# HG changeset patch
# User dsamersoff
# Date 1351602345 -14400
# Node ID 0a1053497df1c14723aec9d79c1b8b7ca755068b
# Parent  1389ac1d3a5f802957ca6646a31c4e08d0489e0f
8000539: JMX implementation allows invocation of methods of a system class
Summary: Added extra packageAccess check call
Reviewed-by: ahgross, dfuchs
Contributed-by: jaroslav.bachorik@oracle.com

diff -r 1389ac1d3a5f -r 0a1053497df1 jdk/src/share/classes/com/sun/jmx/mbeanserver/Introspector.java
--- a/jdk/src/share/classes/com/sun/jmx/mbeanserver/Introspector.java	Fri Oct 26 13:48:33 2012 -0700
+++ b/jdk/src/share/classes/com/sun/jmx/mbeanserver/Introspector.java	Tue Oct 30 17:05:45 2012 +0400
@@ -56,6 +56,8 @@
 import java.lang.reflect.InvocationTargetException;
 import javax.management.AttributeNotFoundException;
 import javax.management.openmbean.CompositeData;
+import sun.reflect.misc.MethodUtil;
+import sun.reflect.misc.ReflectUtil;
 
 /**
  * This class contains the methods for performing all the tests needed to verify
@@ -528,8 +530,10 @@
                     // to locate method
                     readMethod = SimpleIntrospector.getReadMethod(clazz, element);
                 }
-                if (readMethod != null)
-                    return readMethod.invoke(complex);
+                if (readMethod != null) {
+                    ReflectUtil.checkPackageAccess(readMethod.getDeclaringClass());
+                    return MethodUtil.invoke(readMethod, complex, new Class[0]);
+                }
 
                 throw new AttributeNotFoundException(
                     "Could not find the getter method for the property " +