--- a/hotspot/src/cpu/sparc/vm/interpreterRT_sparc.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/cpu/sparc/vm/interpreterRT_sparc.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -237,7 +237,7 @@
   // handle arguments
   // Warning: We use reg arg slot 00 temporarily to return the RegArgSignature
   // back to the code that pops the arguments into the CPU registers
-  SlowSignatureHandler(m, (address)from, m->is_static() ? to+2 : to+1, to).iterate(UCONST64(-1));
+  SlowSignatureHandler(m, (address)from, m->is_static() ? to+2 : to+1, to).iterate((uint64_t)CONST64(-1));
   // return result handler
   return Interpreter::result_handler(m->result_type());
 IRT_END

--- a/hotspot/src/cpu/x86/vm/c1_LIRAssembler_x86.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/cpu/x86/vm/c1_LIRAssembler_x86.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -60,10 +60,10 @@
 static jlong fp_signmask_pool[(4+1)*2]; // 4*128bits(data) + 128bits(alignment)
 
 // Static initialization during VM startup.
-static jlong *float_signmask_pool  = double_quadword(&fp_signmask_pool[1*2], CONST64(0x7FFFFFFF7FFFFFFF), CONST64(0x7FFFFFFF7FFFFFFF));
-static jlong *double_signmask_pool = double_quadword(&fp_signmask_pool[2*2], CONST64(0x7FFFFFFFFFFFFFFF), CONST64(0x7FFFFFFFFFFFFFFF));
-static jlong *float_signflip_pool  = double_quadword(&fp_signmask_pool[3*2], CONST64(0x8000000080000000), CONST64(0x8000000080000000));
-static jlong *double_signflip_pool = double_quadword(&fp_signmask_pool[4*2], CONST64(0x8000000000000000), CONST64(0x8000000000000000));
+static jlong *float_signmask_pool  = double_quadword(&fp_signmask_pool[1*2],         CONST64(0x7FFFFFFF7FFFFFFF),         CONST64(0x7FFFFFFF7FFFFFFF));
+static jlong *double_signmask_pool = double_quadword(&fp_signmask_pool[2*2],         CONST64(0x7FFFFFFFFFFFFFFF),         CONST64(0x7FFFFFFFFFFFFFFF));
+static jlong *float_signflip_pool  = double_quadword(&fp_signmask_pool[3*2], (jlong)UCONST64(0x8000000080000000), (jlong)UCONST64(0x8000000080000000));
+static jlong *double_signflip_pool = double_quadword(&fp_signmask_pool[4*2], (jlong)UCONST64(0x8000000000000000), (jlong)UCONST64(0x8000000000000000));
 
 
 

--- a/hotspot/src/cpu/x86/vm/c1_Runtime1_x86.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/cpu/x86/vm/c1_Runtime1_x86.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -1597,7 +1597,7 @@
         __ movl(rdx, 0x80000000);
         __ xorl(rax, rax);
 #else
-        __ mov64(rax, CONST64(0x8000000000000000));
+        __ mov64(rax, UCONST64(0x8000000000000000));
 #endif // _LP64
         __ jmp(do_return);
 

--- a/hotspot/src/cpu/x86/vm/interpreterRT_x86_32.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/cpu/x86/vm/interpreterRT_x86_32.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -135,7 +135,7 @@
   methodHandle m(thread, (Method*)method);
   assert(m->is_native(), "sanity check");
   // handle arguments
-  SlowSignatureHandler(m, (address)from, to + 1).iterate(UCONST64(-1));
+  SlowSignatureHandler(m, (address)from, to + 1).iterate((uint64_t)CONST64(-1));
   // return result handler
   return Interpreter::result_handler(m->result_type());
 IRT_END

--- a/hotspot/src/cpu/x86/vm/interpreterRT_x86_64.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/cpu/x86/vm/interpreterRT_x86_64.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -487,7 +487,7 @@
   assert(m->is_native(), "sanity check");
 
