From 7900daf789bf1b067e6ca5e3f09f21b346536c96 Mon Sep 17 00:00:00 2001
From: sherman <unknown>
Date: Tue, 28 May 2013 10:42:52 -0700
Subject: [PATCH] 8001750: CharsetDecoder.replacement should not be changeable
 except via replaceWith method Summary: to make defensive copy for set/get
 replacement byte array Reviewed-by: martin

---
 .../java/nio/charset/Charset-X-Coder.java.template  | 13 +++++++++++--
 src/share/classes/sun/nio/cs/UTF_8.java             |  7 ++++++-
 src/share/classes/sun/nio/cs/ext/DoubleByte.java    |  7 +++++--
 src/share/classes/sun/nio/cs/ext/HKSCS.java         |  6 +++++-
 4 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/src/share/classes/java/nio/charset/Charset-X-Coder.java.template b/src/share/classes/java/nio/charset/Charset-X-Coder.java.template
index 5b6ecfa63..2449d56cf 100644
--- a/src/share/classes/java/nio/charset/Charset-X-Coder.java.template
+++ b/src/share/classes/java/nio/charset/Charset-X-Coder.java.template
@@ -34,6 +34,7 @@ import java.nio.BufferOverflowException;
 import java.nio.BufferUnderflowException;
 import java.lang.ref.WeakReference;
 import java.nio.charset.CoderMalfunctionError;                  // javadoc
+import java.util.Arrays;
 
 
 /**
@@ -244,7 +245,12 @@ public abstract class Charset$Coder$ {
      *          which is never <tt>null</tt> and is never empty
      */
     public final $replType$ replacement() {
+#if[decoder]
         return replacement;
+#end[decoder]
+#if[encoder]
+        return Arrays.copyOf(replacement, replacement.$replLength$);
+#end[encoder]
     }
 
     /**
@@ -280,12 +286,15 @@ public abstract class Charset$Coder$ {
             throw new IllegalArgumentException("Empty replacement");
         if (len > max$ItypesPerOtype$)
             throw new IllegalArgumentException("Replacement too long");
+#if[decoder]
+        this.replacement = newReplacement;
+#end[decoder]
 #if[encoder]
         if (!isLegalReplacement(newReplacement))
             throw new IllegalArgumentException("Illegal replacement");
+        this.replacement = Arrays.copyOf(newReplacement, newReplacement.$replLength$);
 #end[encoder]
-        this.replacement = newReplacement;
-        implReplaceWith(newReplacement);
+        implReplaceWith(this.replacement);
         return this;
     }
 
diff --git a/src/share/classes/sun/nio/cs/UTF_8.java b/src/share/classes/sun/nio/cs/UTF_8.java
index 3a475d478..cb707ff5a 100644
--- a/src/share/classes/sun/nio/cs/UTF_8.java
+++ b/src/share/classes/sun/nio/cs/UTF_8.java
@@ -682,6 +682,11 @@ class UTF_8 extends Unicode
                 return encodeBufferLoop(src, dst);
         }
 
+        private byte repl = (byte)'?';
+        protected void implReplaceWith(byte[] newReplacement) {
+            repl = newReplacement[0];
+        }
+
         // returns -1 if there is malformed char(s) and the
         // "action" for malformed input is not REPLACE.
         public int encode(char[] sa, int sp, int len, byte[] da) {
@@ -709,7 +714,7 @@ class UTF_8 extends Unicode
                     if (uc < 0) {
                         if (malformedInputAction() != CodingErrorAction.REPLACE)
                             return -1;
-                        da[dp++] = replacement()[0];
+                        da[dp++] = repl;
                     } else {
                         da[dp++] = (byte)(0xf0 | ((uc >> 18)));
                         da[dp++] = (byte)(0x80 | ((uc >> 12) & 0x3f));
diff --git a/src/share/classes/sun/nio/cs/ext/DoubleByte.java b/src/share/classes/sun/nio/cs/ext/DoubleByte.java
index af649edd8..c213d288c 100644
--- a/src/share/classes/sun/nio/cs/ext/DoubleByte.java
+++ b/src/share/classes/sun/nio/cs/ext/DoubleByte.java
@@ -610,6 +610,11 @@ public class DoubleByte {
                 return encodeBufferLoop(src, dst);
         }
 
+        protected byte[] repl = replacement();
+        protected void implReplaceWith(byte[] newReplacement) {
+            repl = newReplacement;
+        }
+
         public int encode(char[] src, int sp, int len, byte[] dst) {
             int dp = 0;
             int sl = sp + len;
@@ -622,7 +627,6 @@ public class DoubleByte {
                         Character.isLowSurrogate(src[sp])) {
                         sp++;
                     }
-                    byte[] repl = replacement();
                     dst[dp++] = repl[0];
                     if (repl.length > 1)
                         dst[dp++] = repl[1];
@@ -877,7 +881,6 @@ public class DoubleByte {
                         Character.isLowSurrogate(src[sp])) {
                         sp++;
                     }
-                    byte[] repl = replacement();
                     dst[dp++] = repl[0];
                     if (repl.length > 1)
                         dst[dp++] = repl[1];
diff --git a/src/share/classes/sun/nio/cs/ext/HKSCS.java b/src/share/classes/sun/nio/cs/ext/HKSCS.java
index 851888082..097846882 100644
--- a/src/share/classes/sun/nio/cs/ext/HKSCS.java
+++ b/src/share/classes/sun/nio/cs/ext/HKSCS.java
@@ -356,6 +356,11 @@ public class HKSCS {
                 return encodeBufferLoop(src, dst);
         }
 
+        private byte[] repl = replacement();
+        protected void implReplaceWith(byte[] newReplacement) {
+            repl = newReplacement;
+        }
+
         public int encode(char[] src, int sp, int len, byte[] dst) {
             int dp = 0;
             int sl = sp + len;
@@ -367,7 +372,6 @@ public class HKSCS {
                         !Character.isLowSurrogate(src[sp]) ||
                         (bb = encodeSupp(Character.toCodePoint(c, src[sp++])))
                         == UNMAPPABLE_ENCODING) {
-                        byte[] repl = replacement();
                         dst[dp++] = repl[0];
                         if (repl.length > 1)
                             dst[dp++] = repl[1];
-- 
GitLab