RFR: 8263436: Silly array comparison in GaloisCounterMode.overlapDetection

Anthony Scarpino ascarpino at openjdk.java.net
Thu Mar 11 17:39:08 UTC 2021


On Thu, 11 Mar 2021 11:22:40 GMT, Aleksey Shipilev <shade at openjdk.org> wrote:

> SonarCloud reports:
>   Use "Arrays.equals(array1, array2)" or the "==" operator instead of using the "Object.equals(Object obj)" method.
> 
>         } else if (!src.isDirect() && !dst.isDirect()) {
>             if (!src.isReadOnly()) {
>                 // If using the heap, check underlying byte[] address.
>                 if (!src.array().equals(dst.array()) ) { // <--- here
> 
> Additional testing:
>   - [x] Linux x86_64 fastdebug `jdk_security`

Can you explain why the silly way it is written now is any different than what you are proposing? When running jshell your proposed change returns the same result as the existing code:

one ==> byte[5] { 1, 2, 3, 4, 5 }
two ==> byte[5] { 1, 2, 3, 4, 5 }
jshell> one != two
$9 ==> true

jshell> !one.equals(two)
$10 ==> true

jshell> one != one
$11 ==> false

jshell> !one.equals(one)
$12 ==> false

Is the analysis tool thinking equals() is comparing the contents?

-------------

PR: https://git.openjdk.java.net/jdk/pull/2938



More information about the security-dev mailing list