   // handle arguments
-  SlowSignatureHandler(m, (address)from, to + 1).iterate(UCONST64(-1));
+  SlowSignatureHandler(m, (address)from, to + 1).iterate((uint64_t)CONST64(-1));
 
   // return result handler
   return Interpreter::result_handler(m->result_type());

--- a/hotspot/src/cpu/zero/vm/interpreterRT_zero.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/cpu/zero/vm/interpreterRT_zero.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -155,7 +155,7 @@
 
   intptr_t *buf = (intptr_t *) stack->alloc(required_words * wordSize);
   SlowSignatureHandlerGenerator sshg(methodHandle(thread, method), buf);
-  sshg.generate(UCONST64(-1));
+  sshg.generate((uint64_t)CONST64(-1));
 
   SignatureHandler *handler = sshg.handler();
   handler->finalize();

--- a/hotspot/src/os/aix/vm/os_aix.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/os/aix/vm/os_aix.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -1641,7 +1641,8 @@
   char* rp = realpath((char *)dlinfo.dli_fname, buf);
   assert(rp != NULL, "error in realpath(): maybe the 'path' argument is too long?");
 
-  strcpy(saved_jvm_path, buf);
+  strncpy(saved_jvm_path, buf, sizeof(saved_jvm_path));
+  saved_jvm_path[sizeof(saved_jvm_path) - 1] = '\0';
 }
 
 void os::print_jni_name_prefix_on(outputStream* st, int args_size) {

--- a/hotspot/src/os/aix/vm/perfMemory_aix.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/os/aix/vm/perfMemory_aix.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -506,6 +506,7 @@
 
   if (!is_directory_secure(dirname)) {
     // the directory is not a secure directory
+    os::closedir(dirp);
     return;
   }
 
@@ -853,6 +854,9 @@
   //
   if (!is_directory_secure(dirname)) {
     FREE_C_HEAP_ARRAY(char, dirname, mtInternal);
+    if (luser != user) {
+      FREE_C_HEAP_ARRAY(char, luser, mtInternal);
+    }
     THROW_MSG(vmSymbols::java_lang_IllegalArgumentException(),
               "Process not found");
   }

--- a/hotspot/src/os/bsd/vm/os_bsd.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/os/bsd/vm/os_bsd.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -1875,6 +1875,7 @@
   }
 
   strncpy(saved_jvm_path, buf, MAXPATHLEN);
+  saved_jvm_path[MAXPATHLEN - 1] = '\0';
 }
 
 void os::print_jni_name_prefix_on(outputStream* st, int args_size) {

--- a/hotspot/src/os/bsd/vm/perfMemory_bsd.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/os/bsd/vm/perfMemory_bsd.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -506,6 +506,7 @@
 
   if (!is_directory_secure(dirname)) {
     // the directory is not a secure directory
+    os::closedir(dirp);
     return;
   }
 
@@ -872,6 +873,9 @@
   //
   if (!is_directory_secure(dirname)) {
     FREE_C_HEAP_ARRAY(char, dirname, mtInternal);
+    if (luser != user) {
+      FREE_C_HEAP_ARRAY(char, luser, mtInternal);
+    }
     THROW_MSG(vmSymbols::java_lang_IllegalArgumentException(),
               "Process not found");
   }

--- a/hotspot/src/os/linux/vm/os_linux.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/os/linux/vm/os_linux.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -384,7 +384,10 @@
 
     // Found the full path to libjvm.so.
     // Now cut the path to <java_home>/jre if we can.
-    *(strrchr(buf, '/')) = '\0'; // Get rid of /libjvm.so.
+    pslash = strrchr(buf, '/');
+    if (pslash != NULL) {
+      *pslash = '\0';            // Get rid of /libjvm.so.
+    }
     pslash = strrchr(buf, '/');
     if (pslash != NULL) {
       *pslash = '\0';            // Get rid of /{client|server|hotspot}.
@@ -1223,7 +1226,7 @@
       i = 0;
       if (s) {
         // Skip blank chars
-        do s++; while (isspace(*s));
+        do { s++; } while (s && isspace(*s));
 
