diff --git a/.hgtags b/.hgtags
index d2a2798f0a58f7caf2b4b806823f14a1f80da721..874dc9ebe7b6bb05325c29b9a0cf2b5af5eedc52 100644
--- a/.hgtags
+++ b/.hgtags
@@ -931,6 +931,8 @@ c2c4db2a42a215c98a4f027edb8bbb00dd62d9b9 jdk8u112-b14
 b28d012a24cab8f4ceeee0c9d3252969757423ed jdk8u112-b15
 e134dc1879b72124e478be01680b0646a2fbf585 jdk8u112-b16
 87440ed4e1de7753a436f957d35555d8b4e26f1d jdk8u112-b31
+ba25f5833a128b8062e597f794efda26b30f095d jdk8u112-b32
+919ffdca10c2721ee0f6f233e704709174556510 jdk8u112-b33
 3b0e5f01891f5ebbf67797b1aae786196f1bb4f6 jdk8u121-b00
 251a2493b1857f2ff4f11eab2dfd8b2fe8ed441b jdk8u121-b01
 70c4a50f576a01ec975d0a02b3642ee33db39ed8 jdk8u121-b02
diff --git a/src/share/vm/classfile/systemDictionary.cpp b/src/share/vm/classfile/systemDictionary.cpp
index 31be14bd4bdf70d6b7e0df0f6eaa13f7fc693795..1dfe3b647edc75d933f6ed09b9992128930eed29 100644
--- a/src/share/vm/classfile/systemDictionary.cpp
+++ b/src/share/vm/classfile/systemDictionary.cpp
@@ -1084,15 +1084,18 @@ Klass* SystemDictionary::resolve_from_stream(Symbol* class_name,
                                                              THREAD);
 
   const char* pkg = "java/";
+  size_t pkglen = strlen(pkg);
   if (!HAS_PENDING_EXCEPTION &&
       !class_loader.is_null() &&
       parsed_name != NULL &&
-      !strncmp((const char*)parsed_name->bytes(), pkg, strlen(pkg))) {
+      parsed_name->utf8_length() >= (int)pkglen &&
+      !strncmp((const char*)parsed_name->bytes(), pkg, pkglen)) {
     // It is illegal to define classes in the "java." package from
     // JVM_DefineClass or jni_DefineClass unless you're the bootclassloader
     ResourceMark rm(THREAD);
     char* name = parsed_name->as_C_string();
     char* index = strrchr(name, '/');
+    assert(index != NULL, "must be");
     *index = '\0'; // chop to just the package name
     while ((index = strchr(name, '/')) != NULL) {
       *index = '.'; // replace '/' with '.' in package name