Version in base suite: 11.0.20+8-1~deb11u1 Base version: openjdk-11_11.0.20+8-1~deb11u1 Target version: openjdk-11_11.0.21+9-1~deb11u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/o/openjdk-11/openjdk-11_11.0.20+8-1~deb11u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/o/openjdk-11/openjdk-11_11.0.21+9-1~deb11u1.dsc /srv/release.debian.org/tmp/uG9itUZD5c/openjdk-11-11.0.21+9/test/jdk/java/security/KeyRep/RSA.pre.1.5.key |binary /srv/release.debian.org/tmp/uG9itUZD5c/openjdk-11-11.0.21+9/test/jdk/javax/swing/JTable/4170447/swing.small.gif |binary openjdk-11-11.0.21+9/.jcheck/conf | 2 openjdk-11-11.0.21+9/debian/changelog | 42 openjdk-11-11.0.21+9/debian/copyright | 2 openjdk-11-11.0.21+9/debian/patches/exclude-broken-tests.patch | 121 openjdk-11-11.0.21+9/debian/patches/nss-limited-ecc-tests.patch | 48 openjdk-11-11.0.21+9/debian/patches/reproducible-properties-timestamp.diff | 23 openjdk-11-11.0.21+9/debian/patches/series | 2 openjdk-11-11.0.21+9/debian/rules | 10 openjdk-11-11.0.21+9/debian/tests/hotspot | 9 openjdk-11-11.0.21+9/debian/tests/jaxp | 6 openjdk-11-11.0.21+9/debian/tests/jdk | 10 openjdk-11-11.0.21+9/debian/tests/jtreg-autopkgtest.in | 5 openjdk-11-11.0.21+9/debian/tests/jtreg-autopkgtest.sh | 3 openjdk-11-11.0.21+9/debian/tests/langtools | 8 openjdk-11-11.0.21+9/debian/tests/problems-armhf.txt | 17 openjdk-11-11.0.21+9/debian/tests/problems-hotspot.txt | 21 openjdk-11-11.0.21+9/debian/tests/problems-i386.txt | 3 openjdk-11-11.0.21+9/debian/tests/problems-jdk.txt | 45 openjdk-11-11.0.21+9/debian/tests/problems-langtools.txt | 24 openjdk-11-11.0.21+9/debian/tests/problems-s390x.txt | 3 openjdk-11-11.0.21+9/debian/tests/write-problems | 25 openjdk-11-11.0.21+9/make/autoconf/hotspot.m4 | 9 openjdk-11-11.0.21+9/make/autoconf/version-numbers | 4 openjdk-11-11.0.21+9/make/data/cacerts/certignarootca | 43 openjdk-11-11.0.21+9/make/data/cacerts/secomscrootca1 | 27 openjdk-11-11.0.21+9/make/data/publicsuffixlist/VERSION | 4 openjdk-11-11.0.21+9/make/data/publicsuffixlist/public_suffix_list.dat | 1596 +- openjdk-11-11.0.21+9/make/lib/Awt2dLibraries.gmk | 7 openjdk-11-11.0.21+9/src/hotspot/cpu/aarch64/aarch64.ad | 170 openjdk-11-11.0.21+9/src/hotspot/cpu/aarch64/frame_aarch64.cpp | 2 openjdk-11-11.0.21+9/src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp | 32 openjdk-11-11.0.21+9/src/hotspot/cpu/aarch64/macroAssembler_aarch64.hpp | 4 openjdk-11-11.0.21+9/src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp | 4 openjdk-11-11.0.21+9/src/hotspot/cpu/arm/frame_arm.cpp | 2 openjdk-11-11.0.21+9/src/hotspot/cpu/ppc/frame_ppc.cpp | 2 openjdk-11-11.0.21+9/src/hotspot/cpu/x86/frame_x86.cpp | 2 openjdk-11-11.0.21+9/src/hotspot/os/linux/os_linux.cpp | 162 openjdk-11-11.0.21+9/src/hotspot/os/linux/os_linux.hpp | 2 openjdk-11-11.0.21+9/src/hotspot/os/posix/os_posix.cpp | 4 openjdk-11-11.0.21+9/src/hotspot/share/c1/c1_LinearScan.cpp | 8 openjdk-11-11.0.21+9/src/hotspot/share/classfile/altHashing.cpp | 6 openjdk-11-11.0.21+9/src/hotspot/share/classfile/dictionary.cpp | 1 openjdk-11-11.0.21+9/src/hotspot/share/classfile/dictionary.hpp | 2 openjdk-11-11.0.21+9/src/hotspot/share/classfile/loaderConstraints.cpp | 14 openjdk-11-11.0.21+9/src/hotspot/share/classfile/loaderConstraints.hpp | 1 openjdk-11-11.0.21+9/src/hotspot/share/gc/cms/concurrentMarkSweepGeneration.cpp | 3 openjdk-11-11.0.21+9/src/hotspot/share/gc/shared/stringdedup/stringDedupTable.cpp | 2 openjdk-11-11.0.21+9/src/hotspot/share/interpreter/interpreterRuntime.cpp | 35 openjdk-11-11.0.21+9/src/hotspot/share/memory/metaspace.cpp | 1 openjdk-11-11.0.21+9/src/hotspot/share/memory/metaspaceShared.cpp | 6 openjdk-11-11.0.21+9/src/hotspot/share/oops/klass.cpp | 4 openjdk-11-11.0.21+9/src/hotspot/share/oops/klass.hpp | 5 openjdk-11-11.0.21+9/src/hotspot/share/oops/method.hpp | 9 openjdk-11-11.0.21+9/src/hotspot/share/oops/oopHandle.hpp | 6 openjdk-11-11.0.21+9/src/hotspot/share/opto/library_call.cpp | 203 openjdk-11-11.0.21+9/src/hotspot/share/opto/loopTransform.cpp | 7 openjdk-11-11.0.21+9/src/hotspot/share/opto/loopopts.cpp | 4 openjdk-11-11.0.21+9/src/hotspot/share/opto/parse1.cpp | 6 openjdk-11-11.0.21+9/src/hotspot/share/opto/phaseX.cpp | 13 openjdk-11-11.0.21+9/src/hotspot/share/prims/jvmtiThreadState.hpp | 6 openjdk-11-11.0.21+9/src/hotspot/share/prims/whitebox.cpp | 25 openjdk-11-11.0.21+9/src/hotspot/share/runtime/frame.cpp | 9 openjdk-11-11.0.21+9/src/hotspot/share/runtime/frame.hpp | 2 openjdk-11-11.0.21+9/src/hotspot/share/runtime/globals.hpp | 4 openjdk-11-11.0.21+9/src/java.base/macosx/classes/apple/security/KeychainStore.java | 17 openjdk-11-11.0.21+9/src/java.base/macosx/native/libjava/ProcessHandleImpl_macosx.c | 4 openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/DESKey.java | 27 openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/DESedeKey.java | 29 openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/DHPrivateKey.java | 37 openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/DHPublicKey.java | 39 openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/KeyProtector.java | 18 openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/OAEPParameters.java | 22 openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/PBEKey.java | 39 openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/PBES2Parameters.java | 95 openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/PBKDF2KeyImpl.java | 42 openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java | 507 openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/TlsMasterSecretGenerator.java | 26 openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/java/util/jar/pack/NativeUnpack.java | 2 openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/java/util/jar/pack/UnpackerImpl.java | 5 openjdk-11-11.0.21+9/src/java.base/share/classes/java/net/URI.java | 38 openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/AlgorithmParameterGenerator.java | 6 openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/CodeSigner.java | 15 openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/KeyPairGenerator.java | 6 openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/PKCS12Attribute.java | 2 openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/Security.java | 152 openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/cert/CertPathHelperImpl.java | 11 openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/cert/CertificateFactory.java | 12 openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/cert/CertificateRevokedException.java | 4 openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/cert/X509CertSelector.java | 30 openjdk-11-11.0.21+9/src/java.base/share/classes/java/util/concurrent/CompletableFuture.java | 94 openjdk-11-11.0.21+9/src/java.base/share/classes/java/util/concurrent/ConcurrentHashMap.java | 20 openjdk-11-11.0.21+9/src/java.base/share/classes/java/util/zip/ZipFile.java | 53 openjdk-11-11.0.21+9/src/java.base/share/classes/javax/crypto/Cipher.java | 10 openjdk-11-11.0.21+9/src/java.base/share/classes/javax/crypto/KeyAgreement.java | 4 openjdk-11-11.0.21+9/src/java.base/share/classes/javax/crypto/KeyGenerator.java | 6 openjdk-11-11.0.21+9/src/java.base/share/classes/javax/crypto/spec/SecretKeySpec.java | 26 openjdk-11-11.0.21+9/src/java.base/share/classes/javax/net/ssl/SSLContextSpi.java | 3 openjdk-11-11.0.21+9/src/java.base/share/classes/javax/security/auth/callback/ChoiceCallback.java | 62 openjdk-11-11.0.21+9/src/java.base/share/classes/javax/security/auth/callback/ConfirmationCallback.java | 55 openjdk-11-11.0.21+9/src/java.base/share/classes/javax/security/auth/callback/PasswordCallback.java | 64 openjdk-11-11.0.21+9/src/java.base/share/classes/jdk/internal/event/X509CertificateEvent.java | 11 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/launcher/LauncherHelper.java | 5 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/net/www/http/KeepAliveCache.java | 149 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/net/www/protocol/http/AuthenticationInfo.java | 9 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/net/www/protocol/http/HttpURLConnection.java | 13 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/net/www/protocol/http/NegotiateAuthentication.java | 16 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/net/www/protocol/http/Negotiator.java | 2 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/net/www/protocol/https/HttpsClient.java | 8 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/jca/JCAUtil.java | 77 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/jca/Providers.java | 3 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/pkcs/ContentInfo.java | 70 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/pkcs/PKCS7.java | 26 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/pkcs/PKCS9Attribute.java | 4 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/pkcs12/PKCS12KeyStore.java | 90 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/DSAPublicKeyImpl.java | 26 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/KeyProtector.java | 12 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/PolicyFile.java | 30 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/SecureRandom.java | 54 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/SunEntries.java | 172 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/X509Factory.java | 46 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/CertPathHelper.java | 14 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/ForwardBuilder.java | 65 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/ForwardState.java | 50 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/OCSPResponse.java | 9 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/PKIXCertPathValidator.java | 8 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/RevocationChecker.java | 3 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/SunCertPathBuilder.java | 109 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/X509CertPath.java | 22 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/X509CertificatePair.java | 6 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/PSSParameters.java | 4 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/RSAKeyFactory.java | 66 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/RSAKeyPairGenerator.java | 15 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/RSAPrivateCrtKeyImpl.java | 184 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/RSAPrivateKeyImpl.java | 58 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/RSAPublicKeyImpl.java | 129 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/RSAUtil.java | 191 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java | 91 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/ssl/DHKeyExchange.java | 35 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/ssl/SSLConfiguration.java | 2 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/ssl/SunJSSE.java | 16 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/ssl/X509KeyManagerImpl.java | 16 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/timestamp/TSRequest.java | 4 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/tools/keytool/Main.java | 86 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/ConstraintsParameters.java | 2 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/CurveDB.java | 290 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/DisabledAlgorithmConstraints.java | 2 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/KnownOIDs.java | 5 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/NamedCurve.java | 40 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/ObjectIdentifier.java | 90 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/SecurityProviderConstants.java | 90 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/validator/EndEntityChecker.java | 28 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/validator/SimpleValidator.java | 23 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/AVA.java | 6 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/AccessDescription.java | 10 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/AlgorithmId.java | 599 - openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/ExtendedKeyUsageExtension.java | 44 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/GeneralSubtrees.java | 5 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/InhibitAnyPolicyExtension.java | 17 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/NetscapeCertTypeExtension.java | 15 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/OIDMap.java | 11 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/OIDName.java | 4 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/PKIXExtensions.java | 163 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/X500Name.java | 85 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/X509CRLEntryImpl.java | 7 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java | 4 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/X509CertImpl.java | 56 openjdk-11-11.0.21+9/src/java.base/share/classes/sun/text/bidi/BidiBase.java | 2 openjdk-11-11.0.21+9/src/java.base/share/conf/security/java.security | 3 openjdk-11-11.0.21+9/src/java.base/share/legal/public_suffix.md | 2 openjdk-11-11.0.21+9/src/java.base/windows/native/libnet/DefaultProxySelector.c | 2 openjdk-11-11.0.21+9/src/java.desktop/macosx/classes/sun/lwawt/macosx/CPrinterJob.java | 97 openjdk-11-11.0.21+9/src/java.desktop/macosx/native/libawt_lwawt/awt/CClipboard.m | 15 openjdk-11-11.0.21+9/src/java.desktop/macosx/native/libawt_lwawt/awt/CPrinterJob.m | 42 openjdk-11-11.0.21+9/src/java.desktop/macosx/native/libawt_lwawt/font/CCharToGlyphMapper.m | 12 openjdk-11-11.0.21+9/src/java.desktop/macosx/native/libosxui/JRSUIController.m | 12 openjdk-11-11.0.21+9/src/java.desktop/share/classes/com/sun/media/sound/DirectAudioDevice.java | 5 openjdk-11-11.0.21+9/src/java.desktop/share/classes/sun/awt/FontConfiguration.java | 9 openjdk-11-11.0.21+9/src/java.desktop/share/classes/sun/awt/image/ImageRepresentation.java | 22 openjdk-11-11.0.21+9/src/java.desktop/share/classes/sun/print/RasterPrinterJob.java | 2 openjdk-11-11.0.21+9/src/java.desktop/share/legal/freetype.md | 41 openjdk-11-11.0.21+9/src/java.desktop/share/legal/harfbuzz.md | 6 openjdk-11-11.0.21+9/src/java.desktop/share/legal/libpng.md | 5 openjdk-11-11.0.21+9/src/java.desktop/share/native/libawt/java2d/loops/FourByteAbgrPre.c | 10 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfontmanager/freetypeScaler.c | 5 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/ftconfig.