 #define _UFM UINTX_FORMAT
 #define _DFM INTX_FORMAT
@@ -2372,6 +2375,9 @@
 
         // Check the current module name "libjvm.so".
         p = strrchr(buf, '/');
+        if (p == NULL) {
+          return;
+        }
         assert(strstr(p, "/libjvm") == p, "invalid library name");
 
         rp = realpath(java_home_var, buf);
@@ -2405,6 +2411,7 @@
   }
 
   strncpy(saved_jvm_path, buf, MAXPATHLEN);
+  saved_jvm_path[MAXPATHLEN - 1] = '\0';
 }
 
 void os::print_jni_name_prefix_on(outputStream* st, int args_size) {
@@ -5354,7 +5361,7 @@
   if (s == NULL) return -1;
 
   // Skip blank chars
-  do s++; while (isspace(*s));
+  do { s++; } while (s && isspace(*s));
 
   count = sscanf(s,"%c %d %d %d %d %d %lu %lu %lu %lu %lu %lu %lu",
                  &cdummy, &idummy, &idummy, &idummy, &idummy, &idummy,

--- a/hotspot/src/os/linux/vm/perfMemory_linux.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/os/linux/vm/perfMemory_linux.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -506,6 +506,7 @@
 
   if (!is_directory_secure(dirname)) {
     // the directory is not a secure directory
+    os::closedir(dirp);
     return;
   }
 
@@ -872,6 +873,9 @@
   //
   if (!is_directory_secure(dirname)) {
     FREE_C_HEAP_ARRAY(char, dirname, mtInternal);
+    if (luser != user) {
+      FREE_C_HEAP_ARRAY(char, luser, mtInternal);
+    }
     THROW_MSG(vmSymbols::java_lang_IllegalArgumentException(),
               "Process not found");
   }

--- a/hotspot/src/os/posix/vm/os_posix.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/os/posix/vm/os_posix.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -663,7 +663,10 @@
     }
   }
 
-  jio_snprintf(out, outlen, ret);
+  if (out && outlen > 0) {
+    strncpy(out, ret, outlen);
+    out[outlen - 1] = '\0';
+  }
   return out;
 }
 

--- a/hotspot/src/os/solaris/vm/os_solaris.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/os/solaris/vm/os_solaris.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -2221,6 +2221,7 @@
   }
 
   strncpy(saved_jvm_path, buf, MAXPATHLEN);
+  saved_jvm_path[MAXPATHLEN - 1] = '\0';
 }
 
 

--- a/hotspot/src/os/solaris/vm/perfMemory_solaris.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/os/solaris/vm/perfMemory_solaris.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -545,6 +545,7 @@
 
   if (!is_directory_secure(dirname)) {
     // the directory is not a secure directory
+    os::closedir(dirp);
     return;
   }
 
@@ -890,6 +891,9 @@
   //
   if (!is_directory_secure(dirname)) {
     FREE_C_HEAP_ARRAY(char, dirname, mtInternal);
+    if (luser != user) {
+      FREE_C_HEAP_ARRAY(char, luser, mtInternal);
+    }
     THROW_MSG(vmSymbols::java_lang_IllegalArgumentException(),
               "Process not found");
   }

--- a/hotspot/src/os/windows/vm/attachListener_windows.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/os/windows/vm/attachListener_windows.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -30,6 +30,7 @@
 
 #include <windows.h>
 #include <signal.h>             // SIGBREAK
+#include <stdio.h>
 
