stan/jdk-24
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

8030655: Regression: 14_01 Security fix 8024306 causes test failures

Browse Source 
Reviewed-by: mullan, xuelei, ahgross
This commit is contained in:
Weijun Wang 2014-01-15 11:23:07 +08:00
parent 4e372752a0
commit b98404d258
1 changed files with 19 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
jdk/src/share/classes/javax/security/auth/Subject.java
View File

@ -959,14 +959,30 @@ public final class Subject implements java.io.Serializable {
/**
* Reads this object from a stream (i.e., deserializes it)
*/
@SuppressWarnings("unchecked")
private void readObject(java.io.ObjectInputStream s)
throws java.io.IOException, ClassNotFoundException {
s.defaultReadObject();
ObjectInputStream.GetField gf = s.readFields();
readOnly = gf.get("readOnly", false);
Set<Principal> inputPrincs = (Set<Principal>)gf.get("principals", null);
// Rewrap the principals into a SecureSet
principals = Collections.synchronizedSet(new SecureSet<Principal>
(this, PRINCIPAL_SET, principals));
if (inputPrincs == null) {
throw new NullPointerException
(ResourcesMgr.getString("invalid.null.input.s."));
}
try {
principals = Collections.synchronizedSet(new SecureSet<Principal>
(this, PRINCIPAL_SET, inputPrincs));
} catch (NullPointerException npe) {
// Sometimes people deserialize the principals set only.
// Subject is not accessible, so just don't fail.
principals = Collections.synchronizedSet
(new SecureSet<Principal>(this, PRINCIPAL_SET));
}
// The Credential {@code Set} is not serialized, but we do not
// want the default deserialization routine to set it to null.