diff --git a/commons/auth-filters/authn-filter/jaspi-modules/iwa-module/src/main/java/org/forgerock/jaspi/modules/iwa/wdsso/DerValue.java b/commons/auth-filters/authn-filter/jaspi-modules/iwa-module/src/main/java/org/forgerock/jaspi/modules/iwa/wdsso/DerValue.java index 5a795973c..c866a396e 100644 --- a/commons/auth-filters/authn-filter/jaspi-modules/iwa-module/src/main/java/org/forgerock/jaspi/modules/iwa/wdsso/DerValue.java +++ b/commons/auth-filters/authn-filter/jaspi-modules/iwa-module/src/main/java/org/forgerock/jaspi/modules/iwa/wdsso/DerValue.java @@ -1,4 +1,4 @@ -//@Checkstyle:ignoreFor 29 +//@Checkstyle:ignoreFor 30 /* * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER. * @@ -26,12 +26,14 @@ * $Id: DerValue.java,v 1.2 2008/06/25 05:42:07 qcheng Exp $ * * Portions Copyrighted 2011-2016 ForgeRock AS. + * Portions Copyrighted 2026 3A Systems, LLC */ package org.forgerock.jaspi.modules.iwa.wdsso; import static java.lang.Integer.toHexString; import java.io.ByteArrayInputStream; +import java.util.Arrays; /** * A dedicated implementation of handling ASN1/DER for the @@ -88,7 +90,13 @@ private void init(ByteArrayInputStream input) { tag = (byte) input.read(); length = getLength(input); data = new byte[length]; - input.read(data, 0, length); + final int read = input.read(data, 0, length); + if (read > 0 && read < length) { + // Truncated DER value: keep only the bytes actually read so that + // callers do not treat uninitialised trailing bytes as content. + length = read; + data = Arrays.copyOf(data, read); + } } private int getLength(ByteArrayInputStream input) { diff --git a/commons/auth-filters/authn-filter/jaspi-modules/iwa-module/src/main/java/org/forgerock/jaspi/modules/iwa/wdsso/WDSSO.java b/commons/auth-filters/authn-filter/jaspi-modules/iwa-module/src/main/java/org/forgerock/jaspi/modules/iwa/wdsso/WDSSO.java index 13dd1e46e..ace5e9c08 100644 --- a/commons/auth-filters/authn-filter/jaspi-modules/iwa-module/src/main/java/org/forgerock/jaspi/modules/iwa/wdsso/WDSSO.java +++ b/commons/auth-filters/authn-filter/jaspi-modules/iwa-module/src/main/java/org/forgerock/jaspi/modules/iwa/wdsso/WDSSO.java @@ -1,4 +1,4 @@ -//@Checkstyle:ignoreFor 29 +//@Checkstyle:ignoreFor 30 /* * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER. * @@ -26,6 +26,7 @@ * $Id: WindowsDesktopSSO.java,v 1.7 2009/07/28 19:40:45 beomsuk Exp $ * * Portions Copyrighted 2011-2016 ForgeRock AS. + * Portions Copyrighted 2026 3A Systems, LLC */ package org.forgerock.jaspi.modules.iwa.wdsso; @@ -285,8 +286,8 @@ private byte[] parseToken(byte[] rawToken) { // check for SPNEGO OID byte[] oidArray = new byte[SPNEGO_OID.length]; - tmpInput.read(oidArray, 0, oidArray.length); - if (Arrays.equals(oidArray, SPNEGO_OID)) { + final int oidRead = tmpInput.read(oidArray, 0, oidArray.length); + if (oidRead == oidArray.length && Arrays.equals(oidArray, SPNEGO_OID)) { tmpToken = new DerValue(tmpInput); // 0xa0 indicates an init token(NegTokenInit); 0xa1 indicates an @@ -323,8 +324,8 @@ private byte[] parseToken(byte[] rawToken) { for (; i < oidArray.length; i++) { krb5Oid[i] = oidArray[i]; } - tmpInput.read(krb5Oid, i, krb5Oid.length - i); - if (!Arrays.equals(krb5Oid, KERBEROS_V5_OID)) { + final int krb5Read = tmpInput.read(krb5Oid, i, krb5Oid.length - i); + if (krb5Read != krb5Oid.length - i || !Arrays.equals(krb5Oid, KERBEROS_V5_OID)) { LOG.debug("IWA WDSSO: Kerberos V5 OID not found in the Auth Token"); token = null; } else { diff --git a/persistit/core/src/main/java/com/persistit/BackupTask.java b/persistit/core/src/main/java/com/persistit/BackupTask.java index 2c6e7ad3b..90e307d31 