RFR: 8263436: Silly array comparison in GaloisCounterMode.overlapDetection
Anthony Scarpino
ascarpino at openjdk.java.net
Thu Mar 11 17:39:08 UTC 2021
On Thu, 11 Mar 2021 11:22:40 GMT, Aleksey Shipilev <shade at openjdk.org> wrote:
> SonarCloud reports:
> Use "Arrays.equals(array1, array2)" or the "==" operator instead of using the "Object.equals(Object obj)" method.
>
> } else if (!src.isDirect() && !dst.isDirect()) {
> if (!src.isReadOnly()) {
> // If using the heap, check underlying byte[] address.
> if (!src.array().equals(dst.array()) ) { // <--- here
>
> Additional testing:
> - [x] Linux x86_64 fastdebug `jdk_security`
Can you explain why the silly way it is written now is any different than what you are proposing? When running jshell your proposed change returns the same result as the existing code:
one ==> byte[5] { 1, 2, 3, 4, 5 }
two ==> byte[5] { 1, 2, 3, 4, 5 }
jshell> one != two
$9 ==> true
jshell> !one.equals(two)
$10 ==> true
jshell> one != one
$11 ==> false
jshell> !one.equals(one)
$12 ==> false
Is the analysis tool thinking equals() is comparing the contents?
-------------
PR: https://git.openjdk.java.net/jdk/pull/2938
More information about the security-dev
mailing list