Fix 487694: Race condition in annotation unpacking can surface through Spring AOP

4 files changed, 21 insertions, 8 deletions

diff --git a/bcel-builder/bcel-verifier.jar b/bcel-builder/bcel-verifier.jar
deleted file mode 100644
index e6edce128..000000000
--- a/bcel-builder/bcel-verifier.jar
+++ /dev/null
diff --git a/bcel-builder/bcel.jar b/bcel-builder/bcel.jar
deleted file mode 100644
index a7003b981..000000000
--- a/bcel-builder/bcel.jar
+++ /dev/null
diff --git a/bcel-builder/src/org/aspectj/apache/bcel/classfile/annotation/RuntimeAnnos.java b/bcel-builder/src/org/aspectj/apache/bcel/classfile/annotation/RuntimeAnnos.java
index 05c83a6ee..c69b447ca 100644
--- a/bcel-builder/src/org/aspectj/apache/bcel/classfile/annotation/RuntimeAnnos.java
+++ b/bcel-builder/src/org/aspectj/apache/bcel/classfile/annotation/RuntimeAnnos.java
@@ -71,12 +71,17 @@ public abstract class RuntimeAnnos extends Attribute {
 		}
 	}
 
+	
 	private void inflate() {
 		try {
 			DataInputStream dis = new DataInputStream(new ByteArrayInputStream(annotation_data));
 			int numberOfAnnotations = dis.readUnsignedShort();
-			for (int i = 0; i < numberOfAnnotations; i++) {
-				annotations.add(AnnotationGen.read(dis, getConstantPool(), visible));
+			if (numberOfAnnotations > 0) {
+				List<AnnotationGen> inflatedAnnotations = new ArrayList<AnnotationGen>();
+				for (int i = 0; i < numberOfAnnotations; i++) {
+					inflatedAnnotations.add(AnnotationGen.read(dis, getConstantPool(), visible));
+				}
+				annotations = inflatedAnnotations;
 			}
 			dis.close();
 			inflated = true;
diff --git a/bcel-builder/src/org/aspectj/apache/bcel/classfile/annotation/RuntimeParamAnnos.java b/bcel-builder/src/org/aspectj/apache/bcel/classfile/annotation/RuntimeParamAnnos.java
index ad92c9fce..650bd2625 100644
--- a/bcel-builder/src/org/aspectj/apache/bcel/classfile/annotation/RuntimeParamAnnos.java
+++ b/bcel-builder/src/org/aspectj/apache/bcel/classfile/annotation/RuntimeParamAnnos.java
@@ -87,13 +87,21 @@ public abstract class RuntimeParamAnnos extends Attribute {
 		try {
 			DataInputStream dis = new DataInputStream(new ByteArrayInputStream(annotation_data));
 			int numParameters = dis.readUnsignedByte();
-			for (int i=0; i<numParameters; i++) {
-				int numAnnotations = dis.readUnsignedShort();
-				AnnotationGen[] annotations = new AnnotationGen[numAnnotations];
-				for (int j=0; j<numAnnotations; j++) {
-					annotations[j] = AnnotationGen.read(dis,getConstantPool(),visible);
+			if (numParameters > 0) {
+				List<AnnotationGen[]> inflatedParameterAnnotations = new ArrayList<AnnotationGen[]>();
+				for (int i=0; i<numParameters; i++) {
+					int numAnnotations = dis.readUnsignedShort();
+					if (numAnnotations == 0 ) {
+						inflatedParameterAnnotations.add(AnnotationGen.NO_ANNOTATIONS);
+					} else {
+						AnnotationGen[] annotations = new AnnotationGen[numAnnotations];
+						for (int j=0; j<numAnnotations; j++) {
+							annotations[j] = AnnotationGen.read(dis,getConstantPool(),visible);
+						}
+						inflatedParameterAnnotations.add(annotations);
+					}
 				}
-				parameterAnnotations.add(annotations);
+				parameterAnnotations = inflatedParameterAnnotations;
 			}
 			inflated = true;
 		} catch (IOException ioe) {