8023278: Reflection API methods do not throw AnnotationFormatError in case of malformed Runtime[In]VisibleTypeAnnotations attribute

Reviewed-by: darcy

2 files changed, 28 insertions, 23 deletions

diff --git a/src/share/classes/sun/reflect/annotation/TypeAnnotation.java b/src/share/classes/sun/reflect/annotation/TypeAnnotation.java
index 5c94db4d6..e1d1bba5e 100644
--- a/src/share/classes/sun/reflect/annotation/TypeAnnotation.java
+++ b/src/share/classes/sun/reflect/annotation/TypeAnnotation.java
@@ -147,13 +147,13 @@ public final class TypeAnnotation {
         public static final LocationInfo BASE_LOCATION = new LocationInfo();
 
         public static LocationInfo parseLocationInfo(ByteBuffer buf) {
-            int depth = buf.get();
+            int depth = buf.get() & 0xFF;
             if (depth == 0)
                 return BASE_LOCATION;
             Location[] locations = new Location[depth];
             for (int i = 0; i < depth; i++) {
                 byte tag = buf.get();
-                byte index = buf.get();
+                short index = (short)(buf.get() & 0xFF);
                 if (!(tag == 0 || tag == 1 | tag == 2 || tag == 3))
                     throw new AnnotationFormatError("Bad Location encoding in Type Annotation");
                 if (tag != 3 && index != 0)
@@ -164,26 +164,26 @@ public final class TypeAnnotation {
         }
 
         public LocationInfo pushArray() {
-            return pushLocation((byte)0, (byte)0);
+            return pushLocation((byte)0, (short)0);
         }
 
         public LocationInfo pushInner() {
-            return pushLocation((byte)1, (byte)0);
+            return pushLocation((byte)1, (short)0);
         }
 
         public LocationInfo pushWildcard() {
-            return pushLocation((byte) 2, (byte) 0);
+            return pushLocation((byte) 2, (short) 0);
         }
 
-        public LocationInfo pushTypeArg(byte index) {
+        public LocationInfo pushTypeArg(short index) {
             return pushLocation((byte) 3, index);
         }
 
-        public LocationInfo pushLocation(byte tag, byte index) {
+        public LocationInfo pushLocation(byte tag, short index) {
             int newDepth = this.depth + 1;
             Location[] res = new Location[newDepth];
             System.arraycopy(this.locations, 0, res, 0, depth);
-            res[newDepth - 1] = new Location(tag, index);
+            res[newDepth - 1] = new Location(tag, (short)(index & 0xFF));
             return new LocationInfo(newDepth, res);
         }
 
@@ -207,13 +207,13 @@ public final class TypeAnnotation {
 
         public static final class Location {
             public final byte tag;
-            public final byte index;
+            public final short index;
 
             boolean isSameLocation(Location other) {
                 return tag == other.tag && index == other.index;
             }
 
-            public Location(byte tag, byte index) {
+            public Location(byte tag, short index) {
                 this.tag = tag;
                 this.index = index;
             }
diff --git a/src/share/classes/sun/reflect/annotation/TypeAnnotationParser.java b/src/share/classes/sun/reflect/annotation/TypeAnnotationParser.java
index abd28cfaf..9bd4b6c64 100644
--- a/src/share/classes/sun/reflect/annotation/TypeAnnotationParser.java
+++ b/src/share/classes/sun/reflect/annotation/TypeAnnotationParser.java
@@ -394,20 +394,25 @@ public final class TypeAnnotationParser {
             ConstantPool cp,
             AnnotatedElement baseDecl,
             Class<?> container) {
-        TypeAnnotationTargetInfo ti = parseTargetInfo(buf);
-        LocationInfo locationInfo = LocationInfo.parseLocationInfo(buf);
-        Annotation a = AnnotationParser.parseAnnotation(buf, cp, container, false);
-        if (ti == null) // Inside a method for example
-            return null;
-        return new TypeAnnotation(ti, locationInfo, a, baseDecl);
+        try {
+            TypeAnnotationTargetInfo ti = parseTargetInfo(buf);
+            LocationInfo locationInfo = LocationInfo.parseLocationInfo(buf);
+            Annotation a = AnnotationParser.parseAnnotation(buf, cp, container, false);
+            if (ti == null) // Inside a method for example
+                return null;
+            return new TypeAnnotation(ti, locationInfo, a, baseDecl);
+        } catch (IllegalArgumentException | // Bad type in const pool at specified index
+                BufferUnderflowException e) {
+            throw new AnnotationFormatError(e);
+        }
     }
 
     private static TypeAnnotationTargetInfo parseTargetInfo(ByteBuffer buf) {
-        byte posCode = buf.get();
+        int posCode = buf.get() & 0xFF;
         switch(posCode) {
         case CLASS_TYPE_PARAMETER:
         case METHOD_TYPE_PARAMETER: {
-            byte index = buf.get();
+            int index = buf.get() & 0xFF;
             TypeAnnotationTargetInfo res;
             if (posCode == CLASS_TYPE_PARAMETER)
                 res = new TypeAnnotationTargetInfo(TypeAnnotationTarget.CLASS_TYPE_PARAMETER,
@@ -418,7 +423,7 @@ public final class TypeAnnotationParser {
             return res;
             } // unreachable break;
         case CLASS_EXTENDS: {
-            short index = buf.getShort();
+            short index = buf.getShort(); //needs to be signed
             if (index == -1) {
                 return new TypeAnnotationTargetInfo(TypeAnnotationTarget.CLASS_EXTENDS);
             } else if (index >= 0) {
@@ -437,7 +442,7 @@ public final class TypeAnnotationParser {
         case METHOD_RECEIVER:
             return new TypeAnnotationTargetInfo(TypeAnnotationTarget.METHOD_RECEIVER);
         case METHOD_FORMAL_PARAMETER: {
-            byte index = buf.get();
+            int index = buf.get() & 0xFF;
             return new TypeAnnotationTargetInfo(TypeAnnotationTarget.METHOD_FORMAL_PARAMETER,
                     index);
             } //unreachable break;
@@ -486,12 +491,12 @@ public final class TypeAnnotationParser {
     }
 
     private static TypeAnnotationTargetInfo parseShortTarget(TypeAnnotationTarget target, ByteBuffer buf) {
-        short index = buf.getShort();
+        int index = buf.getShort() & 0xFFFF;
         return new TypeAnnotationTargetInfo(target, index);
     }
     private static TypeAnnotationTargetInfo parse2ByteTarget(TypeAnnotationTarget target, ByteBuffer buf) {
-        byte count = buf.get();
-        byte secondaryIndex = buf.get();
+        int count = buf.get() & 0xFF;
+        int secondaryIndex = buf.get() & 0xFF;
         return new TypeAnnotationTargetInfo(target,
                                             count,
                                             secondaryIndex);