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/ftheader.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/ftoption.h | 36 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/ftstdlib.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/integer-types.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/mac-support.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/public-macros.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/freetype.h | 232 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftadvanc.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftbbox.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftbdf.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftbitmap.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftcid.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftcolor.h | 155 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftdriver.h | 3 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/fterrdef.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/fterrors.h | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftfntfmt.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftgasp.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftglyph.h | 12 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftgzip.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftimage.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftincrem.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftlcdfil.h | 8 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftlist.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftlogging.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftmac.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftmm.h | 19 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftmodapi.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftmoderr.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftoutln.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftparams.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftrender.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftsizes.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftsnames.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftstroke.h | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftsynth.h | 13 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftsystem.h | 14 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/fttrigon.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/fttypes.h | 7 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/autohint.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/cffotypes.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/cfftypes.h | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/compiler-macros.h | 17 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftcalc.h | 46 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftdebug.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftdrv.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftgloadr.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftmemory.h | 14 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftmmtypes.h | 85 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftobjs.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftpsprop.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftrfork.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftserv.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftstream.h | 110 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/fttrace.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftvalid.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/psaux.h | 6 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/pshints.h | 6 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svbdf.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svcfftl.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svcid.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svfntfmt.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svgldict.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svgxval.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svkern.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svmetric.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svmm.h | 125 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svotval.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpfr.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpostnm.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svprop.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpscmap.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpsinfo.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svsfnt.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svttcmap.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svtteng.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svttglyf.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svwinfnt.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/sfnt.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/svginterface.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/t1types.h | 6 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/tttypes.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/wofftypes.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/otsvg.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/t1tables.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ttnameid.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/tttables.h | 6 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/tttags.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/ft2build.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afblue.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afblue.cin | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afblue.dat | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afblue.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afblue.hin | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afcjk.c | 26 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afcjk.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afcover.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afdummy.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afdummy.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/aferrors.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afglobal.c | 47 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afglobal.h | 6 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afhints.c | 44 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afhints.h | 21 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afindic.c | 5 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afindic.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/aflatin.c | 87 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/aflatin.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afloader.c | 5 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afloader.h | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afmodule.c | 42 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afmodule.h | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afranges.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afranges.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afscript.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afshaper.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afshaper.h | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afstyles.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/aftypes.h | 24 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afws-decl.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afws-iter.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftadvanc.c | 8 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftbase.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftbbox.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftbitmap.c | 92 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftcalc.c | 69 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftcid.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftcolor.c | 156 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftdbgmem.c | 50 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftdebug.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftfntfmt.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftfstype.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftgasp.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftgloadr.c | 32 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftglyph.c | 5 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftinit.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftlcdfil.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftmac.c | 3 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftmm.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftobjs.c | 223 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftoutln.c | 44 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftpatent.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftpsprop.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftrfork.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftsnames.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftstream.c | 40 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftstroke.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftsynth.c | 22 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftsystem.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/fttrigon.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/fttype1.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftutil.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cff/cffcmap.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cff/cffcmap.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cff/cffdrivr.c | 142 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cff/cffdrivr.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cff/cfferrs.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cff/cffgload.c | 42 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cff/cffgload.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cff/cffload.c | 8 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cff/cffload.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cff/cffobjs.c | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cff/cffobjs.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cff/cffparse.c | 16 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cff/cffparse.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cff/cfftoken.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cid/ciderrs.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cid/cidgload.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cid/cidgload.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cid/cidload.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cid/cidload.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cid/cidobjs.c | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cid/cidobjs.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cid/cidparse.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cid/cidparse.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cid/cidriver.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cid/cidriver.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/cid/cidtoken.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/afmparse.c | 6 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/afmparse.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/cffdecode.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/cffdecode.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/psauxerr.