RFR 8184744 : Replace finalizer in crypto classes with Cleaner

Roger Riggs Roger.Riggs at Oracle.com
Fri Aug 4 18:43:18 UTC 2017


Hi Mandy,

On 8/3/2017 4:13 PM, Mandy Chung wrote:
> Thanks for doing this.  It’s good to see JDK finalizes being replaced.
>
> It looks good to me.  I wonder if there is any existing security utility class that may be a good place for this zero-ing byte array method to share.  Sean and other may have opinion.
There are very few of these cases and I think it is better to keep the 
code close to the use.
If there's good place to put a method for this purpose, let me know.

Thanks, Roger

>
> Mandy
>
>> On Aug 3, 2017, at 1:01 PM, Roger Riggs <Roger.Riggs at oracle.com> wrote:
>>
>> Found a race in the tests between the Cleaner clearing the arrays and the test waiting for the key to be freed.
>> Revised to continuously check the arrays and exit when they are cleared.  If not cleared the test will timeout.
>>
>> Updated the webrev:
>>   http://cr.openjdk.java.net/~rriggs/webrev-crypt-finalize-8184744/
>>
>> Thanks, Roger
>>
>> On 8/3/2017 9:58 AM, Roger Riggs wrote:
>>> Please review replacing finalize with java.lang.ref.Cleaner in a few simple cases.
>>>
>>> Webrev:
>>> http://cr.openjdk.java.net/~rriggs/webrev-crypt-finalize-8184744/
>>>
>>> Thanks, Roger
>>>
>>>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.openjdk.org/pipermail/security-dev/attachments/20170804/0ede5c40/attachment.htm>


More information about the security-dev mailing list