8192757: Improve stub classes implementation

Reviewed-by: rriggs, dfuchs, erikj

make/BuildCorba.gmk

 #
-# Copyright (c) 2007, 2013, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2007, 2018, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -174,7 +174,8 @@ ifeq ($(LOGWRAPPERS_ARE_CREATED), yes)
         SETUP := GENERATE_NEWBYTECODE, \
         SRC := $(CORBA_TOPDIR)/src/share/classes $(CORBA_OUTPUTDIR)/gensrc $(CORBA_OUTPUTDIR)/logwrappers, \
         EXCLUDES := com/sun/corba/se/PortableActivationIDL \
-            com/sun/tools/corba/se/logutil, \
+            com/sun/tools/corba/se/logutil \
+            sun/misc, \
         EXCLUDE_FILES := com/sun/corba/se/impl/presentation/rmi/JNDIStateFactoryImpl.java \
             com/sun/corba/se/spi/presentation/rmi/StubWrapper.java \
             com/sun/org/omg/CORBA/IDLTypeOperations.java \

src/share/classes/com/sun/corba/se/impl/ior/StubIORImpl.java

 /*
- * Copyright (c) 2003, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2018, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -34,7 +34,6 @@ package com.sun.corba.se.impl.ior;
 import java.io.ObjectInputStream ;
 import java.io.ObjectOutputStream ;
 import java.io.IOException ;
-import java.io.StringWriter ;
 
 import org.omg.CORBA.ORB ;
 
@@ -47,6 +46,7 @@ import org.omg.CORBA.portable.OutputStream ;
 // other vendor's ORBs.
 import com.sun.corba.se.spi.presentation.rmi.StubAdapter ;
 import com.sun.corba.se.impl.orbutil.HexOutputStream ;
+import sun.corba.SharedSecrets;
 
 /**
  * This class implements a very simply IOR representation
@@ -125,14 +125,20 @@ public class StubIORImpl
     {
         // read the IOR from the ObjectInputStream
         int typeLength = stream.readInt();
+        SharedSecrets.getJavaOISAccess().checkArray(stream, byte[].class, typeLength);
         typeData = new byte[typeLength];
         stream.readFully(typeData);
+
         int numProfiles = stream.readInt();
+        SharedSecrets.getJavaOISAccess().checkArray(stream, int[].class, numProfiles);
+        SharedSecrets.getJavaOISAccess().checkArray(stream, byte[].class, numProfiles);
         profileTags = new int[numProfiles];
         profileData = new byte[numProfiles][];
         for (int i = 0; i < numProfiles; i++) {
             profileTags[i] = stream.readInt();
-            profileData[i] = new byte[stream.readInt()];
+            int dataSize = stream.readInt();
+            SharedSecrets.getJavaOISAccess().checkArray(stream, byte[].class, dataSize);
+            profileData[i] = new byte[dataSize];
             stream.readFully(profileData[i]);
         }
     }

src/share/classes/sun/corba/SharedSecrets.java

 /*
- * Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -26,8 +26,10 @@
 package sun.corba;
 
 import com.sun.corba.se.impl.io.ValueUtility;
+import sun.misc.JavaOISAccess;
 import sun.misc.Unsafe;
 
+import java.io.ObjectInputStream;
 import java.security.AccessController;
 
 /** A repository of "shared secrets", which are a mechanism for
@@ -43,6 +45,7 @@ import java.security.AccessController;
 public class SharedSecrets {
     private static final Unsafe unsafe = Unsafe.getUnsafe();
     private static JavaCorbaAccess javaCorbaAccess;
+    private static JavaOISAccess javaOISAccess;
 
     public static JavaCorbaAccess getJavaCorbaAccess() {
         if (javaCorbaAccess == null) {
@@ -57,4 +60,15 @@ public class SharedSecrets {
         javaCorbaAccess = access;
     }
 
+    public static void setJavaOISAccess(JavaOISAccess access) {
+        javaOISAccess = access;
+    }
+
+    public static JavaOISAccess getJavaOISAccess() {
+        if (javaOISAccess == null)
+            unsafe.ensureClassInitialized(ObjectInputStream.class);
+
+        return javaOISAccess;
+    }
+
 }

src/share/classes/sun/misc/JavaOISAccess.java

+/*
+ * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package sun.misc;
+
+import java.io.InvalidClassException;
+import java.io.ObjectInputStream;
+
+/*
+ * Skeleton interface added so com.sun.corba.se.impl.ior.StubIORImpl will compile.
+ * JDK implementation will be used at runtime.
+ */
+public interface JavaOISAccess {
+    void setObjectInputFilter(ObjectInputStream stream, ObjectInputFilter filter);
+    ObjectInputFilter getObjectInputFilter(ObjectInputStream stream);
+    void checkArray(ObjectInputStream stream, Class<?> arrayType, int arrayLength)
+        throws InvalidClassException;
+}

src/share/classes/sun/misc/ObjectInputFilter.java

+/*
+ * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package sun.misc;
+
+import java.io.InvalidClassException;
+import java.io.ObjectInputStream;
+
+/*
+ * Skeleton interface added so com.sun.corba.se.impl.ior.StubIORImpl will compile.
+ * JDK implementation will be used at runtime.
+ */
+public interface ObjectInputFilter {
+}