RFR: 8280409: JarFile::verifiableEntry can fail with NPE accessing ze.getName() [v4]

Lance Andersen lancea at openjdk.java.net
Thu Feb 17 19:00:47 UTC 2022


> Hi all,
> 
> Please review the attached patch to address
> 
> - That JarFile::getInputStream did not check for a null ZipEntry passed as a parameter
> - Have Zip/JarFile::getInputStream throw a ZipException in the event that an unexpected exception occurs
> 
> Mach5 tiers1-3 runs are clean as are the TCK java.util.zip and java.util.jar test runs
> 
> Best
> Lance

Lance Andersen has updated the pull request incrementally with one additional commit since the last revision:

  Return null when ZipEntry::getName is null

-------------

Changes:
  - all: https://git.openjdk.java.net/jdk/pull/7348/files
  - new: https://git.openjdk.java.net/jdk/pull/7348/files/32f6c284..d5cf8db8

Webrevs:
 - full: https://webrevs.openjdk.java.net/?repo=jdk&pr=7348&range=03
 - incr: https://webrevs.openjdk.java.net/?repo=jdk&pr=7348&range=02-03

  Stats: 201 lines in 2 files changed: 34 ins; 96 del; 71 mod
  Patch: https://git.openjdk.java.net/jdk/pull/7348.diff
  Fetch: git fetch https://git.openjdk.java.net/jdk pull/7348/head:pull/7348

PR: https://git.openjdk.java.net/jdk/pull/7348



More information about the security-dev mailing list