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/psauxmod.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/psauxmod.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/psconv.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/psconv.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/psfixed.h | 6 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/psft.c | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/psglue.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/pshints.c | 12 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/psobjs.c | 5 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/psobjs.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/psstack.h | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/t1cmap.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/t1cmap.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/t1decode.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psaux/t1decode.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/pshinter/pshalgo.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/pshinter/pshalgo.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/pshinter/pshglob.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/pshinter/pshglob.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/pshinter/pshmod.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/pshinter/pshmod.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/pshinter/pshnterr.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/pshinter/pshrec.c | 6 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/pshinter/pshrec.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psnames/psmodule.c | 33 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psnames/psmodule.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psnames/psnamerr.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/psnames/pstables.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/raster/ftmisc.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/raster/ftraster.c | 18 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/raster/ftraster.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/raster/ftrend1.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/raster/ftrend1.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/raster/rasterrs.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/pngshim.c | 7 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/pngshim.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/sfdriver.c | 36 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/sfdriver.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/sferrors.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/sfobjs.c | 10 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/sfobjs.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/sfwoff.c | 13 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/sfwoff.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/sfwoff2.c | 67 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/sfwoff2.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/ttcmap.c | 5 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/ttcmap.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/ttcmapc.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/ttcolr.c | 731 + openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/ttcolr.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/ttcpal.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/ttcpal.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/ttkern.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/ttkern.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/ttload.c | 28 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/ttload.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/ttmtx.c | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/ttmtx.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/ttpost.c | 6 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/ttpost.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/ttsbit.c | 45 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/ttsbit.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/woff2tags.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/sfnt/woff2tags.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/smooth/ftgrays.c | 38 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/smooth/ftgrays.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/smooth/ftsmerrs.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/smooth/ftsmooth.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/smooth/ftsmooth.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/truetype/ttdriver.c | 43 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/truetype/ttdriver.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/truetype/tterrors.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/truetype/ttgload.c | 234 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/truetype/ttgload.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/truetype/ttgxvar.c | 784 - openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/truetype/ttgxvar.h | 102 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/truetype/ttinterp.c | 32 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/truetype/ttinterp.h | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/truetype/ttobjs.c | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/truetype/ttobjs.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/truetype/ttpload.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/truetype/ttpload.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/truetype/ttsubpix.c | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/truetype/ttsubpix.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/type1/t1afm.c | 23 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/type1/t1afm.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/type1/t1driver.c | 39 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/type1/t1driver.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/type1/t1errors.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/type1/t1gload.c | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/type1/t1gload.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/type1/t1load.c | 6 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/type1/t1load.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/type1/t1objs.c | 6 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/type1/t1objs.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/type1/t1parse.c | 57 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/type1/t1parse.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/type1/t1tokens.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/OT/Color/COLR/COLR.hh | 387 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/OT/Color/CPAL/CPAL.hh | 40 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/OT/Layout/GPOS/MarkLigPosFormat1.hh | 14 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/OT/Layout/GPOS/PairPosFormat1.hh | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/OT/Layout/GPOS/SinglePosFormat1.hh | 8 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/OT/Layout/GSUB/Ligature.hh | 3 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/OT/Layout/GSUB/LigatureSet.hh | 12 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/OT/Layout/GSUB/LigatureSubstFormat1.hh | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/OT/Layout/GSUB/SingleSubstFormat1.hh | 38 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/OT/Layout/GSUB/SingleSubstFormat2.hh | 25 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/OT/glyf/CompositeGlyph.hh | 88 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/OT/glyf/Glyph.hh | 105 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/OT/glyf/SimpleGlyph.hh | 6 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/OT/glyf/SubsetGlyph.hh | 77 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/OT/glyf/VarCompositeGlyph.hh | 39 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/OT/glyf/glyf.hh | 48 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/OT/glyf/path-builder.hh | 39 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/UPDATING.txt | 1 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-aat-layout-common.hh | 6 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-algs.hh | 89 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-bimap.hh | 9 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-bit-set.hh | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-blob.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-buffer.cc | 5 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-cache.hh | 14 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-common.cc | 1 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-config.hh | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-debug.hh | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-deprecated.h | 11 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-face.cc | 8 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-face.hh | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-font.cc | 82 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-font.h | 5 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ft.cc | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-map.cc | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-map.hh | 16 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ot-cmap-table.hh | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ot-face-table-list.hh | 1 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ot-font.cc | 18 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ot-hdmx-table.hh | 10 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ot-head-table.hh | 20 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ot-hmtx-table.hh | 19 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ot-layout-common.hh | 68 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ot-layout-gsubgpos.hh | 15 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ot-layout.cc | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ot-maxp-table.hh | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ot-name.cc | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ot-post-table.hh | 8 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ot-shaper-indic.cc | 5 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ot-stat-table.hh | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ot-var-common.hh | 362 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ot-var-cvar-table.hh | 158 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ot-var-gvar-table.hh | 467 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-ot-var-hvar-table.hh | 13 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-outline.cc | 5 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-outline.hh | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-paint.h | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-paint.hh | 8 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-pool.hh | 11 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-priority-queue.hh | 6 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-sanitize.hh | 12 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-shape.cc | 246 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-shape.h | 12 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-shaper-list.hh | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-static.cc | 24 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-style.cc | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-subset-input.cc | 1 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-subset-plan.cc | 192 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-subset-plan.hh | 2 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-subset.cc | 16 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-subset.h | 3 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-unicode.h | 4 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb-version.h | 6 openjdk-11-11.0.21+9/src/java.desktop/share/native/libharfbuzz/hb.hh | 16 openjdk-11-11.0.21+9/src/java.desktop/unix/native/libawt_xawt/awt/swing_GTKEngine.c | 5 openjdk-11-11.0.21+9/src/java.desktop/windows/classes/sun/awt/windows/WClipboard.java | 8 openjdk-11-11.0.21+9/src/java.desktop/windows/classes/sun/awt/windows/WScrollPanePeer.java | 11 openjdk-11-11.0.21+9/src/java.desktop/windows/native/libawt/java2d/d3d/D3DBadHardware.h | 3 openjdk-11-11.0.21+9/src/java.desktop/windows/native/libawt/windows/ThemeReader.cpp | 9 openjdk-11-11.0.21+9/src/java.desktop/windows/native/libawt/windows/awt_DataTransferer.cpp | 4 openjdk-11-11.0.21+9/src/java.desktop/windows/native/libawt/windows/awt_ScrollPane.cpp | 11 openjdk-11-11.0.21+9/src/java.desktop/windows/native/libawt/windows/awt_Toolkit.cpp | 6 openjdk-11-11.0.21+9/src/java.naming/share/classes/sun/security/provider/certpath/ldap/LDAPCertStoreImpl.java | 118 openjdk-11-11.0.21+9/src/java.net.http/share/classes/jdk/internal/net/http/AuthenticationFilter.java | 29 openjdk-11-11.0.21+9/src/java.security.jgss/share/classes/org/ietf/jgss/Oid.java | 4 openjdk-11-11.0.21+9/src/java.security.jgss/share/classes/sun/net/www/protocol/http/spnego/NegotiatorImpl.java | 30 openjdk-11-11.0.21+9/src/java.security.jgss/share/classes/sun/security/jgss/GSSContextImpl.java | 4 openjdk-11-11.0.21+9/src/java.security.jgss/share/classes/sun/security/jgss/GSSNameImpl.java | 4 openjdk-11-11.0.21+9/src/java.security.jgss/share/classes/sun/security/jgss/krb5/Krb5Token.java | 4 openjdk-11-11.0.21+9/src/java.security.jgss/share/classes/sun/security/jgss/spnego/SpNegoToken.java | 4 openjdk-11-11.0.21+9/src/java.security.jgss/share/classes/sun/security/jgss/wrapper/GSSNameElement.java | 4 openjdk-11-11.0.21+9/src/java.security.jgss/share/classes/sun/security/jgss/wrapper/NativeGSSContext.java | 4 openjdk-11-11.0.21+9/src/java.security.jgss/share/classes/sun/security/krb5/KdcComm.java | 9 openjdk-11-11.0.21+9/src/java.security.jgss/share/classes/sun/security/krb5/internal/Krb5.java | 1 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/Const.java | 5618 +++++----- openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/ExceptionConst.java | 72 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/Repository.java | 230 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/AccessFlags.java | 185 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/AnnotationDefault.java | 61 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/AnnotationElementValue.java | 58 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/AnnotationEntry.java | 118 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/Annotations.java | 108 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ArrayElementValue.java | 64 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/Attribute.java | 366 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/AttributeReader.java | 50 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/BootstrapMethod.java | 99 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/BootstrapMethods.java | 90 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ClassElementValue.java | 36 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ClassFormatException.java | 40 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ClassParser.java | 180 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/Code.java | 320 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/CodeException.java | 167 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/Constant.java | 149 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantCP.java | 80 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantClass.java | 58 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantDouble.java | 56 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantDynamic.java | 30 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantFieldref.java | 23 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantFloat.java | 60 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantInteger.java | 56 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantInterfaceMethodref.java | 23 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantInvokeDynamic.java | 34 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantLong.java | 56 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantMethodHandle.java | 53 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantMethodType.java | 36 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantMethodref.java | 23 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantModule.java | 66 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantNameAndType.java | 59 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantObject.java | 10 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantPackage.java | 66 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantPool.java | 489 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantString.java | 59 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantUtf8.java | 82 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ConstantValue.java | 120 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/Deprecated.java | 82 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/DescendingVisitor.java | 530 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ElementValue.java | 198 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ElementValuePair.java | 47 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/EmptyVisitor.java | 249 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/EnclosingMethod.java | 60 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/EnumElementValue.java | 46 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ExceptionTable.java | 136 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/Field.java | 169 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/FieldOrMethod.java | 273 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/InnerClass.java | 118 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/InnerClasses.java | 127 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/JavaClass.java | 936 - openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/LineNumber.java | 86 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/LineNumberTable.java | 199 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/LocalVariable.java | 230 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/LocalVariableTable.java | 146 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/LocalVariableTypeTable.java | 87 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/Method.java | 254 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/MethodParameter.java | 87 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/MethodParameters.java | 63 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/Module.java | 178 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ModuleExports.java | 60 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ModuleMainClass.java | 87 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ModuleOpens.java | 60 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ModulePackages.java | 133 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ModuleProvides.java | 60 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ModuleRequires.java | 56 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/NestHost.java | 84 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/NestMembers.java | 141 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/Node.java | 3 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/PMGClass.java | 107 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ParameterAnnotationEntry.java | 59 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/ParameterAnnotations.java | 81 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/RuntimeInvisibleAnnotations.java | 32 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/RuntimeInvisibleParameterAnnotations.java | 14 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/RuntimeVisibleAnnotations.java | 31 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/RuntimeVisibleParameterAnnotations.java | 14 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/Signature.java | 307 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/SimpleElementValue.java | 202 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/SourceFile.java | 109 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/StackMap.java | 158 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/StackMapEntry.java | 460 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/StackMapType.java | 146 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/Synthetic.java | 98 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/Unknown.java | 122 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/UnknownAttributeReader.java | 29 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/Utility.java | 2253 +--- openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/classfile/Visitor.java | 171 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/AALOAD.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/AASTORE.java | 18 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ACONST_NULL.java | 29 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ALOAD.java | 27 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ANEWARRAY.java | 37 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ARETURN.java | 15 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ARRAYLENGTH.java | 43 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ASTORE.java | 27 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ATHROW.java | 36 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/AllocationInstruction.java | 1 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/AnnotationElementValueGen.java | 47 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/AnnotationEntryGen.java | 341 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ArithmeticInstruction.java | 102 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ArrayElementValueGen.java | 89 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ArrayInstruction.java | 71 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ArrayType.java | 93 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/BALOAD.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/BASTORE.java | 18 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/BIPUSH.java | 70 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/BREAKPOINT.java | 10 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/BasicType.java | 74 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/BranchHandle.java | 90 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/BranchInstruction.java | 298 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/CALOAD.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/CASTORE.java | 18 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/CHECKCAST.java | 60 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/CPInstruction.java | 97 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ClassElementValueGen.java | 73 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ClassGen.java | 689 - openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ClassGenException.java | 6 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ClassObserver.java | 7 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/CodeExceptionGen.java | 187 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/CompoundInstruction.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ConstantPoolGen.java | 909 - openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ConstantPushInstruction.java | 5 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ConversionInstruction.java | 66 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/D2F.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/D2I.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/D2L.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DADD.java | 19 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DALOAD.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DASTORE.java | 18 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DCMPG.java | 27 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DCMPL.java | 27 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DCONST.java | 49 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DDIV.java | 21 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DLOAD.java | 21 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DMUL.java | 19 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DNEG.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DREM.java | 19 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DRETURN.java | 18 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DSTORE.java | 21 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DSUB.java | 19 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DUP.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DUP2.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DUP2_X1.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DUP2_X2.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DUP_X1.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/DUP_X2.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ElementValueGen.java | 164 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ElementValuePairGen.java | 60 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/EmptyVisitor.java | 548 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/EnumElementValueGen.java | 110 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ExceptionThrower.java | 23 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/F2D.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/F2I.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/F2L.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FADD.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FALOAD.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FASTORE.java | 18 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FCMPG.java | 29 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FCMPL.java | 29 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FCONST.java | 49 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FDIV.