager(boolean secureProcessing) {
236242
* Setting FEATURE_SECURE_PROCESSING explicitly
237243
*/
238244
public void setSecureProcessing(boolean secure) {
245+
secureProcessingSet = true;
239246
secureProcessing = secure;
240247
for (Limit limit : Limit.values()) {
241248
if (secure) {
@@ -254,6 +261,15 @@ public boolean isSecureProcessing() {
254261
return secureProcessing;
255262
}
256263

264+
/**
265+
* Returns the state indicating whether the Secure Processing is set explicitly,
266+
* via factories' setFeature and then this class' setSecureProcessing method.
267+
* @return the state indicating whether the Secure Processing is set explicitly
268+
*/
269+
public boolean isSecureProcessingSet() {
270+
return secureProcessingSet;
271+
}
272+
257273
/**
258274
* Set limit by property name and state
259275
* @param propertyName property name

jdk/src/share/classes/com/sun/java/swing/SwingUtilities3.java

Lines changed: 123 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2002, 2010, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2002, 2025, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -36,11 +36,20 @@
3636
import java.applet.Applet;
3737
import java.awt.AWTEvent;
3838
import java.awt.EventQueue;
39+
import java.awt.Color;
3940
import java.awt.Component;
4041
import java.awt.Container;
42+
import java.awt.Graphics;
43+
import java.awt.Insets;
44+
import java.awt.Rectangle;
4145
import java.awt.Window;
46+
import javax.swing.ButtonModel;
47+
import javax.swing.Icon;
4248
import javax.swing.JComponent;
49+
import javax.swing.JMenu;
4350
import javax.swing.RepaintManager;
51+
import sun.swing.MenuItemLayoutHelper;
52+
import sun.swing.SwingUtilities2;
4453

4554
/**
4655
* A collection of utility methods for Swing.
@@ -113,6 +122,119 @@ public static boolean isVsyncRequested(Container rootContainer) {
113122
return Boolean.TRUE == vsyncedMap.get(rootContainer);
114123
}
115124

