8049516: sun.security.provider.SeedGenerator throws ArrayIndexOutOfBoundsException
authorjnimeh
Thu, 22 Sep 2016 07:28:40 -0700
changeset 41120 c730063ccd48
parent 41119 2ca17e55ddf2
child 41121 91734a3ed04b
8049516: sun.security.provider.SeedGenerator throws ArrayIndexOutOfBoundsException Summary: Prevent the latch inside ThreadedSeedGenerator.run() from overflowing into a negative value causing a negative index array lookup. Reviewed-by: xuelei, weijun
jdk/src/java.base/share/classes/sun/security/provider/SeedGenerator.java
--- a/jdk/src/java.base/share/classes/sun/security/provider/SeedGenerator.java	Wed Sep 21 09:29:30 2016 -0700
+++ b/jdk/src/java.base/share/classes/sun/security/provider/SeedGenerator.java	Thu Sep 22 07:28:40 2016 -0700
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2015, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -344,7 +344,8 @@
                         try {
                             BogusThread bt = new BogusThread();
                             Thread t = new Thread
-                                (seedGroup, bt, "SeedGenerator Thread", 0, false);
+                                (seedGroup, bt, "SeedGenerator Thread", 0,
+                                        false);
                             t.start();
                         } catch (Exception e) {
                             throw new InternalError("internal error: " +
@@ -357,7 +358,8 @@
                         long startTime = System.nanoTime();
                         while (System.nanoTime() - startTime < 250000000) {
                             synchronized(this){};
-                            latch++;
+                            // Mask the sign bit and keep latch non-negative
+                            latch = (latch + 1) & 0x1FFFFFFF;
                         }
 
                         // Translate the value using the permutation, and xor
@@ -431,7 +433,7 @@
         // data and using it to mix the trivial permutation.
         // It should be evenly distributed. The specific values
         // are not crucial to the security of this class.
-        private static byte[] rndTab = {
+        private static final byte[] rndTab = {
             56, 30, -107, -6, -86, 25, -83, 75, -12, -64,
             5, -128, 78, 21, 16, 32, 70, -81, 37, -51,
             -43, -46, -108, 87, 29, 17, -55, 22, -11, -111,