Fix 487694: Race condition in annotation unpacking can surface through Spring AOP

8 files changed, 22 insertions, 9 deletions

diff --git a/bcel-builder/bcel-verifier.jar b/bcel-builder/bcel-verifier.jar
deleted file mode 100644
index e6edce128..000000000
--- a/bcel-builder/bcel-verifier.jar
+++ /dev/null
diff --git a/bcel-builder/bcel.jar b/bcel-builder/bcel.jar
deleted file mode 100644
index a7003b981..000000000
--- a/bcel-builder/bcel.jar
+++ /dev/null
diff --git a/bcel-builder/src/org/aspectj/apache/bcel/classfile/annotation/RuntimeAnnos.java b/bcel-builder/src/org/aspectj/apache/bcel/classfile/annotation/RuntimeAnnos.java
index 05c83a6ee..c69b447ca 100644
--- a/bcel-builder/src/org/aspectj/apache/bcel/classfile/annotation/RuntimeAnnos.java
+++ b/bcel-builder/src/org/aspectj/apache/bcel/classfile/annotation/RuntimeAnnos.java
@@ -71,12 +71,17 @@ public abstract class RuntimeAnnos extends Attribute {
 		}
 	}
 
+	
 	private void inflate() {
 		try {
 			DataInputStream dis = new DataInputStream(new ByteArrayInputStream(annotation_data));
 			int numberOfAnnotations = dis.readUnsignedShort();
-			for (int i = 0; i < numberOfAnnotations; i++) {
-				annotations.add(AnnotationGen.read(dis, getConstantPool(), visible));
+			if (numberOfAnnotations > 0) {
+				List<AnnotationGen> inflatedAnnotations = new ArrayList<AnnotationGen>();
+				for (int i = 0; i < numberOfAnnotations; i++) {
+					inflatedAnnotations.add(AnnotationGen.read(dis, getConstantPool(), visible));
+				}
+				annotations = inflatedAnnotations;
 			}
 			dis.close();
 			inflated = true;
diff --git a/bcel-builder/src/org/aspectj/apache/bcel/classfile/annotation/RuntimeParamAnnos.java b/bcel-builder/src/org/aspectj/apache/bcel/classfile/annotation/RuntimeParamAnnos.java
index ad92c9fce..650bd2625 100644
--- a/bcel-builder/src/org/aspectj/apache/bcel/classfile/annotation/RuntimeParamAnnos.java
+++ b/bcel-builder/src/org/aspectj/apache/bcel/classfile/annotation/RuntimeParamAnnos.java
@@ -87,13 +87,21 @@ public abstract class RuntimeParamAnnos extends Attribute {
 		try {
 			DataInputStream dis = new DataInputStream(new ByteArrayInputStream(annotation_data));
 			int numParameters = dis.readUnsignedByte();
-			for (int i=0; i<numParameters; i++) {
-				int numAnnotations = dis.readUnsignedShort();
-				AnnotationGen[] annotations = new AnnotationGen[numAnnotations];
-				for (int j=0; j<numAnnotations; j++) {
-					annotations[j] = AnnotationGen.read(dis,getConstantPool(),visible);
+			if (numParameters > 0) {
+				List<AnnotationGen[]> inflatedParameterAnnotations = new ArrayList<AnnotationGen[]>();
+				for (int i=0; i<numParameters; i++) {
+					int numAnnotations = dis.readUnsignedShort();
+					if (numAnnotations == 0 ) {
+						inflatedParameterAnnotations.add(AnnotationGen.NO_ANNOTATIONS);
+					} else {
+						AnnotationGen[] annotations = new AnnotationGen[numAnnotations];
+						for (int j=0; j<numAnnotations; j++) {
+							annotations[j] = AnnotationGen.read(dis,getConstantPool(),visible);
+						}
+						inflatedParameterAnnotations.add(annotations);
+					}
 				}
-				parameterAnnotations.add(annotations);
+				parameterAnnotations = inflatedParameterAnnotations;
 			}
 			inflated = true;
 		} catch (IOException ioe) {
diff --git a/lib/bcel/bcel-src.zip b/lib/bcel/bcel-src.zip
index 014a928d4..55e904c39 100644
--- a/lib/bcel/bcel-src.zip
+++ b/lib/bcel/bcel-src.zip
diff --git a/lib/bcel/bcel-verifier.jar b/lib/bcel/bcel-verifier.jar
index 87a86a795..7ca7ec48b 100644
--- a/lib/bcel/bcel-verifier.jar
+++ b/lib/bcel/bcel-verifier.jar
diff --git a/lib/bcel/bcel.jar b/lib/bcel/bcel.jar
index 197137b65..79ff2ae98 100644
--- a/lib/bcel/bcel.jar
+++ b/lib/bcel/bcel.jar
diff --git a/weaver5/java5-src/org/aspectj/weaver/reflect/Java15AnnotationFinder.java b/weaver5/java5-src/org/aspectj/weaver/reflect/Java15AnnotationFinder.java
index c19f38e46..a978d9605 100644
--- a/weaver5/java5-src/org/aspectj/weaver/reflect/Java15AnnotationFinder.java
+++ b/weaver5/java5-src/org/aspectj/weaver/reflect/Java15AnnotationFinder.java
@@ -254,7 +254,7 @@ public class Java15AnnotationFinder implements AnnotationFinder, ArgNameFinder {
 			org.aspectj.apache.bcel.classfile.annotation.AnnotationGen[] anns = jc.getAnnotations();
 			bcelRepository.clear();
 			if (anns == null)
-				return new ResolvedType[0];
+				return ResolvedType.NONE;
 			ResolvedType[] ret = new ResolvedType[anns.length];
 			for (int i = 0; i < ret.length; i++) {
 				ret[i] = inWorld.resolve(UnresolvedType.forSignature(anns[i].getTypeSignature()));