← Back to branch summary

~ubuntu-branches/ubuntu/karmic/openjdk-6/karmic-security

« back to all changes in this revision

Viewing changes to patches/security/20110215/6985453.patch

  • Committer: Bazaar Package Importer
  • Author(s): Steve Beattie
  • Date: 2011-02-23 09:41:17 UTC
  • mfrom: (0.33.1 upstream)
  • Revision ID: james.westby@ubuntu.com-20110223094117-a1onlognjzmk28qv
Tags: 6b20-1.9.7-0ubuntu1~9.10.1
* IcedTea6 1.9.7 release.
  - SECURITY UPDATE:
    + S4421494, CVE-2010-4476: infinite loop while parsing double literal.
    + S6878713, CVE-2010-4469: Hotspot backward jsr heap corruption
    + S6907662, CVE-2010-4465: Swing timer-based security manager bypass
    + S6994263, CVE-2010-4472: Untrusted code allowed to replace
      DSIG/C14N implementation
    + S6981922, CVE-2010-4448: DNS cache poisoning by untrusted applets
    + S6983554, CVE-2010-4450: Launcher incorrect processing of
      empty library path entries
    + S6985453, CVE-2010-4471: Java2D font-related system property leak
    + S6927050, CVE-2010-4470: JAXP untrusted component state manipulation
    + RH677332, CVE-2011-0706: Multiple signers privilege escalation
  - Bug fixes
    + RH676659: Pass -export-dynamic flag to linker using -Wl,
      as option in gcc 4.6+ is broken
    + G344659: Fix issue when building on SPARC
    + Fix latent JAXP bug caused by missing import
* dropped patch due to different fix applied upstream:
  - debian/patches/hotspot-sparc-fix.diff
* debian/patches/hotspot-fix_added_define.patch: added to fix
  redefinition added by patch for S6878713
* Makefile.{am,in}: don't use stage1 build for zerovm, bootstrap
  zerovm instead to compensate for
  http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=631

Show diffs side-by-side

added added

removed removed

Lines of Context:
patches/security/20110215/6985453.patch
 
1
# HG changeset patch
 
2
# User bae
 
3
# Date 1288382134 -14400
 
4
# Node ID 5e70dbac6a7d3743e64e19399552a60d25ba5cff
 
5
# Parent  f3dff5c1b9c2cc8d38fde74c3661786f6332a3eb
 
6
6985453: Font.createFont may expose some system properties in exception text
 
7
Reviewed-by: prr, hawtin
 
8
 
 
9
diff --git a/src/share/classes/sun/font/FileFont.java b/src/share/classes/sun/font/FileFont.java
 
10
--- openjdk/jdk/src/share/classes/sun/font/FileFont.java
 
11
+++ openjdk/jdk/src/share/classes/sun/font/FileFont.java
 
12
@@ -48,6 +48,9 @@ import java.util.HashSet;
 
13
 import java.util.HashSet;
 
14
 import java.util.HashMap;
 
15
 import java.awt.Font;
 
16
+import java.security.AccessController;
 
17
+import java.security.PrivilegedActionException;
 
18
+import java.security.PrivilegedExceptionAction;
 
19
 
 
20
 public abstract class FileFont extends PhysicalFont {
 
21
 
 
22
@@ -284,4 +287,49 @@ public abstract class FileFont extends P
 
23
             });
 
24
         }
 
25
     }
 
26
+
 
27
+    protected String getPublicFileName() {
 
28
+        SecurityManager sm = System.getSecurityManager();
 
29
+        if (sm == null) {
 
30
+            return platName;
 
31
+        }
 
32
+        boolean canReadProperty = true;
 
33
+
 
34
+        try {
 
35
+            sm.checkPropertyAccess("java.io.tmpdir");
 
36
+        } catch (SecurityException e) {
 
37
+            canReadProperty = false;
 
38
+        }
 
39
+
 
40
+        if (canReadProperty) {
 
41
+            return platName;
 
42
+        }
 
43
+
 
44
+        final File f = new File(platName);
 
45
+
 
46
+         Boolean isTmpFile = Boolean.FALSE;
 
47
+         try {
 
48
+             isTmpFile = AccessController.doPrivileged(
 
49
+                 new PrivilegedExceptionAction<Boolean>() {
 
50
+                     public Boolean run() {
 
51
+                         File tmp = new File(System.getProperty("java.io.tmpdir"));
 
52
+                         try {
 
53
+                             String tpath = tmp.getCanonicalPath();
 
54
+                             String fpath = f.getCanonicalPath();
 
55
+
 
56
+                             return (fpath == null) || fpath.startsWith(tpath);
 
57
+                         } catch (IOException e) {
 
58
+                             return Boolean.TRUE;
 
59
+                         }
 
60
+                     }
 
61
+                 }
 
62
+             );
 
63
+         } catch (PrivilegedActionException e) {
 
64
+             // unable to verify whether value of java.io.tempdir will be
 
65
+             // exposed, so return only a name of the font file.
 
66
+             isTmpFile = Boolean.TRUE;
 
67
+         }
 
68
+
 
69
+         return  isTmpFile ? "temp file" : platName;
 
70
+     }
 
71
 }
 
72
diff --git a/src/share/classes/sun/font/TrueTypeFont.java b/src/share/classes/sun/font/TrueTypeFont.java
 
73
--- openjdk/jdk/src/share/classes/sun/font/TrueTypeFont.java
 
74
+++ openjdk/jdk/src/share/classes/sun/font/TrueTypeFont.java
 
75
@@ -504,7 +504,8 @@ public class TrueTypeFont extends FileFo
 
76
                 break;
 
77
 
 
78
             default:
 
79
-                throw new FontFormatException("Unsupported sfnt " + platName);
 
80
+                throw new FontFormatException("Unsupported sfnt " +
 
81
+                                              getPublicFileName());
 
82
             }
 
83
 
 
84
             /* Now have the offset of this TT font (possibly within a TTC)
 
85
@@ -1369,6 +1370,6 @@ public class TrueTypeFont extends FileFo
 
86
 
 
87
     public String toString() {
 
88
         return "** TrueType Font: Family="+familyName+ " Name="+fullName+
 
89
-            " style="+style+" fileName="+platName;
 
90
+            " style="+style+" fileName="+getPublicFileName();
 
91
     }
 
92
 }
 
93
diff --git a/src/share/classes/sun/font/Type1Font.java b/src/share/classes/sun/font/Type1Font.java
 
94
--- openjdk/jdk/src/share/classes/sun/font/Type1Font.java
 
95
+++ openjdk/jdk/src/share/classes/sun/font/Type1Font.java
 
96
@@ -677,7 +677,7 @@ public class Type1Font extends FileFont 
 
97
 
 
98
     public String toString() {
 
99
         return "** Type1 Font: Family="+familyName+ " Name="+fullName+
 
100
-            " style="+style+" fileName="+platName;
 
101
+            " style="+style+" fileName="+getPublicFileName();
 
102
     }
 
103
 
 
104
 }