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FLOAD.java | 21 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FMUL.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FNEG.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FREM.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FRETURN.java | 18 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FSTORE.java | 21 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FSUB.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FieldGen.java | 383 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FieldGenOrMethodGen.java | 158 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FieldInstruction.java | 47 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FieldObserver.java | 7 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/FieldOrMethod.java | 106 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/GETFIELD.java | 51 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/GETSTATIC.java | 46 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/GOTO.java | 61 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/GOTO_W.java | 41 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/GotoInstruction.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/I2B.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/I2C.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/I2D.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/I2F.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/I2L.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/I2S.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IADD.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IALOAD.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IAND.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IASTORE.java | 15 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ICONST.java | 53 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IDIV.java | 34 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IFEQ.java | 35 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IFGE.java | 35 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IFGT.java | 35 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IFLE.java | 35 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IFLT.java | 35 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IFNE.java | 35 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IFNONNULL.java | 35 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IFNULL.java | 35 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IF_ACMPEQ.java | 35 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IF_ACMPNE.java | 35 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IF_ICMPEQ.java | 35 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IF_ICMPGE.java | 35 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IF_ICMPGT.java | 35 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IF_ICMPLE.java | 35 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IF_ICMPLT.java | 35 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IF_ICMPNE.java | 35 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IINC.java | 120 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ILOAD.java | 21 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IMPDEP1.java | 10 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IMPDEP2.java | 10 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IMUL.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/INEG.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/INSTANCEOF.java | 50 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/INVOKEDYNAMIC.java | 118 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/INVOKEINTERFACE.java | 93 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/INVOKESPECIAL.java | 63 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/INVOKESTATIC.java | 57 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/INVOKEVIRTUAL.java | 59 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IOR.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IREM.java | 34 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IRETURN.java | 18 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ISHL.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ISHR.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ISTORE.java | 21 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ISUB.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IUSHR.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IXOR.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IfInstruction.java | 6 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/IndexedInstruction.java | 7 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/Instruction.java | 921 - openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/InstructionComparator.java | 36 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/InstructionConst.java | 49 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/InstructionFactory.java | 1152 -- openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/InstructionHandle.java | 322 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/InstructionList.java | 1479 +- openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/InstructionListObserver.java | 7 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/InstructionTargeter.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/InvokeInstruction.java | 119 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/JSR.java | 49 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/JSR_W.java | 41 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/JsrInstruction.java | 37 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/L2D.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/L2F.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/L2I.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LADD.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LALOAD.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LAND.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LASTORE.java | 18 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LCMP.java | 29 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LCONST.java | 49 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LDC.java | 152 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LDC2_W.java | 68 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LDC_W.java | 12 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LDIV.java | 29 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LLOAD.java | 17 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LMUL.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LNEG.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LOOKUPSWITCH.java | 77 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LOR.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LREM.java | 26 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LRETURN.java | 15 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LSHL.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LSHR.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LSTORE.java | 17 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LSUB.java | 16 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LUSHR.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LXOR.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LineNumberGen.java | 80 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LoadClass.java | 33 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LoadInstruction.java | 29 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LocalVariableGen.java | 245 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/LocalVariableInstruction.java | 185 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/MONITORENTER.java | 26 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/MONITOREXIT.java | 26 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/MULTIANEWARRAY.java | 117 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/MethodGen.java | 1553 +- openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/MethodObserver.java | 7 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/NEW.java | 45 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/NEWARRAY.java | 82 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/NOP.java | 10 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/NameSignatureInstruction.java | 27 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/NamedAndTyped.java | 11 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ObjectType.java | 130 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/POP.java | 14 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/POP2.java | 14 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/PUSH.java | 145 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/PUTFIELD.java | 48 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/PUTSTATIC.java | 46 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/PopInstruction.java | 3 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/PushInstruction.java | 6 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/RET.java | 90 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/RETURN.java | 15 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ReferenceType.java | 386 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ReturnInstruction.java | 61 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/ReturnaddressType.java | 28 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/SALOAD.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/SASTORE.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/SIPUSH.java | 67 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/SWAP.java | 13 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/SWITCH.java | 144 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/Select.java | 363 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/SimpleElementValueGen.java | 172 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/StackConsumer.java | 6 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/StackInstruction.java | 11 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/StackProducer.java | 9 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/StoreInstruction.java | 29 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/TABLESWITCH.java | 77 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/TargetLostException.java | 20 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/Type.java | 518 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/TypedInstruction.java | 6 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/UnconditionalBranch.java | 1 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/VariableLengthInstruction.java | 5 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/generic/Visitor.java | 549 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/util/Args.java | 148 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/util/AttributeHTML.java | 273 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/util/BCELComparator.java | 5 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/util/BCELFactory.java | 379 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/util/BCELifier.java | 412 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/util/ByteSequence.java | 39 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/util/Class2HTML.java | 245 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/util/ClassQueue.java | 20 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/util/ClassSet.java | 41 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/util/ClassStack.java | 14 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/util/CodeHTML.java | 791 - openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/util/ConstantHTML.java | 305 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/util/InstructionFinder.java | 489 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/util/MethodHTML.java | 116 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/util/ModularRuntimeImage.java | 46 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/util/Repository.java | 37 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/bcel/internal/util/SyntheticRepository.java | 132 openjdk-11-11.0.21+9/src/java.xml/share/classes/com/sun/org/apache/xml/internal/serializer/ToHTMLStream.java | 41 openjdk-11-11.0.21+9/src/java.xml/share/classes/jdk/xml/internal/Utils.java | 57 openjdk-11-11.0.21+9/src/java.xml/share/legal/bcel.md | 4 openjdk-11-11.0.21+9/src/jdk.compiler/share/classes/com/sun/tools/javac/resources/javac.properties | 2 openjdk-11-11.0.21+9/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java | 10 openjdk-11-11.0.21+9/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11RSAKeyFactory.java | 31 openjdk-11-11.0.21+9/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java | 212 openjdk-11-11.0.21+9/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java | 21 openjdk-11-11.0.21+9/src/jdk.crypto.ec/share/classes/sun/security/ec/ECPrivateKeyImpl.java | 19 openjdk-11-11.0.21+9/src/jdk.crypto.ec/share/classes/sun/security/ec/ECPublicKeyImpl.java | 21 