From e370d6098aacaa5453a668842fe965acfada7df8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Johan=20Sj=C3=B6l=C3=A9n?= Date: Mon, 10 Nov 2025 09:49:41 +0100 Subject: [PATCH 1/3] Add a recursion limit --- .../share/classfile/classFileParser.cpp | 19 +++-- .../runtime/ClassFile/NestedAnnotations.java | 77 +++++++++++++++++++ 2 files changed, 90 insertions(+), 6 deletions(-) create mode 100644 test/hotspot/jtreg/runtime/ClassFile/NestedAnnotations.java diff --git a/src/hotspot/share/classfile/classFileParser.cpp b/src/hotspot/share/classfile/classFileParser.cpp index eb8a2a389b90c..b1914241dd3f9 100644 --- a/src/hotspot/share/classfile/classFileParser.cpp +++ b/src/hotspot/share/classfile/classFileParser.cpp @@ -1016,7 +1016,8 @@ class ClassFileParser::ClassAnnotationCollector : public AnnotationCollector{ }; -static int skip_annotation_value(const u1*, int, int); // fwd decl +static int skip_annotation_value(const u1* buffer, int limit, int index, int recursion_depth); // fwd decl +static const int max_recursion_depth = 5; // Safely increment index by val if does not pass limit #define SAFE_ADD(index, limit, val) \ @@ -1024,23 +1025,29 @@ if (index >= limit - val) return limit; \ index += val; // Skip an annotation. Return >=limit if there is any problem. -static int skip_annotation(const u1* buffer, int limit, int index) { +static int skip_annotation(const u1* buffer, int limit, int index, int recursion_depth = 0) { assert(buffer != nullptr, "invariant"); + if (recursion_depth > max_recursion_depth) { + return limit; + } // annotation := atype:u2 do(nmem:u2) {member:u2 value} // value := switch (tag:u1) { ... } SAFE_ADD(index, limit, 4); // skip atype and read nmem int nmem = Bytes::get_Java_u2((address)buffer + index - 2); while (--nmem >= 0 && index < limit) { SAFE_ADD(index, limit, 2); // skip member - index = skip_annotation_value(buffer, limit, index); + index = skip_annotation_value(buffer, limit, index, recursion_depth + 1); } return index; } // Skip an annotation value. Return >=limit if there is any problem. -static int skip_annotation_value(const u1* buffer, int limit, int index) { +static int skip_annotation_value(const u1* buffer, int limit, int index, int recursion_depth) { assert(buffer != nullptr, "invariant"); + if (recursion_depth > max_recursion_depth) { + return limit; + } // value := switch (tag:u1) { // case B, C, I, S, Z, D, F, J, c: con:u2; // case e: e_class:u2 e_name:u2; @@ -1072,12 +1079,12 @@ static int skip_annotation_value(const u1* buffer, int limit, int index) { SAFE_ADD(index, limit, 2); // read nval int nval = Bytes::get_Java_u2((address)buffer + index - 2); while (--nval >= 0 && index < limit) { - index = skip_annotation_value(buffer, limit, index); + index = skip_annotation_value(buffer, limit, index, recursion_depth + 1); } } break; case '@': - index = skip_annotation(buffer, limit, index); + index = skip_annotation(buffer, limit, index, recursion_depth + 1); break; default: return limit; // bad tag byte diff --git a/test/hotspot/jtreg/runtime/ClassFile/NestedAnnotations.java b/test/hotspot/jtreg/runtime/ClassFile/NestedAnnotations.java new file mode 100644 index 0000000000000..1c72ea7439cab --- /dev/null +++ b/test/hotspot/jtreg/runtime/ClassFile/NestedAnnotations.java @@ -0,0 +1,77 @@ +/* + * Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +/* + * @test NestedAnnotations + * @summary The JVM handles nested annotations + * @bug 8364655 + * @requires vm.flagless + * @library /test/lib + * @library /testlibrary/asm + * @modules java.base/jdk.internal.misc + * java.desktop + * java.management + * @run driver NestedAnnotations + */ + +import jdk.test.lib.process.OutputAnalyzer; +import jdk.test.lib.process.ProcessTools; + +import org.objectweb.asm.AnnotationVisitor; +import org.objectweb.asm.ClassWriter; + +import java.lang.invoke.MethodHandles; +import java.util.ArrayList; + +import static org.objectweb.asm.Opcodes.