--- a/src/java.desktop/share/classes/java/awt/Container.java	Tue Nov 07 16:07:36 2017 -0500
+++ b/src/java.desktop/share/classes/java/awt/Container.java	Wed Nov 15 07:07:16 2017 -0800
@@ -35,6 +35,7 @@
 import java.beans.PropertyChangeListener;
 
 import java.io.IOException;
+import java.io.InvalidObjectException;
 import java.io.ObjectInputStream;
 import java.io.ObjectOutputStream;
 import java.io.ObjectStreamField;
@@ -3720,8 +3721,15 @@
         throws ClassNotFoundException, IOException
     {
         ObjectInputStream.GetField f = s.readFields();
-        Component [] tmpComponent = (Component[])f.get("component", EMPTY_ARRAY);
+        // array of components may not be present in the stream or may be null
+        Component [] tmpComponent = (Component[])f.get("component", null);
+        if (tmpComponent == null) {
+            tmpComponent = EMPTY_ARRAY;
+        }
         int ncomponents = (Integer) f.get("ncomponents", 0);
+        if (ncomponents < 0 || ncomponents > tmpComponent.length) {
+            throw new InvalidObjectException("Incorrect number of components");
+        }
         component = new java.util.ArrayList<Component>(ncomponents);
         for (int i = 0; i < ncomponents; ++i) {
             component.add(tmpComponent[i]);