openjdk-11-11.0.21+9/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java | 70 openjdk-11-11.0.21+9/src/jdk.crypto.ec/share/classes/sun/security/ec/XDHPrivateKeyImpl.java | 19 openjdk-11-11.0.21+9/src/jdk.crypto.ec/share/classes/sun/security/ec/XDHPublicKeyImpl.java | 22 openjdk-11-11.0.21+9/src/jdk.crypto.ec/share/classes/sun/security/ec/XECParameters.java | 14 openjdk-11-11.0.21+9/src/jdk.crypto.mscapi/windows/classes/sun/security/mscapi/CPrivateKey.java | 23 openjdk-11-11.0.21+9/src/jdk.crypto.mscapi/windows/classes/sun/security/mscapi/CPublicKey.java | 24 openjdk-11-11.0.21+9/src/jdk.crypto.mscapi/windows/classes/sun/security/mscapi/SunMSCAPI.java | 83 openjdk-11-11.0.21+9/src/jdk.crypto.ucrypto/solaris/classes/com/oracle/security/ucrypto/LibMDMech.java | 22 openjdk-11-11.0.21+9/src/jdk.crypto.ucrypto/solaris/classes/com/oracle/security/ucrypto/ServiceDesc.java | 10 openjdk-11-11.0.21+9/src/jdk.crypto.ucrypto/solaris/classes/com/oracle/security/ucrypto/UcryptoMech.java | 132 openjdk-11-11.0.21+9/src/jdk.crypto.ucrypto/solaris/classes/com/oracle/security/ucrypto/UcryptoProvider.java | 8 openjdk-11-11.0.21+9/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/memory/FileMapInfo.java | 3 openjdk-11-11.0.21+9/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/runtime/VM.java | 70 openjdk-11-11.0.21+9/src/jdk.hotspot.agent/share/classes/sun/jvm/hotspot/tools/HeapSummary.java | 4 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/reader/Binding.java | 2 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/reader/Candidate.java | 51 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/reader/CompletingParsedLine.java | 2 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/reader/CompletionMatcher.java | 2 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/reader/Highlighter.java | 27 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/reader/History.java | 7 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/reader/LineReader.java | 7 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/reader/LineReaderBuilder.java | 6 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/reader/Parser.java | 10 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/reader/impl/CompletionMatcherImpl.java | 2 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/reader/impl/DefaultParser.java | 146 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/reader/impl/LineReaderImpl.java | 59 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/reader/impl/completer/FileNameCompleter.java | 2 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/reader/impl/completer/SystemCompleter.java | 2 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/reader/impl/history/DefaultHistory.java | 4 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/terminal/TerminalBuilder.java | 402 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/terminal/impl/AbstractPty.java | 5 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/terminal/impl/AbstractWindowsTerminal.java | 33 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/terminal/impl/Diag.java | 133 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/terminal/impl/ExecPty.java | 44 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/terminal/impl/PosixPtyTerminal.java | 9 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/terminal/impl/PosixSysTerminal.java | 10 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/terminal/impl/exec/ExecTerminalProvider.java | 133 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/terminal/spi/JansiSupport.java | 33 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/terminal/spi/JnaSupport.java | 37 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/terminal/spi/TerminalProvider.java | 84 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/utils/Colors.java | 2 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/utils/Curses.java | 12 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/utils/Display.java | 2 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/utils/InfoCmp.java | 2 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/utils/NonBlocking.java | 90 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/utils/NonBlockingInputStream.java | 26 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/utils/NonBlockingInputStreamImpl.java | 13 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/utils/NonBlockingPumpInputStream.java | 39 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/utils/NonBlockingPumpReader.java | 18 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/utils/NonBlockingReader.java | 10 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/utils/NonBlockingReaderImpl.java | 30 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/utils/OSUtils.java | 47 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/utils/PumpReader.java | 89 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/utils/StyleResolver.java | 2 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/utils/Timeout.java | 48 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/utils/WCWidth.java | 5 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/jdk/internal/org/jline/utils/windows-vtp.caps | 2 openjdk-11-11.0.21+9/src/jdk.internal.le/share/classes/module-info.java | 3 openjdk-11-11.0.21+9/src/jdk.internal.le/share/legal/jline.md | 12 openjdk-11-11.0.21+9/src/jdk.internal.le/windows/classes/jdk/internal/org/jline/terminal/impl/jna/JnaSupportImpl.java | 77 openjdk-11-11.0.21+9/src/jdk.internal.le/windows/classes/jdk/internal/org/jline/terminal/impl/jna/JnaTerminalProvider.java | 106 openjdk-11-11.0.21+9/src/jdk.internal.le/windows/classes/jdk/internal/org/jline/terminal/impl/jna/win/JnaWinConsoleWriter.java | 8 openjdk-11-11.0.21+9/src/jdk.internal.le/windows/classes/jdk/internal/org/jline/terminal/impl/jna/win/JnaWinSysTerminal.java | 70 openjdk-11-11.0.21+9/src/jdk.internal.le/windows/classes/module-info.java.extra | 27 openjdk-11-11.0.21+9/src/jdk.jartool/share/classes/sun/security/tools/jarsigner/TimestampedSigner.java | 22 openjdk-11-11.0.21+9/src/jdk.javadoc/share/classes/jdk/javadoc/internal/doclets/formats/html/HtmlDocletWriter.java | 3 openjdk-11-11.0.21+9/src/jdk.javadoc/share/classes/jdk/javadoc/internal/doclets/formats/html/markup/Links.java | 42 openjdk-11-11.0.21+9/src/jdk.javadoc/share/classes/jdk/javadoc/internal/doclets/formats/html/resources/jquery/jquery-ui.css | 2 openjdk-11-11.0.21+9/src/jdk.javadoc/share/classes/jdk/javadoc/internal/doclets/formats/html/resources/jquery/jquery-ui.js | 20 openjdk-11-11.0.21+9/src/jdk.javadoc/share/classes/jdk/javadoc/internal/doclets/formats/html/resources/jquery/jquery-ui.min.css | 2 openjdk-11-11.0.21+9/src/jdk.javadoc/share/classes/jdk/javadoc/internal/doclets/formats/html/resources/jquery/jquery-ui.min.js | 4 openjdk-11-11.0.21+9/src/jdk.javadoc/share/classes/jdk/javadoc/internal/doclets/toolkit/util/Extern.java | 103 openjdk-11-11.0.21+9/src/jdk.javadoc/share/legal/jqueryUI.md | 2 openjdk-11-11.0.21+9/src/jdk.jdi/share/classes/com/sun/tools/example/debug/tty/Env.java | 6 openjdk-11-11.0.21+9/src/jdk.jdi/share/classes/com/sun/tools/example/debug/tty/TTY.java | 12 openjdk-11-11.0.21+9/src/jdk.jdi/share/classes/com/sun/tools/example/debug/tty/VMConnection.java | 36 openjdk-11-11.0.21+9/src/jdk.management.agent/share/classes/sun/management/jmxremote/ConnectorBootstrap.java | 18 openjdk-11-11.0.21+9/src/jdk.pack/share/native/libunpack/jni.cpp | 5 openjdk-11-11.0.21+9/src/jdk.security.auth/share/classes/com/sun/security/auth/LdapPrincipal.java | 31 openjdk-11-11.0.21+9/src/jdk.security.auth/share/classes/com/sun/security/auth/NTDomainPrincipal.java | 28 openjdk-11-11.0.21+9/src/jdk.security.auth/share/classes/com/sun/security/auth/NTSid.java | 36 openjdk-11-11.0.21+9/src/jdk.security.auth/share/classes/com/sun/security/auth/NTUserPrincipal.java | 29 openjdk-11-11.0.21+9/src/jdk.security.auth/share/classes/com/sun/security/auth/UnixNumericGroupPrincipal.java | 30 openjdk-11-11.0.21+9/src/jdk.security.auth/share/classes/com/sun/security/auth/UnixNumericUserPrincipal.java | 28 openjdk-11-11.0.21+9/src/jdk.security.auth/share/classes/com/sun/security/auth/UnixPrincipal.java | 28 openjdk-11-11.0.21+9/src/jdk.security.auth/share/classes/com/sun/security/auth/UserPrincipal.java | 20 openjdk-11-11.0.21+9/src/jdk.zipfs/share/classes/jdk/nio/zipfs/ZipFileSystem.java | 14 openjdk-11-11.0.21+9/test/hotspot/jtreg/ProblemList.txt | 62 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/aot/verification/ClassAndLibraryNotMatchTest.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/aot/verification/vmflags/BasicFlagsChange.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/arraycopy/TestArrayCopyIntrinsicWithUCT.java | 312 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/arraycopy/stress/TestStressArrayCopy.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/c2/Test6905845.java | 1 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/c2/aarch64/TestIntrinsicsRegStress.java | 296 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/c2/irTests/TestDebugInfo.java | 137 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/ciReplay/CiReplayBase.java | 11 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/ciReplay/SABase.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/graalunit/common/GraalUnitTestLauncher.java | 5 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/intrinsics/string/TestStringIndexOfCharIntrinsics.java | 74 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/loopopts/TestRemoveEmptyCountedLoop.java | 67 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/loopstripmining/TestAddPAtOuterLoopHead.java | 82 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/runtime/cr8015436/Driver8015436.java | 4 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/startup/NumCompilerThreadsCheck.java | 5 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/types/correctness/OffTest.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/JdkInternalMiscUnsafeAccessTestBoolean.java | 46 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/JdkInternalMiscUnsafeAccessTestByte.java | 46 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/JdkInternalMiscUnsafeAccessTestChar.java | 46 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/JdkInternalMiscUnsafeAccessTestDouble.java | 46 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/JdkInternalMiscUnsafeAccessTestFloat.java | 46 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/JdkInternalMiscUnsafeAccessTestInt.java | 46 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/JdkInternalMiscUnsafeAccessTestLong.java | 46 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/JdkInternalMiscUnsafeAccessTestObject.java | 46 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/JdkInternalMiscUnsafeAccessTestShort.java | 46 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/SunMiscUnsafeAccessTestBoolean.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/SunMiscUnsafeAccessTestByte.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/SunMiscUnsafeAccessTestChar.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/SunMiscUnsafeAccessTestDouble.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/SunMiscUnsafeAccessTestFloat.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/SunMiscUnsafeAccessTestInt.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/SunMiscUnsafeAccessTestLong.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/SunMiscUnsafeAccessTestObject.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/SunMiscUnsafeAccessTestShort.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/X-UnsafeAccessTest.java.template | 46 openjdk-11-11.0.21+9/test/hotspot/jtreg/compiler/unsafe/generate-unsafe-access-tests.sh | 8 openjdk-11-11.0.21+9/test/hotspot/jtreg/containers/docker/TestMemoryAwareness.java | 45 openjdk-11-11.0.21+9/test/hotspot/jtreg/containers/docker/TestMemoryWithCgroupV1.java | 10 openjdk-11-11.0.21+9/test/hotspot/jtreg/gc/TestAllocateHeapAt.java | 3 openjdk-11-11.0.21+9/test/hotspot/jtreg/gc/TestAllocateHeapAtError.java | 3 openjdk-11-11.0.21+9/test/hotspot/jtreg/gc/TestAllocateHeapAtMultiple.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/gc/TestVerifyDuringStartup.java | 3 openjdk-11-11.0.21+9/test/hotspot/jtreg/gc/arguments/GCArguments.java | 18 openjdk-11-11.0.21+9/test/hotspot/jtreg/gc/arguments/TestUseNUMAInterleaving.java | 3 openjdk-11-11.0.21+9/test/hotspot/jtreg/gc/g1/TestShrinkAuxiliaryData.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/gc/g1/TestStringDeduplicationTableRehashFullGC.java | 44 openjdk-11-11.0.21+9/test/hotspot/jtreg/gc/g1/TestStringDeduplicationTools.java | 17 openjdk-11-11.0.21+9/test/hotspot/jtreg/gc/g1/mixedgc/TestLogging.java | 3 openjdk-11-11.0.21+9/test/hotspot/jtreg/gc/whitebox/TestWBGC.java | 3 openjdk-11-11.0.21+9/test/hotspot/jtreg/runtime/BootstrapMethod/BSMCalledTwice.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/runtime/ClassFile/UnsupportedClassFileVersion.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/runtime/SharedArchiveFile/SharedArchiveFile.java | 6 openjdk-11-11.0.21+9/test/hotspot/jtreg/runtime/StackTrace/LargeClassTest.