*; + +public class NestedAnnotations { + static void test() throws Exception { + var cw = new ClassWriter(0); + cw.visit(V17, 0, "Annotations", null, "java/lang/Object", null); + final int number_of_annotations = 65535; + var av = cw.visitAnnotation("LTest;", true); + var stack = new ArrayList(number_of_annotations + 1); + stack.add(av); + for (int i = 0; i < number_of_annotations; i++) { + stack.add(av = av.visitAnnotation("value", "LTest;")); + } + for (int i = number_of_annotations; i != 0;) { + stack.get(--i).visitEnd(); + } + + cw.visitEnd(); + // Does not matter whether the class is hidden, used for simplicity’ sake. + MethodHandles.lookup().defineHiddenClass(cw.toByteArray(), true); + } + + public static void main(String[] args) throws Exception { + if (args.length == 1 && args[0].equals("testIt")) { + test(); + } else { + OutputAnalyzer oa = ProcessTools.executeTestJava("NestedAnnotations", "testIt"); + oa.shouldHaveExitValue(0); + } + } +} + From 0e0e56f41ea5a9393257ecbeb4935e0948846ec3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Johan=20Sj=C3=B6l=C3=A9n?= Date: Fri, 5 Dec 2025 08:41:37 +0100 Subject: [PATCH 2/3] Spelling mistake --- test/hotspot/jtreg/runtime/ClassFile/NestedAnnotations.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/hotspot/jtreg/runtime/ClassFile/NestedAnnotations.java b/test/hotspot/jtreg/runtime/ClassFile/NestedAnnotations.java index 1c72ea7439cab..795acd0fc5909 100644 --- a/test/hotspot/jtreg/runtime/ClassFile/NestedAnnotations.java +++ b/test/hotspot/jtreg/runtime/ClassFile/NestedAnnotations.java @@ -61,7 +61,7 @@ static void test() throws Exception { } cw.visitEnd(); - // Does not matter whether the class is hidden, used for simplicity’ sake. + // Does not matter whether the class is hidden, used for simplicity’s sake. MethodHandles.lookup().defineHiddenClass(cw.toByteArray(), true); } From c72c87d02f1920fc6a1de48ce8297b06135643a9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Johan=20Sj=C3=B6len?= Date: Tue, 16 Dec 2025 15:49:05 +0100 Subject: [PATCH 3/3] Untabify --- .../runtime/ClassFile/NestedAnnotations.java | 32 +++++++++---------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/test/hotspot/jtreg/runtime/ClassFile/NestedAnnotations.java b/test/hotspot/jtreg/runtime/ClassFile/NestedAnnotations.java index 795acd0fc5909..81dc442ce0c40 100644 --- a/test/hotspot/jtreg/runtime/ClassFile/NestedAnnotations.java +++ b/test/hotspot/jtreg/runtime/ClassFile/NestedAnnotations.java @@ -1,4 +1,4 @@ -/* + /* * Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * @@ -47,22 +47,22 @@ public class NestedAnnotations { static void test() throws Exception { - var cw = new ClassWriter(0); - cw.visit(V17, 0, "Annotations", null, "java/lang/Object", null); - final int number_of_annotations = 65535; - var av = cw.visitAnnotation("LTest;", true); - var stack = new ArrayList(number_of_annotations + 1); - stack.add(av); - for (int i = 0; i < number_of_annotations; i++) { - stack.add(av = av.visitAnnotation("value", "LTest;")); - } - for (int i = number_of_annotations; i != 0;) { - stack.get(--i).visitEnd(); - } + var cw = new ClassWriter(0); + cw.visit(V17, 0, "Annotations", null, "java/lang/Object", null); + final int number_of_annotations = 65535; + var av = cw.visitAnnotation("LTest;", true); + var stack = new ArrayList(number_of_annotations + 1); + stack.add(av); + for (int i = 0; i < number_of_annotations; i++) { + stack.add(av = av.visitAnnotation("value", "LTest;")); + } + for (int i = number_of_annotations; i != 0;) { + stack.get(--i).visitEnd(); + } - cw.visitEnd(); - // Does not matter whether the class is hidden, used for simplicity’s sake. - MethodHandles.lookup().defineHiddenClass(cw.toByteArray(), true); + cw.visitEnd(); + // Does not matter whether the class is hidden, used for simplicity’s sake. + MethodHandles.lookup().defineHiddenClass(cw.toByteArray(), true); } public static void main(String[] args) throws Exception {