 // The AttachListener thread services a queue of operations. It blocks in the dequeue
 // function until an operation is enqueued. A client enqueues an operation by creating
@@ -269,6 +270,7 @@
   if (hPipe != INVALID_HANDLE_VALUE) {
     // shouldn't happen as there is a pipe created per operation
     if (::GetLastError() == ERROR_PIPE_BUSY) {
+      ::CloseHandle(hPipe);
       return INVALID_HANDLE_VALUE;
     }
   }
@@ -313,7 +315,8 @@
     BOOL fSuccess;
 
     char msg[32];
-    sprintf(msg, "%d\n", result);
+    _snprintf(msg, sizeof(msg), "%d\n", result);
+    msg[sizeof(msg) - 1] = '\0';
 
     fSuccess = write_pipe(hPipe, msg, (int)strlen(msg));
     if (fSuccess) {

--- a/hotspot/src/os/windows/vm/os_windows.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/os/windows/vm/os_windows.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -96,7 +96,7 @@
 #include <vdmdbg.h>
 
 // for timer info max values which include all bits
-#define ALL_64_BITS CONST64(0xFFFFFFFFFFFFFFFF)
+#define ALL_64_BITS CONST64(-1)
 
 // For DLL loading/load error detection
 // Values of PE COFF
@@ -211,6 +211,7 @@
     }
     strcpy(home_path, home_dir);
     Arguments::set_java_home(home_path);
+    FREE_C_HEAP_ARRAY(char, home_path, mtInternal);
 
     dll_path = NEW_C_HEAP_ARRAY(char, strlen(home_dir) + strlen(bin) + 1,
                                 mtInternal);
@@ -220,6 +221,7 @@
     strcpy(dll_path, home_dir);
     strcat(dll_path, bin);
     Arguments::set_dll_dir(dll_path);
+    FREE_C_HEAP_ARRAY(char, dll_path, mtInternal);
 
     if (!set_boot_path('\\', ';')) {
       return;
@@ -297,6 +299,9 @@
     char * buf = NEW_C_HEAP_ARRAY(char, len, mtInternal);
     sprintf(buf, "%s%s", Arguments::get_java_home(), ENDORSED_DIR);
     Arguments::set_endorsed_dirs(buf);
+    // (Arguments::set_endorsed_dirs() calls SystemProperty::set_value(), which
+    //  duplicates the input.)
+    FREE_C_HEAP_ARRAY(char, buf, mtInternal);
 #undef ENDORSED_DIR
   }
 
@@ -1834,6 +1839,7 @@
     GetModuleFileName(vm_lib_handle, buf, buflen);
   }
   strncpy(saved_jvm_path, buf, MAX_PATH);
+  saved_jvm_path[MAX_PATH - 1] = '\0';
 }
 
 
@@ -3746,8 +3752,12 @@
 
   // search system directory
   if ((size = GetSystemDirectory(path, pathLen)) > 0) {
-    strcat(path, "\\");
-    strcat(path, name);
+    if (size >= pathLen) {
+      return NULL; // truncated
+    }
+    if (jio_snprintf(path + size, pathLen - size, "\\%s", name) == -1) {
+      return NULL; // truncated
+    }
     if ((result = (HINSTANCE)os::dll_load(path, ebuf, ebuflen)) != NULL) {
       return result;
     }
@@ -3755,8 +3765,12 @@
 
   // try Windows directory
   if ((size = GetWindowsDirectory(path, pathLen)) > 0) {
-    strcat(path, "\\");
-    strcat(path, name);
+    if (size >= pathLen) {
+      return NULL; // truncated
+    }
+    if (jio_snprintf(path + size, pathLen - size, "\\%s", name) == -1) {
+      return NULL; // truncated
+    }
     if ((result = (HINSTANCE)os::dll_load(path, ebuf, ebuflen)) != NULL) {
       return result;
     }