125+
public static void applyInsets(Rectangle rect, Insets insets) {
126+
if (insets != null) {
127+
rect.x += insets.left;
128+
rect.y += insets.top;
129+
rect.width -= (insets.right + rect.x);
130+
rect.height -= (insets.bottom + rect.y);
131+
}
132+
}
133+
134+
public static void paintCheckIcon(Graphics g, MenuItemLayoutHelper lh,
135+
MenuItemLayoutHelper.LayoutResult lr,
136+
Color holdc, Color foreground) {
137+
if (lh.getCheckIcon() != null) {
138+
ButtonModel model = lh.getMenuItem().getModel();
139+
if (model.isArmed() || (lh.getMenuItem() instanceof JMenu
140+
&& model.isSelected())) {
141+
g.setColor(foreground);
142+
} else {
143+
g.setColor(holdc);
144+
}
145+
if (lh.useCheckAndArrow()) {
146+
lh.getCheckIcon().paintIcon(lh.getMenuItem(), g,
147+
lr.getCheckRect().x, lr.getCheckRect().y);
148+
}
149+
g.setColor(holdc);
150+
}
151+
}
152+
153+
public static void paintIcon(Graphics g, MenuItemLayoutHelper lh,
154+
MenuItemLayoutHelper.LayoutResult lr, Color holdc) {
155+
if (lh.getIcon() != null) {
156+
Icon icon;
157+
ButtonModel model = lh.getMenuItem().getModel();
158+
if (!model.isEnabled()) {
159+
icon = lh.getMenuItem().getDisabledIcon();
160+
} else if (model.isPressed() && model.isArmed()) {
161+
icon = lh.getMenuItem().getPressedIcon();
162+
if (icon == null) {
163+
// Use default icon
164+
icon = lh.getMenuItem().getIcon();
165+
}
166+
} else {
167+
icon = lh.getMenuItem().getIcon();
168+
}
169+
170+
if (icon != null) {
171+
icon.paintIcon(lh.getMenuItem(), g, lr.getIconRect().x,
172+
lr.getIconRect().y);
173+
g.setColor(holdc);
174+
}
175+
}
176+
}
177+
178+
179+
public static void paintAccText(Graphics g, MenuItemLayoutHelper lh,
180+
MenuItemLayoutHelper.LayoutResult lr,
181+
Color disabledForeground,
182+
Color acceleratorSelectionForeground,
183+
Color acceleratorForeground) {
184+
if (!lh.getAccText().isEmpty()) {
185+
ButtonModel model = lh.getMenuItem().getModel();
186+
g.setFont(lh.getAccFontMetrics().getFont());
187+
if (!model.isEnabled()) {
188+
189+
// paint the accText disabled
190+
if (disabledForeground != null) {
191+
g.setColor(disabledForeground);
192+
SwingUtilities2.drawString(lh.getMenuItem(), g,
193+
lh.getAccText(), lr.getAccRect().x,
194+
lr.getAccRect().y + lh.getAccFontMetrics().getAscent());
195+
} else {
196+
g.setColor(lh.getMenuItem().getBackground().brighter());
197+
SwingUtilities2.drawString(lh.getMenuItem(), g,
198+
lh.getAccText(), lr.getAccRect().x,
199+
lr.getAccRect().y + lh.getAccFontMetrics().getAscent());
200+
g.setColor(lh.getMenuItem().getBackground().darker());
201+
SwingUtilities2.drawString(lh.getMenuItem(), g,
202+
lh.getAccText(), lr.getAccRect().x - 1,
203+
lr.getAccRect().y + lh.getFontMetrics().getAscent() - 1);
204+
}
205+
} else {
206+
207+
// paint the accText normally
208+
if (model.isArmed()
209+
|| (lh.getMenuItem() instanceof JMenu
210+
&& model.isSelected())) {
211+
g.setColor(acceleratorSelectionForeground);
212+
} else {
213+
g.setColor(acceleratorForeground);
214+
}
215+
SwingUtilities2.drawString(lh.getMenuItem(), g, lh.getAccText(),
216+
lr.getAccRect().x, lr.getAccRect().y +
217+
lh.getAccFontMetrics().getAscent());
218+
}
219+
}
220+
}
221+
222+
public static void paintArrowIcon(Graphics g, MenuItemLayoutHelper lh,
223+
MenuItemLayoutHelper.LayoutResult lr,
224+
Color foreground) {
225+
if (lh.getArrowIcon() != null) {
226+
ButtonModel model = lh.getMenuItem().getModel();
227+
if (model.isArmed() || (lh.getMenuItem() instanceof JMenu
228+
&& model.isSelected())) {
229+
g.setColor(foreground);
230+
}
231+
if (lh.useCheckAndArrow()) {
232+
lh.getArrowIcon().paintIcon(lh.getMenuItem(), g,
233+
lr.getArrowRect().x, lr.getArrowRect().y);
234+
}
235+
}
236+
}
237+
116238
/**
117239
* Returns delegate {@code RepaintManager} for {@code component} hierarchy.
118240
*/

jdk/src/share/classes/com/sun/java/swing/plaf/windows/WindowsCheckBoxMenuItemUI.java

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 1997, 2006, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 1997, 2025, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -74,6 +74,26 @@ protected void paintBackground(Graphics g, JMenuItem menuItem,
7474
}
7575
super.paintBackground(g, menuItem, bgColor);
7676
}
77+
78+
/**
79+
* Paint MenuItem.
80+
*/
81+
protected void paintMenuItem(Graphics g, JComponent c,
82+
Icon checkIcon, Icon arrowIcon,
83+
Color background, Color foreground,
84+
int defaultTextIconGap) {
85+
if (WindowsMenuItemUI.isVistaPainting()) {
86+
WindowsMenuItemUI.paintMenuItem(accessor, g, c, checkIcon,
87+
arrowIcon, background, foreground,
88+
disabledForeground, acceleratorSelectionForeground,
89+
acceleratorForeground, defaultTextIconGap,
90+
menuItem, getPropertyPrefix());
91+
return;
92+
}
93+
super.paintMenuItem(g, c, checkIcon, arrowIcon, background,
94+
foreground, defaultTextIconGap);
95+
}
96+
7797
/**
7898
* Method which renders the text of the current menu item.
7999
* <p>

0 commit comments

Comments
 (0)