RFR: 8330684: ClassFile API runs into StackOverflowError while parsing certain class' bytes

[Paul Sandoz]

On Tue, 23 Apr 2024 07:39:47 GMT, Adam Sotona <asotona at openjdk.org> wrote:

> ClassFile API dives into the nested constant pool entries without type restrictions, while parsing a class file. Validation of the entry is performed post-parsing. Specifically corrupted constant pool entry may cause infinite loop during parsing and throws SOE.
> This patch resolves the issue by providing specific implementations for the nested CP entries parsing, instead of sharing the common (post-checking) code.
> Added test simulates the situation on inner-looped method reference entry.
> 
> Please review.
> 
> Thank you,
> Adam

Rather than duplicating some checks I wonder if it is possible to add a private method `entryByIndex(int index, int expectedTag)` that the existing `entryByIndex` defers to. If the `expectedTag` is non-negative then it checks `tag` against `expectedTag` before proceeding to the switch expression. Then the implementations of `readClassEntry` etc can be adjusted to pass along the expected tag.

-------------

PR Review: https://git.openjdk.org/jdk/pull/18907#pullrequestreview-2021009969