--- a/hotspot/src/share/vm/memory/metaspaceShared.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/share/vm/memory/metaspaceShared.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -714,12 +714,17 @@
     int class_list_path_len = (int)strlen(class_list_path_str);
     if (class_list_path_len >= 3) {
       if (strcmp(class_list_path_str + class_list_path_len - 3, "lib") != 0) {
-        strcat(class_list_path_str, os::file_separator());
-        strcat(class_list_path_str, "lib");
+        if (class_list_path_len < JVM_MAXPATHLEN - 4) {
+          strncat(class_list_path_str, os::file_separator(), 1);
+          strncat(class_list_path_str, "lib", 3);
+        }
       }
     }
-    strcat(class_list_path_str, os::file_separator());
-    strcat(class_list_path_str, "classlist");
+    class_list_path_len = (int)strlen(class_list_path_str);
+    if (class_list_path_len < JVM_MAXPATHLEN - 10) {
+      strncat(class_list_path_str, os::file_separator(), 1);
+      strncat(class_list_path_str, "classlist", 9);
+    }
     class_list_path = class_list_path_str;
   } else {
     class_list_path = SharedClassListFile;

--- a/hotspot/src/share/vm/oops/constMethod.hpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/share/vm/oops/constMethod.hpp	Wed Oct 29 10:13:24 2014 +0100
@@ -277,7 +277,7 @@
   bool has_stackmap_table() const { return _stackmap_data != NULL; }
 
   void init_fingerprint() {
-    const uint64_t initval = CONST64(0x8000000000000000);
+    const uint64_t initval = UCONST64(0x8000000000000000);
     _fingerprint = initval;
   }
 

--- a/hotspot/src/share/vm/oops/instanceKlass.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/share/vm/oops/instanceKlass.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -2499,7 +2499,7 @@
   // If this is an anonymous class, append a hash to make the name unique
   if (is_anonymous()) {
     intptr_t hash = (java_mirror() != NULL) ? java_mirror()->identity_hash() : 0;
-    sprintf(hash_buf, "/" UINTX_FORMAT, (uintx)hash);
+    jio_snprintf(hash_buf, sizeof(hash_buf), "/" UINTX_FORMAT, (uintx)hash);
     hash_len = (int)strlen(hash_buf);
   }
 

--- a/hotspot/src/share/vm/opto/mulnode.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/share/vm/opto/mulnode.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -610,7 +610,7 @@
   // convert masks which would cause a sign extension of the integer
   // value.  This check includes UI2L masks (0x00000000FFFFFFFF) which
   // would be optimized away later in Identity.
-  if (op == Op_ConvI2L && (mask & CONST64(0xFFFFFFFF80000000)) == 0) {
+  if (op == Op_ConvI2L && (mask & UCONST64(0xFFFFFFFF80000000)) == 0) {
     Node* andi = new AndINode(in1->in(1), phase->intcon(mask));
     andi = phase->transform(andi);
     return new ConvI2LNode(andi);

--- a/hotspot/src/share/vm/prims/jni.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/share/vm/prims/jni.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -951,8 +951,9 @@
 
   // Optimized path if we have the bitvector form of signature
   void iterate( uint64_t fingerprint ) {
-    if ( fingerprint == UCONST64(-1) ) SignatureIterator::iterate();// Must be too many arguments
-    else {
+    if (fingerprint == (uint64_t)CONST64(-1)) {
+      SignatureIterator::iterate(); // Must be too many arguments
+    } else {
       _return_type = (BasicType)((fingerprint >> static_feature_size) &
                                   result_feature_mask);
 
@@ -1022,8 +1023,9 @@
 
   // Optimized path if we have the bitvector form of signature
   void iterate( uint64_t fingerprint ) {
-    if ( fingerprint == UCONST64(-1) ) SignatureIterator::iterate(); // Must be too many arguments
-    else {
+    if (fingerprint == (uint64_t)CONST64(-1)) {
+      SignatureIterator::iterate(); // Must be too many arguments
+    } else {
       _return_type = (BasicType)((fingerprint >> static_feature_size) &
                                   result_feature_mask);
       assert(fingerprint, "Fingerprint should not be 0");

--- a/hotspot/src/share/vm/prims/jvm.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/share/vm/prims/jvm.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -2583,7 +2583,14 @@
 int jio_vsnprintf(char *str, size_t count, const char *fmt, va_list args) {
   // see bug 4399518, 4417214
   if ((intptr_t)count <= 0) return -1;
-  return vsnprintf(str, count, fmt, args);
+
+  int result = vsnprintf(str, count, fmt, args);
+  if ((result > 0 && (size_t)result >= count) || result == -1) {
+    str[count - 1] = '\0';
+    result = -1;
+  }
+
+  return result;
 }
 
