8009004: Better implementation of RMI connections

Summary: Better class handling.
Reviewed-by: alanb, dfuchs, skoivu, jbachorik
Contributed-by: jean-francois.denise@oracle.com

src/share/classes/com/sun/jmx/remote/util/OrderClassLoaders.java

@@ -25,6 +25,8 @@
 
 package com.sun.jmx.remote.util;
 
+import sun.reflect.misc.ReflectUtil;
+
 public class OrderClassLoaders extends ClassLoader {
     public OrderClassLoaders(ClassLoader cl1, ClassLoader cl2) {
         super(cl1);
@@ -32,9 +34,10 @@ public class OrderClassLoaders extends ClassLoader {
         this.cl2 = cl2;
     }
 
-    protected Class<?> findClass(String name) throws ClassNotFoundException {
+    protected Class<?> loadClass(String name, boolean resolve) throws ClassNotFoundException {
+        ReflectUtil.checkPackageAccess(name);
         try {
-            return super.findClass(name);
+            return super.loadClass(name, resolve);
         } catch (ClassNotFoundException cne) {
             if (cl2 != null) {
                 return cl2.loadClass(name);

src/share/classes/javax/management/remote/rmi/RMIConnectionImpl.java

@@ -48,6 +48,7 @@ import javax.management.remote.JMXServerErrorException;
 import javax.management.remote.NotificationResult;
 import javax.management.remote.TargetedNotification;
 import javax.security.auth.Subject;
+import sun.reflect.misc.ReflectUtil;
 
 import static com.sun.jmx.mbeanserver.Util.cast;
 import com.sun.jmx.remote.internal.ServerCommunicatorAdmin;
@@ -1792,6 +1793,7 @@ public class RMIConnectionImpl implements RMIConnection, Unreferenced {
         @Override
         protected Class<?> loadClass(String name, boolean resolve)
         throws ClassNotFoundException {
+            ReflectUtil.checkPackageAccess(name);
             try {
                 super.loadClass(name, resolve);
             } catch(Exception e) {