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/runtime/Unsafe/RangeCheck.java | 3 openjdk-11-11.0.21+9/test/hotspot/jtreg/runtime/appcds/DumpClassList.java | 3 openjdk-11-11.0.21+9/test/hotspot/jtreg/runtime/appcds/GraalWithLimitedMetaspace.java | 4 openjdk-11-11.0.21+9/test/hotspot/jtreg/runtime/appcds/TestCommon.java | 4 openjdk-11-11.0.21+9/test/hotspot/jtreg/runtime/appcds/sharedStrings/SharedStringsBasic.java | 4 openjdk-11-11.0.21+9/test/hotspot/jtreg/runtime/appcds/sharedStrings/SysDictCrash.java | 4 openjdk-11-11.0.21+9/test/hotspot/jtreg/runtime/handshake/HandshakeTransitionTest.java | 3 openjdk-11-11.0.21+9/test/hotspot/jtreg/runtime/modules/ModuleOptionsTest.java | 1 openjdk-11-11.0.21+9/test/hotspot/jtreg/runtime/modules/PatchModule/PatchModuleClassList.java | 9 openjdk-11-11.0.21+9/test/hotspot/jtreg/runtime/os/AvailableProcessors.java | 3 openjdk-11-11.0.21+9/test/hotspot/jtreg/runtime/os/TestUseCpuAllocPath.java | 3 openjdk-11-11.0.21+9/test/hotspot/jtreg/runtime/verifier/OverriderMsg.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/runtime/verifier/TestANewArray.java | 6 openjdk-11-11.0.21+9/test/hotspot/jtreg/runtime/verifier/TestMultiANewArray.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/sanity/MismatchedWhiteBox/WhiteBox.java | 11 openjdk-11-11.0.21+9/test/hotspot/jtreg/serviceability/jvmti/GetObjectSizeClass.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/serviceability/jvmti/GetObjectSizeOverflow.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/serviceability/logging/TestLogRotation.java | 3 openjdk-11-11.0.21+9/test/hotspot/jtreg/serviceability/sa/ClhsdbCDSCore.java | 6 openjdk-11-11.0.21+9/test/hotspot/jtreg/serviceability/sa/ClhsdbFlags.java | 57 openjdk-11-11.0.21+9/test/hotspot/jtreg/serviceability/sa/TestJmapCore.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/testlibrary/ctw/src/sun/hotspot/tools/ctw/CtwRunner.java | 4 openjdk-11-11.0.21+9/test/hotspot/jtreg/testlibrary/jittester/src/jdk/test/lib/jittester/jtreg/JitTesterDriver.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/testlibrary_tests/ctw/CtwTest.java | 2 openjdk-11-11.0.21+9/test/hotspot/jtreg/vmTestbase/gc/huge/quicklook/largeheap/MemOptions/MemOptionsTest.java | 4 openjdk-11-11.0.21+9/test/hotspot/jtreg/vmTestbase/jit/tiered/Test.java | 4 openjdk-11-11.0.21+9/test/hotspot/jtreg/vmTestbase/metaspace/flags/maxMetaspaceSize/TestMaxMetaspaceSize.java | 4 openjdk-11-11.0.21+9/test/hotspot/jtreg/vmTestbase/nsk/jvmti/GetThreadState/thrstat001/thrstat001.cpp | 298 openjdk-11-11.0.21+9/test/hotspot/jtreg/vmTestbase/nsk/jvmti/RetransformClasses/retransform003/TestDriver.java | 3 openjdk-11-11.0.21+9/test/hotspot/jtreg/vmTestbase/nsk/jvmti/SetNativeMethodPrefix/SetNativeMethodPrefix001/TestDescription.java | 4 openjdk-11-11.0.21+9/test/hotspot/jtreg/vmTestbase/nsk/jvmti/SetNativeMethodPrefix/SetNativeMethodPrefix002/TestDriver.java | 3 openjdk-11-11.0.21+9/test/hotspot/jtreg/vmTestbase/nsk/share/jvmti/jvmti_tools.cpp | 126 openjdk-11-11.0.21+9/test/hotspot/jtreg/vmTestbase/vm/compiler/CodeCacheInfo/Test.java | 4 openjdk-11-11.0.21+9/test/hotspot/jtreg/vmTestbase/vm/compiler/CodeCacheInfoOnCompilation/Test.java | 2 openjdk-11-11.0.21+9/test/jaxp/javax/xml/jaxp/unittest/transform/SurrogateTest.java | 106 openjdk-11-11.0.21+9/test/jaxp/javax/xml/jaxp/unittest/transform/SurrogateTest1.html | 12 openjdk-11-11.0.21+9/test/jaxp/javax/xml/jaxp/unittest/transform/SurrogateTest1.xml | 4 openjdk-11-11.0.21+9/test/jaxp/javax/xml/jaxp/unittest/transform/SurrogateTest1.xsl | 26 openjdk-11-11.0.21+9/test/jaxp/javax/xml/jaxp/unittest/transform/SurrogateTest2.txt | 4 openjdk-11-11.0.21+9/test/jaxp/javax/xml/jaxp/unittest/transform/SurrogateTest2.xml | 6 openjdk-11-11.0.21+9/test/jaxp/javax/xml/jaxp/unittest/xpath/XPathAncestorsTest.java | 186 openjdk-11-11.0.21+9/test/jaxp/javax/xml/jaxp/unittest/xpath/XPathPrecedingTest.java | 185 openjdk-11-11.0.21+9/test/jdk/ProblemList.txt | 16 openjdk-11-11.0.21+9/test/jdk/com/sun/jdi/JITDebug.java | 2 openjdk-11-11.0.21+9/test/jdk/com/sun/jdi/JdbOptions.java | 165 openjdk-11-11.0.21+9/test/jdk/com/sun/jdi/OptionTest.java | 12 openjdk-11-11.0.21+9/test/jdk/com/sun/jdi/PrivateTransportTest.java | 2 openjdk-11-11.0.21+9/test/jdk/com/sun/jdi/RunToExit.java | 41 openjdk-11-11.0.21+9/test/jdk/com/sun/jdi/cds/CDSJDITest.java | 6 openjdk-11-11.0.21+9/test/jdk/com/sun/jdi/lib/jdb/Debuggee.java | 9 openjdk-11-11.0.21+9/test/jdk/com/sun/net/httpserver/SimpleHttpServerTest.java | 44 openjdk-11-11.0.21+9/test/jdk/com/sun/net/httpserver/bugs/B6393710.java | 11 openjdk-11-11.0.21+9/test/jdk/java/awt/Choice/ChoiceConsumeMouseEvents.java | 125 openjdk-11-11.0.21+9/test/jdk/java/awt/Choice/ChoiceFocusLostTest.java | 116 openjdk-11-11.0.21+9/test/jdk/java/awt/Choice/ChoiceFreezeTest.java | 132 openjdk-11-11.0.21+9/test/jdk/java/awt/Choice/ChoiceGeneratesItemEvents.java | 129 openjdk-11-11.0.21+9/test/jdk/java/awt/Choice/ChoiceHandleMouseEvent.java | 206 openjdk-11-11.0.21+9/test/jdk/java/awt/Choice/ChoiceHandleMouseEvent_2.java | 340 openjdk-11-11.0.21+9/test/jdk/java/awt/Choice/ChoiceMouseEventOutbounds.java | 145 openjdk-11-11.0.21+9/test/jdk/java/awt/Choice/ChoiceMoveTest.java | 106 openjdk-11-11.0.21+9/test/jdk/java/awt/Choice/ChoiceStaysOpenedOnTAB.java | 150 openjdk-11-11.0.21+9/test/jdk/java/awt/Choice/DragOffNoSelectTest.java | 134 openjdk-11-11.0.21+9/test/jdk/java/awt/Clipboard/CopyAnimatedGIFTest.java | 166 openjdk-11-11.0.21+9/test/jdk/java/awt/Component/ComponentRedrawnTest.java | 198 openjdk-11-11.0.21+9/test/jdk/java/awt/EventDispatchThread/StoppingEdtOnPushPopTest.java | 118 openjdk-11-11.0.21+9/test/jdk/java/awt/FileDialog/ExceptionAfterSetDirectory.java | 116 openjdk-11-11.0.21+9/test/jdk/java/awt/FlowLayout/MinimumLayoutSize.java | 98 openjdk-11-11.0.21+9/test/jdk/java/awt/FlowLayout/PreferredLayoutSize.java | 78 openjdk-11-11.0.21+9/test/jdk/java/awt/Focus/AsyncUpFocusCycleTest.java | 186 openjdk-11-11.0.21+9/test/jdk/java/awt/Focus/ClearMostRecentFocusOwnerTest.java | 307 openjdk-11-11.0.21+9/test/jdk/java/awt/Focus/ConsumedTabKeyTest.java | 232 openjdk-11-11.0.21+9/test/jdk/java/awt/Focus/EventRetargetTest.java | 124 openjdk-11-11.0.21+9/test/jdk/java/awt/Focus/ExtraPropChangeNotifVetoingTest.java | 113 openjdk-11-11.0.21+9/test/jdk/java/awt/Focus/FocusForRemovedComponentTest.java | 154 openjdk-11-11.0.21+9/test/jdk/java/awt/Focus/FocusTraversalPolicyIAE.java | 73 openjdk-11-11.0.21+9/test/jdk/java/awt/Focus/InitialFocusTest.java | 144 openjdk-11-11.0.21+9/test/jdk/java/awt/Focus/LabelScrollBarFocus.java | 180 openjdk-11-11.0.21+9/test/jdk/java/awt/Focus/ModalDialogInFocusEventTest.java | 414 openjdk-11-11.0.21+9/test/jdk/java/awt/ScrollPane/ComponentScrollTest.java | 99 openjdk-11-11.0.21+9/test/jdk/java/awt/ScrollPane/ScrollPaneExtraScrollBar.java | 97 openjdk-11-11.0.21+9/test/jdk/java/awt/ScrollPane/ScrollPaneLeakTest.java | 189 openjdk-11-11.0.21+9/test/jdk/java/awt/ScrollPane/ScrollPaneLimitation.java | 149 openjdk-11-11.0.21+9/test/jdk/java/awt/ScrollPane/ScrollPaneRemoveAdd.java | 113 openjdk-11-11.0.21+9/test/jdk/java/awt/ScrollPane/ScrollPaneScrollEnd.java | 95 openjdk-11-11.0.21+9/test/jdk/java/awt/ScrollPane/ScrollPaneWindowsTest.java | 191 openjdk-11-11.0.21+9/test/jdk/java/awt/ScrollPane/ScrollPositionIntact.java | 103 openjdk-11-11.0.21+9/test/jdk/java/awt/Toolkit/ToolkitListenerTest/ToolkitListenerTest.java | 126 openjdk-11-11.0.21+9/test/jdk/java/awt/Window/MultiWindowApp/ChildAlwaysOnTopTest.java | 282 openjdk-11-11.0.21+9/test/jdk/java/awt/datatransfer/CRLFTest/CRLFTest.java | 209 openjdk-11-11.0.21+9/test/jdk/java/awt/datatransfer/DataConversionDeadlockTest/DataConversionDeadlockTest.java | 204 openjdk-11-11.0.21+9/test/jdk/java/awt/datatransfer/DataFlavor/BestTextFlavorTest/BestTextFlavorTest.java | 105 openjdk-11-11.0.21+9/test/jdk/java/awt/datatransfer/FileTransferAWTLockTest/FileTransferAWTLockTest.java | 219 openjdk-11-11.0.21+9/test/jdk/java/awt/dnd/MouseExitGestureTriggerTest.java | 127 openjdk-11-11.0.21+9/test/jdk/java/awt/dnd/MozillaDnDTest.java | 494 openjdk-11-11.0.21+9/test/jdk/java/awt/dnd/MultiDataFlavorDropTest.java | 415 openjdk-11-11.0.21+9/test/jdk/java/awt/dnd/NativeDragJavaDropTest.java | 152 openjdk-11-11.0.21+9/test/jdk/java/awt/dnd/NestedHeavyweightDropTargetTest.java | 492 openjdk-11-11.0.21+9/test/jdk/java/awt/dnd/NextDropActionTest/NextDropActionTest.java | 203 openjdk-11-11.0.21+9/test/jdk/java/awt/dnd/NoFormatsDragEnterTest/NoFormatsDragEnterTest.java | 225 openjdk-11-11.0.21+9/test/jdk/java/awt/dnd/NoFormatsDropTest/NoFormatsDropTest.java | 297 openjdk-11-11.0.21+9/test/jdk/java/awt/dnd/NoTargetNoDragExitTest/NoTargetNoDragExitTest.java | 217 openjdk-11-11.0.21+9/test/jdk/java/awt/dnd/NotReallySerializableTest/NotReallySerializableTest.java | 120 openjdk-11-11.0.21+9/test/jdk/java/awt/font/FontScaling/StretchedFontTest.java | 222 openjdk-11-11.0.21+9/test/jdk/java/awt/print/PageFormat/PrintContentCutOffTest.java | 358 openjdk-11-11.0.21+9/test/jdk/java/awt/print/PrinterJob/InitToBlack.java | 148 openjdk-11-11.0.21+9/test/jdk/java/io/ByteArrayOutputStream/MaxCapacity.java | 7 openjdk-11-11.0.21+9/test/jdk/java/io/File/MacPath.java | 2 openjdk-11-11.0.21+9/test/jdk/java/io/File/SetLastModified.java | 3 openjdk-11-11.0.21+9/test/jdk/java/io/Serializable/evolution/RenamePackage/RenamePackageTest.java | 4 openjdk-11-11.0.21+9/test/jdk/java/lang/Runtime/shutdown/ShutdownInterruptedMain.java | 6 openjdk-11-11.0.21+9/test/jdk/java/lang/StackWalker/CallerFromMain.java | 2 openjdk-11-11.0.21+9/test/jdk/java/lang/StringBuilder/HugeCapacity.java | 17 openjdk-11-11.0.21+9/test/jdk/java/lang/System/MacEncoding/MacJNUEncoding.java | 2 openjdk-11-11.0.21+9/test/jdk/java/lang/instrument/DaemonThread/TestDaemonThreadLauncher.java | 2 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestAccessBoolean.java | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestAccessByte.java | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestAccessChar.java | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestAccessDouble.java | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestAccessFloat.java | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestAccessInt.java | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestAccessLong.java | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestAccessShort.java | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestAccessString.java | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestByteArrayAsChar.java | 2 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestByteArrayAsDouble.java | 90 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestByteArrayAsFloat.java | 90 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestByteArrayAsInt.java | 90 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestByteArrayAsLong.java | 90 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestByteArrayAsShort.java | 2 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestMethodHandleAccessBoolean.java | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestMethodHandleAccessByte.java | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestMethodHandleAccessChar.java | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestMethodHandleAccessDouble.java | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestMethodHandleAccessFloat.java | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestMethodHandleAccessInt.java | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestMethodHandleAccessLong.java | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestMethodHandleAccessShort.java | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/VarHandleTestMethodHandleAccessString.java | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/X-VarHandleTestAccess.java.template | 134 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/X-VarHandleTestByteArrayView.java.template | 90 openjdk-11-11.0.21+9/test/jdk/java/lang/invoke/VarHandles/X-VarHandleTestMethodHandleAccess.java.template | 134 openjdk-11-11.0.21+9/test/jdk/java/math/BigInteger/DivisionOverflow.java | 55 openjdk-11-11.0.21+9/test/jdk/java/math/BigInteger/StringConstructorOverflow.java | 62 openjdk-11-11.0.21+9/test/jdk/java/math/BigInteger/SymmetricRangeTests.java | 665 - openjdk-11-11.0.21+9/test/jdk/java/math/BigInteger/largeMemory/DivisionOverflow.java | 56 openjdk-11-11.0.21+9/test/jdk/java/math/BigInteger/largeMemory/StringConstructorOverflow.java | 62 openjdk-11-11.0.21+9/test/jdk/java/math/BigInteger/largeMemory/SymmetricRangeTests.java | 665 + openjdk-11-11.0.21+9/test/jdk/java/net/BindException/Test.java | 37 openjdk-11-11.0.21+9/test/jdk/java/net/DatagramSocket/UnreferencedDatagramSockets.java | 20 openjdk-11-11.0.21+9/test/jdk/java/net/HttpURLConnection/SetAuthenticator/HTTPTestServer.java | 185 openjdk-11-11.0.21+9/test/jdk/java/net/InetAddress/ptr/Lookup.java | 90 openjdk-11-11.0.21+9/test/jdk/java/net/NetworkInterface/NetworkInterfaceRetrievalTests.java | 8 openjdk-11-11.0.21+9/test/jdk/java/net/PlainSocketImpl/SetOption.java | 8 openjdk-11-11.0.21+9/test/jdk/java/net/SctpSanity.java | 84 