 ATTRIBUTE_PRINTF(3, 0)

--- a/hotspot/src/share/vm/prims/unsafe.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/share/vm/prims/unsafe.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -802,8 +802,7 @@
 
 static inline void throw_new(JNIEnv *env, const char *ename) {
   char buf[100];
-  strcpy(buf, "java/lang/");
-  strcat(buf, ename);
+  jio_snprintf(buf, 100, "%s%s", "java/lang/", ename);
   jclass cls = env->FindClass(buf);
   if (env->ExceptionCheck()) {
     env->ExceptionClear();

--- a/hotspot/src/share/vm/runtime/globals.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/share/vm/runtime/globals.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -28,6 +28,7 @@
 #include "runtime/arguments.hpp"
 #include "runtime/globals.hpp"
 #include "runtime/globals_extension.hpp"
+#include "runtime/os.hpp"
 #include "utilities/ostream.hpp"
 #include "utilities/macros.hpp"
 #include "utilities/top.hpp"
@@ -818,15 +819,12 @@
   trace_flag_changed<EventStringFlagChanged, const char*>(name, old_value, *value, origin);
   char* new_value = NULL;
   if (*value != NULL) {
-    new_value = NEW_C_HEAP_ARRAY(char, strlen(*value)+1, mtInternal);
-    strcpy(new_value, *value);
+    new_value = os::strdup_check_oom(*value);
   }
   result->set_ccstr(new_value);
   if (result->is_default() && old_value != NULL) {
     // Prior value is NOT heap allocated, but was a literal constant.
-    char* old_value_to_free = NEW_C_HEAP_ARRAY(char, strlen(old_value)+1, mtInternal);
-    strcpy(old_value_to_free, old_value);
-    old_value = old_value_to_free;
+    old_value = os::strdup_check_oom(old_value);
   }
   *value = old_value;
   result->set_origin(origin);
@@ -838,8 +836,7 @@
   guarantee(faddr != NULL && faddr->is_ccstr(), "wrong flag type");
   ccstr old_value = faddr->get_ccstr();
   trace_flag_changed<EventStringFlagChanged, const char*>(faddr->_name, old_value, value, origin);
-  char* new_value = NEW_C_HEAP_ARRAY(char, strlen(value)+1, mtInternal);
-  strcpy(new_value, value);
+  char* new_value = os::strdup_check_oom(value);
   faddr->set_ccstr(new_value);
   if (!faddr->is_default() && old_value != NULL) {
     // Prior value is heap allocated so free it.

--- a/hotspot/src/share/vm/runtime/java.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/share/vm/runtime/java.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -705,25 +705,35 @@
 }
 
 void JDK_Version::to_string(char* buffer, size_t buflen) const {
+  assert(buffer && buflen > 0, "call with useful buffer");
   size_t index = 0;
+
   if (!is_valid()) {
     jio_snprintf(buffer, buflen, "%s", "(uninitialized)");
   } else if (is_partially_initialized()) {
     jio_snprintf(buffer, buflen, "%s", "(uninitialized) pre-1.6.0");
   } else {
-    index += jio_snprintf(
+    int rc = jio_snprintf(
         &buffer[index], buflen - index, "%d.%d", _major, _minor);
+    if (rc == -1) return;
+    index += rc;
     if (_micro > 0) {
-      index += jio_snprintf(&buffer[index], buflen - index, ".%d", _micro);
+      rc = jio_snprintf(&buffer[index], buflen - index, ".%d", _micro);
     }
     if (_update > 0) {
-      index += jio_snprintf(&buffer[index], buflen - index, "_%02d", _update);
+      rc = jio_snprintf(&buffer[index], buflen - index, "_%02d", _update);
+      if (rc == -1) return;
+      index += rc;
     }
     if (_special > 0) {
-      index += jio_snprintf(&buffer[index], buflen - index, "%c", _special);
+      rc = jio_snprintf(&buffer[index], buflen - index, "%c", _special);
+      if (rc == -1) return;
+      index += rc;
     }
     if (_build > 0) {
-      index += jio_snprintf(&buffer[index], buflen - index, "-b%02d", _build);
+      rc = jio_snprintf(&buffer[index], buflen - index, "-b%02d", _build);
+      if (rc == -1) return;
+      index += rc;
     }
   }
 }