100644 --- a/persistit/core/src/main/java/com/persistit/BackupTask.java +++ b/persistit/core/src/main/java/com/persistit/BackupTask.java @@ -12,6 +12,7 @@ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. + * Portions Copyrighted 2026 3A Systems, LLC */ package com.persistit; @@ -260,8 +261,10 @@ private void rename(final File file) throws Exception { final String candidate = k == 0 ? file.getAbsolutePath() + "~" : file.getAbsoluteFile() + "~" + k; final File newFile = new File(candidate); if (!newFile.exists()) { - file.renameTo(newFile); - return; + if (file.renameTo(newFile)) { + return; + } + throw new IOException("Unable to rename file " + file + " to " + newFile); } } throw new IOException("Unable to rename file " + file); diff --git a/persistit/core/src/main/java/com/persistit/IOMeter.java b/persistit/core/src/main/java/com/persistit/IOMeter.java index 6773ab7fd..bbed00672 100644 --- a/persistit/core/src/main/java/com/persistit/IOMeter.java +++ b/persistit/core/src/main/java/com/persistit/IOMeter.java @@ -452,7 +452,14 @@ public static void main(final String[] args) throws Exception { } else { final IOMeter ioMeter = new IOMeter(); final DataInputStream is = new DataInputStream(new BufferedInputStream(new FileInputStream(fileName))); - is.skip(skip * DUMP_RECORD_LENGTH); + long toSkip = skip * DUMP_RECORD_LENGTH; + while (toSkip > 0) { + final long skipped = is.skip(toSkip); + if (skipped <= 0) { + break; + } + toSkip -= skipped; + } ioMeter.dump(is, count == 0 ? Integer.MAX_VALUE : count, ap.isFlag('a')); is.close(); } diff --git a/persistit/core/src/main/java/com/persistit/StreamLoader.java b/persistit/core/src/main/java/com/persistit/StreamLoader.java index f21f63da1..a59116eeb 100644 --- a/persistit/core/src/main/java/com/persistit/StreamLoader.java +++ b/persistit/core/src/main/java/com/persistit/StreamLoader.java @@ -12,6 +12,7 @@ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. + * Portions Copyrighted 2026 3A Systems, LLC */ package com.persistit; @@ -136,9 +137,9 @@ public boolean next(final ImportHandler handler) throws IOException, PersistitEx final int elisionCount = _dis.readShort(); final int valueSize = _dis.readInt(); _value.ensureFit(valueSize); - _dis.read(_key.getEncodedBytes(), elisionCount, keySize - elisionCount); + _dis.readFully(_key.getEncodedBytes(), elisionCount, keySize - elisionCount); _key.setEncodedSize(keySize); - _dis.read(_value.getEncodedBytes(), 0, valueSize); + _dis.readFully(_value.getEncodedBytes(), 0, valueSize); _value.setEncodedSize(valueSize); handler.handleDataRecord(_key, _value); _dataRecordCount++; diff --git a/persistit/core/src/main/java/com/persistit/Value.java b/persistit/core/src/main/java/com/persistit/Value.java index 7e7cdb172..91fbeb8ee 100644 --- a/persistit/core/src/main/java/com/persistit/Value.java +++ b/persistit/core/src/main/java/com/persistit/Value.java @@ -31,6 +31,7 @@ import com.persistit.util.Debug; import com.persistit.util.Util; +import java.io.EOFException; import java.io.IOException; import java.io.InputStream; import java.io.NotActiveException; @@ -4891,12 +4892,16 @@ public String readUTF() { @Override public void readFully(final byte[] b) throws IOException { - read(b, 0, b.length); + readFully(b, 0, b.length); } @Override public void readFully(final byte[] b, final int offset, final int length) throws IOException { - read(b, offset, length); + // read() here either transfers exactly length bytes or throws, so a + // short count means the end of the value was reached prematurely. + if (read(b, offset, length) != length) { + throw new EOFException(); + } } @Override