RFR: 8234466: Class loading deadlock involving X509Factory#commitEvent()
Seán Coffey
sean.coffey at oracle.com
Mon Jan 13 21:18:19 UTC 2020
Thanks Alan. Updates made and changes pushed.
regards,
Sean.
On 13/01/2020 18:50, Alan Bateman wrote:
> On 13/01/2020 10:28, Seán Coffey wrote:
>> some off line comments suggested that I could move the jar
>> initialization checks to the EventHelper class. With that in place,
>> the EventHelper utility class should never initialize the logging
>> framework early during jar initialization.
>>
>> http://cr.openjdk.java.net/~coffeys/webrev.8234466.v4/webrev/
> Thanks for the update. JAR file verification is tricky and important
> not to attempt to run arbitrary code while doing that, esp. anything
> that might need to load a class or resource from the class path. So I
> think the approach (in v5) looks okay. A minor nit in JarFile is that
> it should be "static final". Also you might want to replace or change
> the @summary in both tests to make it clearer that the tests attempt
> to trigger class loading from the class loader during JAR file
> verification.
>
> -Alan.
More information about the security-dev
mailing list