--- a/hotspot/src/share/vm/runtime/signature.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/share/vm/runtime/signature.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -158,7 +158,7 @@
   uint64_t saved_fingerprint = fingerprint;
 
   // Check for too many arguments
-  if ( fingerprint == UCONST64(-1) ) {
+  if (fingerprint == (uint64_t)CONST64(-1)) {
     SignatureIterator::iterate_parameters();
     return;
   }

--- a/hotspot/src/share/vm/runtime/signature.hpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/share/vm/runtime/signature.hpp	Wed Oct 29 10:13:24 2014 +0100
@@ -243,7 +243,7 @@
     }
 
     if (mh->size_of_parameters() > max_size_of_parameters ) {
-      _fingerprint = UCONST64(-1);
+      _fingerprint = (uint64_t)CONST64(-1);
       mh->constMethod()->set_fingerprint(_fingerprint);
       return _fingerprint;
     }

--- a/hotspot/src/share/vm/runtime/thread.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/share/vm/runtime/thread.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -3642,7 +3642,7 @@
 
   if (!agent->valid()) {
     char buffer[JVM_MAXPATHLEN];
-    char ebuf[1024];
+    char ebuf[1024] = "";
     const char *name = agent->name();
     const char *msg = "Could not find agent library ";
 

--- a/hotspot/src/share/vm/services/management.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/share/vm/services/management.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -1333,7 +1333,7 @@
         GrowableArray<oop>* locked_monitors = frame->locked_monitors();
         for (j = 0; j < len; j++) {
           oop monitor = locked_monitors->at(j);
-          assert(monitor != NULL && monitor->is_instance(), "must be a Java object");
+          assert(monitor != NULL, "must be a Java object");
           monitors_array->obj_at_put(count, monitor);
           depths_array->int_at_put(count, depth);
           count++;
@@ -1343,7 +1343,7 @@
       GrowableArray<oop>* jni_locked_monitors = stacktrace->jni_locked_monitors();
       for (j = 0; j < jni_locked_monitors->length(); j++) {
         oop object = jni_locked_monitors->at(j);
-        assert(object != NULL && object->is_instance(), "must be a Java object");
+        assert(object != NULL, "must be a Java object");
         monitors_array->obj_at_put(count, object);
         // Monitor locked via JNI MonitorEnter call doesn't have stack depth info
         depths_array->int_at_put(count, -1);

--- a/hotspot/src/share/vm/services/threadService.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/share/vm/services/threadService.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -597,7 +597,7 @@
     GrowableArray<oop>* locked_monitors = frame->locked_monitors();
     for (int j = 0; j < len; j++) {
       oop monitor = locked_monitors->at(j);
-      assert(monitor != NULL && monitor->is_instance(), "must be a Java object");
+      assert(monitor != NULL, "must be a Java object");
       if (monitor == object) {
         found = true;
         break;

--- a/hotspot/src/share/vm/utilities/globalDefinitions.hpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/share/vm/utilities/globalDefinitions.hpp	Wed Oct 29 10:13:24 2014 +0100
@@ -1048,7 +1048,7 @@
 const int      badResourceValue = 0xAB;                     // value used to zap resource area
 const int      freeBlockPad     = 0xBA;                     // value used to pad freed blocks.
 const int      uninitBlockPad   = 0xF1;                     // value used to zap newly malloc'd blocks.
-const intptr_t badJNIHandleVal  = (intptr_t) CONST64(0xFEFEFEFEFEFEFEFE); // value used to zap jni handle area
+const intptr_t badJNIHandleVal  = (intptr_t) UCONST64(0xFEFEFEFEFEFEFEFE); // value used to zap jni handle area
 const juint    badHeapWordVal   = 0xBAADBABE;               // value used to zap heap after GC
 const juint    badMetaWordVal   = 0xBAADFADE;               // value used to zap metadata heap after GC
 const int      badCodeHeapNewVal= 0xCC;                     // value used to zap Code heap at allocation

--- a/hotspot/src/share/vm/utilities/globalDefinitions_visCPP.hpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/share/vm/utilities/globalDefinitions_visCPP.hpp	Wed Oct 29 10:13:24 2014 +0100
@@ -151,11 +151,11 @@
 // Constant for jlong (specifying an long long constant is C++ compiler specific)
 
 // Build a 64bit integer constant on with Visual C++
-#define CONST64(x)  (x ## i64)
-#define UCONST64(x) ((uint64_t)CONST64(x))
+#define  CONST64(x) (x ##  i64)
+#define UCONST64(x) (x ## ui64)
 
-const jlong min_jlong = CONST64(0x8000000000000000);
-const jlong max_jlong = CONST64(0x7fffffffffffffff);
+const jlong min_jlong = (jlong)UCONST64(0x8000000000000000);
+const jlong max_jlong =         CONST64(0x7fffffffffffffff);
 
 //----------------------------------------------------------------------------------------------------
 // Miscellaneous

--- a/hotspot/src/share/vm/utilities/ostream.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/share/vm/utilities/ostream.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -76,6 +76,8 @@
                                        const char* format, va_list ap,
                                        bool add_cr,
                                        size_t& result_len) {
+  assert(buflen >= 2, "buffer too small");
+
   const char* result;
   if (add_cr)  buflen--;
   if (!strchr(format, '%')) {
@@ -88,14 +90,21 @@
     result = va_arg(ap, const char*);
     result_len = strlen(result);
     if (add_cr && result_len >= buflen)  result_len = buflen-1;  // truncate
-  } else if (vsnprintf(buffer, buflen, format, ap) >= 0) {
+  } else {
+    // Handle truncation:
+    // posix: upon truncation, vsnprintf returns number of bytes which
+    //   would have been written (excluding terminating zero) had the buffer
+    //   been large enough
+    // windows: upon truncation, vsnprintf returns -1
+    const int written = vsnprintf(buffer, buflen, format, ap);
     result = buffer;
-    result_len = strlen(result);
-  } else {
-    DEBUG_ONLY(warning("increase O_BUFLEN in ostream.hpp -- output truncated");)
-    result = buffer;
-    result_len = buflen - 1;
-    buffer[result_len] = 0;
+    if (written < (int) buflen && written >= 0) {
+      result_len = written;
+    } else {
+      DEBUG_ONLY(warning("increase O_BUFLEN in ostream.hpp -- output truncated");)
+      result_len = buflen - 1;
+      buffer[result_len] = 0;
+    }
   }
   if (add_cr) {
     if (result != buffer) {

--- a/hotspot/src/share/vm/utilities/vmError.cpp	Mon Nov 03 11:34:13 2014 -0800
+++ b/hotspot/src/share/vm/utilities/vmError.cpp	Wed Oct 29 10:13:24 2014 +0100
@@ -975,11 +975,13 @@
     // Run error reporting to determine whether or not to report the crash.
     if (!transmit_report_done && should_report_bug(first_error->_id)) {
       transmit_report_done = true;
-      FILE* hs_err = os::open(log.fd(), "r");
+      const int fd2 = ::dup(log.fd());
+      FILE* const hs_err = ::fdopen(fd2, "r");
       if (NULL != hs_err) {
         ErrorReporter er;
         er.call(hs_err, buffer, O_BUFLEN);
       }
+      ::fclose(hs_err);
     }
 
     if (log.fd() != defaultStream::output_fd()) {