openjdk-11-11.0.21+9/test/jdk/java/net/Socket/RST.java | 8 openjdk-11-11.0.21+9/test/jdk/java/net/Socket/Streams.java | 13 openjdk-11-11.0.21+9/test/jdk/java/net/Socks/SocksIPv6Test.java | 14 openjdk-11-11.0.21+9/test/jdk/java/net/URLConnection/URLConnectionHeaders.java | 28 openjdk-11-11.0.21+9/test/jdk/java/net/httpclient/AuthSchemesTest.java | 159 openjdk-11-11.0.21+9/test/jdk/java/net/ipv6tests/UdpTest.java | 13 openjdk-11-11.0.21+9/test/jdk/java/nio/Buffer/Basic.java | 4 openjdk-11-11.0.21+9/test/jdk/java/nio/charset/Charset/DefaultCharsetTest.java | 2 openjdk-11-11.0.21+9/test/jdk/java/nio/charset/coders/SJISMappingPropTest.java | 2 openjdk-11-11.0.21+9/test/jdk/java/nio/file/FileStore/Basic.java | 2 openjdk-11-11.0.21+9/test/jdk/java/nio/file/Path/MacPathTest.java | 2 openjdk-11-11.0.21+9/test/jdk/java/security/KeyRep/SerialOld.java | 14 openjdk-11-11.0.21+9/test/jdk/java/security/MessageDigest/ThreadSafetyTest.java | 8 openjdk-11-11.0.21+9/test/jdk/java/security/Security/ConfigFileTest.java | 122 openjdk-11-11.0.21+9/test/jdk/java/security/Security/override.props | 7 openjdk-11-11.0.21+9/test/jdk/java/security/misc/TestDefaultRandom.java | 229 openjdk-11-11.0.21+9/test/jdk/java/security/testlibrary/CertificateBuilder.java | 4 openjdk-11-11.0.21+9/test/jdk/java/security/testlibrary/SimpleOCSPServer.java | 12 openjdk-11-11.0.21+9/test/jdk/java/time/tck/java/time/format/TCKDateTimeFormatterBuilder.java | 4 openjdk-11-11.0.21+9/test/jdk/java/util/RandomAccess/Basic.java | 225 openjdk-11-11.0.21+9/test/jdk/java/util/concurrent/CompletableFuture/LostInterrupt.java | 73 openjdk-11-11.0.21+9/test/jdk/java/util/concurrent/CompletableFuture/SwallowedInterruptedException.java | 89 openjdk-11-11.0.21+9/test/jdk/java/util/zip/ZipFile/CorruptedZipFiles.java | 7 openjdk-11-11.0.21+9/test/jdk/java/util/zip/ZipFile/ReadNonStandardExtraHeadersTest.java | 940 + openjdk-11-11.0.21+9/test/jdk/javax/accessibility/MaximumAccessibleValueTest.java | 71 openjdk-11-11.0.21+9/test/jdk/javax/accessibility/SetCurrentAccessibleValueTest.java | 76 openjdk-11-11.0.21+9/test/jdk/javax/crypto/SecretKeyFactory/security.properties | 3 openjdk-11-11.0.21+9/test/jdk/javax/print/attribute/SidesAttributeTest.java | 272 openjdk-11-11.0.21+9/test/jdk/javax/security/auth/callback/Mutability.java | 96 openjdk-11-11.0.21+9/test/jdk/javax/security/auth/callback/PasswordCallback/CheckCleanerBound.java | 61 openjdk-11-11.0.21+9/test/jdk/javax/security/auth/callback/PasswordCallback/PasswordCleanup.java | 52 openjdk-11-11.0.21+9/test/jdk/javax/sound/sampled/Clip/SetPositionHang.java | 2 openjdk-11-11.0.21+9/test/jdk/javax/swing/JComboBox/bug4167850.java | 45 openjdk-11-11.0.21+9/test/jdk/javax/swing/JComboBox/bug4171464.java | 55 openjdk-11-11.0.21+9/test/jdk/javax/swing/JComboBox/bug4209474.java | 53 openjdk-11-11.0.21+9/test/jdk/javax/swing/JComboBox/bug4234119.java | 46 openjdk-11-11.0.21+9/test/jdk/javax/swing/JComboBox/bug4244614.java | 58 openjdk-11-11.0.21+9/test/jdk/javax/swing/JComboBox/bug4276920.java | 81 openjdk-11-11.0.21+9/test/jdk/javax/swing/JComboBox/bug4890345.java | 154 openjdk-11-11.0.21+9/test/jdk/javax/swing/JComboBox/bug4924758.java | 115 openjdk-11-11.0.21+9/test/jdk/javax/swing/JComboBox/bug4996503.java | 94 openjdk-11-11.0.21+9/test/jdk/javax/swing/JComboBox/bug5029504.java | 116 openjdk-11-11.0.21+9/test/jdk/javax/swing/JRadioButton/bug4380543.java | 135 openjdk-11-11.0.21+9/test/jdk/javax/swing/JRootPane/DefaultButtonTest.java | 6 openjdk-11-11.0.21+9/test/jdk/javax/swing/JSpinner/4788637/bug4788637.java | 36 openjdk-11-11.0.21+9/test/jdk/javax/swing/JSpinner/JSpinnerFocusTest.java | 121 openjdk-11-11.0.21+9/test/jdk/javax/swing/JTable/4170447/bug4170447.java | 102 openjdk-11-11.0.21+9/test/jdk/javax/swing/JTable/bug4098201.java | 41 openjdk-11-11.0.21+9/test/jdk/javax/swing/JTable/bug4130356.java | 43 openjdk-11-11.0.21+9/test/jdk/javax/swing/JTable/bug4159300.java | 92 openjdk-11-11.0.21+9/test/jdk/javax/swing/JTable/bug4243159.java | 38 openjdk-11-11.0.21+9/test/jdk/javax/swing/JTable/bug4243313.java | 38 openjdk-11-11.0.21+9/test/jdk/javax/swing/JTable/bug4247487.java | 73 openjdk-11-11.0.21+9/test/jdk/javax/swing/JTable/bug4248070.java | 59 openjdk-11-11.0.21+9/test/jdk/javax/swing/JTableHeader/6889007/bug6889007.java | 85 openjdk-11-11.0.21+9/test/jdk/javax/swing/JTextField/JapaneseReadingAttributes/JapaneseReadingAttributes.java | 4 openjdk-11-11.0.21+9/test/jdk/jdk/internal/jline/AbstractWindowsTerminalTest.java | 2 openjdk-11-11.0.21+9/test/jdk/jdk/internal/jline/KeyConversionTest.java | 2 openjdk-11-11.0.21+9/test/jdk/jdk/internal/jline/OSUtilsTest.java | 52 openjdk-11-11.0.21+9/test/jdk/jdk/jfr/event/sampling/TestNative.java | 2 openjdk-11-11.0.21+9/test/jdk/jdk/jfr/event/security/TestX509CertificateEvent.java | 58 openjdk-11-11.0.21+9/test/jdk/jdk/jfr/event/security/TestX509ValidationEvent.java | 41 openjdk-11-11.0.21+9/test/jdk/jdk/jfr/jvm/TestDumpOnCrash.java | 2 openjdk-11-11.0.21+9/test/jdk/jdk/jfr/jvm/TestJfrJavaBase.java | 2 openjdk-11-11.0.21+9/test/jdk/jdk/jfr/startupargs/TestDumpOnExit.java | 2 openjdk-11-11.0.21+9/test/jdk/jdk/jfr/startupargs/TestMemoryOptions.java | 24 openjdk-11-11.0.21+9/test/jdk/jdk/jfr/startupargs/TestMultipleStartupRecordings.java | 8 openjdk-11-11.0.21+9/test/jdk/jdk/jfr/startupargs/TestRetransformUsingLog.java | 2 openjdk-11-11.0.21+9/test/jdk/jdk/jfr/startupargs/TestStartDuration.java | 4 openjdk-11-11.0.21+9/test/jdk/jdk/jfr/startupargs/TestStartName.java | 2 openjdk-11-11.0.21+9/test/jdk/jdk/net/Sockets/QuickAckTest.java | 2 openjdk-11-11.0.21+9/test/jdk/jdk/nio/zipfs/ZipFSOutputStreamTest.java | 23 openjdk-11-11.0.21+9/test/jdk/jdk/security/logging/TestX509CertificateLog.java | 9 openjdk-11-11.0.21+9/test/jdk/jdk/security/logging/TestX509ValidationLog.java | 12 openjdk-11-11.0.21+9/test/jdk/sanity/client/SwingSet/src/ToolTipDemoTest.java | 18 openjdk-11-11.0.21+9/test/jdk/security/infra/java/security/cert/CertPathValidator/certification/ActalisCA.java | 354 openjdk-11-11.0.21+9/test/jdk/security/infra/java/security/cert/CertPathValidator/certification/AmazonCA.java | 901 - openjdk-11-11.0.21+9/test/jdk/security/infra/java/security/cert/CertPathValidator/certification/CertignaCA.java | 227 openjdk-11-11.0.21+9/test/jdk/security/infra/java/security/cert/CertPathValidator/certification/CertignaRoots.java | 293 openjdk-11-11.0.21+9/test/jdk/sun/java2d/loops/SkipConversionIfPossible.java | 89 openjdk-11-11.0.21+9/test/jdk/sun/management/jmxremote/bootstrap/management_ssltest07_ok.properties.in | 4 openjdk-11-11.0.21+9/test/jdk/sun/net/ftp/B6427768.java | 9 openjdk-11-11.0.21+9/test/jdk/sun/net/ftp/FtpURLConnectionLeak.java | 10 openjdk-11-11.0.21+9/test/jdk/sun/net/www/AuthHeaderTest.java | 7 openjdk-11-11.0.21+9/test/jdk/sun/net/www/ftptest/FtpCommandHandler.java | 10 openjdk-11-11.0.21+9/test/jdk/sun/net/www/ftptest/FtpServer.java | 27 openjdk-11-11.0.21+9/test/jdk/sun/net/www/http/ChunkedInputStream/ChunkedEncodingTest.java | 15 openjdk-11-11.0.21+9/test/jdk/sun/net/www/http/ChunkedInputStream/ChunkedEncodingWithProgressMonitorTest.java | 3 openjdk-11-11.0.21+9/test/jdk/sun/net/www/http/ChunkedInputStream/TestAvailable.java | 16 openjdk-11-11.0.21+9/test/jdk/sun/net/www/http/HttpClient/MultiThreadTest.java | 335 openjdk-11-11.0.21+9/test/jdk/sun/net/www/http/HttpClient/RetryPost.java | 15 openjdk-11-11.0.21+9/test/jdk/sun/net/www/http/HttpURLConnection/DigestAuth.java | 22 openjdk-11-11.0.21+9/test/jdk/sun/net/www/http/KeepAliveCache/B8293562.java | 238 openjdk-11-11.0.21+9/test/jdk/sun/net/www/protocol/http/6550798/test.java | 17 openjdk-11-11.0.21+9/test/jdk/sun/net/www/protocol/http/CloseOptionHeader.java | 15 openjdk-11-11.0.21+9/test/jdk/sun/net/www/protocol/https/AbstractCallback.java | 82 openjdk-11-11.0.21+9/test/jdk/sun/net/www/protocol/https/ChunkedOutputStream.java | 250 openjdk-11-11.0.21+9/test/jdk/sun/net/www/protocol/https/HttpCallback.java | 39 openjdk-11-11.0.21+9/test/jdk/sun/net/www/protocol/https/HttpTransaction.java | 330 openjdk-11-11.0.21+9/test/jdk/sun/net/www/protocol/https/HttpsURLConnection/B6216082.java | 101 openjdk-11-11.0.21+9/test/jdk/sun/net/www/protocol/https/HttpsURLConnection/CookieHttpsClientTest.java | 37 openjdk-11-11.0.21+9/test/jdk/sun/net/www/protocol/https/HttpsURLConnection/ReadTimeout.java | 27 openjdk-11-11.0.21+9/test/jdk/sun/net/www/protocol/https/HttpsURLConnection/Redirect.java | 21 openjdk-11-11.0.21+9/test/jdk/sun/net/www/protocol/https/HttpsURLConnection/TunnelProxy.java | 33 openjdk-11-11.0.21+9/test/jdk/sun/net/www/protocol/https/TestHttpsServer.java | 933 - openjdk-11-11.0.21+9/test/jdk/sun/security/jgss/spnego/NotPreferredMech.java | 8 openjdk-11-11.0.21+9/test/jdk/sun/security/krb5/auto/Unavailable.java | 80 openjdk-11-11.0.21+9/test/jdk/sun/security/lib/cacerts/VerifyCACerts.java | 13 openjdk-11-11.0.21+9/test/jdk/sun/security/pkcs/pkcs10/PKCS10AttrEncoding.java | 6 openjdk-11-11.0.21+9/test/jdk/sun/security/pkcs/pkcs10/PKCS10AttributeReader.java | 6 openjdk-11-11.0.21+9/test/jdk/sun/security/pkcs11/Cipher/TestKATForGCM.java | 35 openjdk-11-11.0.21+9/test/jdk/sun/security/pkcs11/PKCS11Test.java | 6 openjdk-11-11.0.21+9/test/jdk/sun/security/pkcs11/rsa/TestKeyFactory.java | 136 openjdk-11-11.0.21+9/test/jdk/sun/security/pkcs12/KeytoolOpensslInteropTest.java | 2 openjdk-11-11.0.21+9/test/jdk/sun/security/pkcs12/PKCS12SameKeyId.java | 6 openjdk-11-11.0.21+9/test/jdk/sun/security/pkcs12/ParamsPreferences.java | 4 openjdk-11-11.0.21+9/test/jdk/sun/security/provider/SecureRandom/SHA1PRNGReseed.java | 8 openjdk-11-11.0.21+9/test/jdk/sun/security/rsa/TestKeyFactory.java | 138 openjdk-11-11.0.21+9/test/jdk/sun/security/rsa/TestRSAOidSupport.java | 78 openjdk-11-11.0.21+9/test/jdk/sun/security/ssl/DHKeyExchange/DHEKeySizing.java | 14 openjdk-11-11.0.21+9/test/jdk/sun/security/ssl/SSLContextImpl/DefaultCipherSuitePreference.java | 120 openjdk-11-11.0.21+9/test/jdk/sun/security/ssl/SSLEngineImpl/SSLEngineKeyLimit.java | 2 openjdk-11-11.0.21+9/test/jdk/sun/security/ssl/SSLSocketImpl/SSLSocketKeyLimit.java | 2 openjdk-11-11.0.21+9/test/jdk/sun/security/tools/jarsigner/compatibility/Compatibility.java | 55 openjdk-11-11.0.21+9/test/jdk/sun/security/tools/jarsigner/compatibility/JdkUtils.java | 10 openjdk-11-11.0.21+9/test/jdk/sun/security/tools/jarsigner/compatibility/SignTwice.java | 6 openjdk-11-11.0.21+9/test/jdk/sun/security/tools/jarsigner/warnings/NoTimestampTest.java | 16 openjdk-11-11.0.21+9/test/jdk/sun/security/tools/jarsigner/warnings/Test.java | 13 openjdk-11-11.0.21+9/test/jdk/sun/security/tools/keytool/KeyToolTest.java | 21 openjdk-11-11.0.21+9/test/jdk/sun/security/tools/keytool/fakegen/java.base/sun/security/rsa/RSAKeyPairGenerator.java | 11 openjdk-11-11.0.21+9/test/jdk/sun/security/util/Oid/OidEquals.java | 13 openjdk-11-11.0.21+9/test/jdk/sun/security/util/Oid/OidFormat.java | 56 openjdk-11-11.0.21+9/test/jdk/sun/security/util/Oid/S11N.java | 6 openjdk-11-11.0.21+9/test/jdk/sun/security/util/RegisteredDomain/ParseNames.java | 4 openjdk-11-11.0.21+9/test/jdk/sun/security/util/RegisteredDomain/tests.dat | 8 openjdk-11-11.0.21+9/test/jdk/sun/security/x509/AVA/AVAEqualsHashCode.java | 8 openjdk-11-11.0.21+9/test/jdk/sun/security/x509/AlgorithmId/ExtensibleAlgorithmId.java | 51 openjdk-11-11.0.21+9/test/jdk/sun/security/x509/X509CertImpl/V3Certificate.java | 8 openjdk-11-11.0.21+9/test/jdk/sun/security/x509/equalNames/AltNamesEqualsTest.java | 6 openjdk-11-11.0.21+9/test/jdk/tools/jmod/hashes/HashesTest.java | 20 openjdk-11-11.0.21+9/test/jdk/tools/launcher/Settings.java | 7 openjdk-11-11.0.21+9/test/jdk/tools/launcher/modules/addexports/AddExportsTest.java | 38 openjdk-11-11.0.21+9/test/jdk/tools/launcher/modules/addexports/src/java.compiler/javax/annotation/processing/Generated.java | 30 openjdk-11-11.0.21+9/test/jdk/tools/launcher/modules/addexports/src/java.compiler/javax/tools/ToolsHelper.java | 27 openjdk-11-11.0.21+9/test/jdk/tools/launcher/modules/addexports/src/java.compiler/javax/tools/internal/Helper.java | 27 openjdk-11-11.0.21+9/test/jdk/tools/launcher/modules/addexports/src/java.compiler/module-info.java | 27 openjdk-11-11.0.21+9/test/jdk/tools/launcher/modules/addexports/src/m2/jdk/test2/Main.java | 32 openjdk-11-11.0.21+9/test/jdk/tools/launcher/modules/addexports/src/m2/module-info.java | 26 openjdk-11-11.0.21+9/test/jdk/tools/pack200/UnpackMalformed.java | 55 openjdk-11-11.0.21+9/test/jtreg-ext/requires/VMProps.java | 4 openjdk-11-11.0.21+9/test/langtools/jdk/javadoc/doclet/InheritDocForUserTags/DocTest.java | 3 openjdk-11-11.0.21+9/test/langtools/jdk/javadoc/doclet/lib/JavadocTester.java | 2 openjdk-11-11.0.21+9/test/langtools/jdk/javadoc/doclet/testClassCrossReferences/TestClassCrossReferences.java | 6 openjdk-11-11.0.21+9/test/langtools/jdk/javadoc/doclet/testExternalOverridenMethod/TestExternalOverridenMethod.java | 6 openjdk-11-11.0.21+9/test/langtools/jdk/javadoc/doclet/testHref/TestHref.java | 4 openjdk-11-11.0.21+9/test/langtools/jdk/javadoc/doclet/testHrefInDocComment/TestHrefInDocComment.java | 4 openjdk-11-11.0.21+9/test/langtools/jdk/javadoc/doclet/testHrefInDocComment/pkg/J1.java | 75 openjdk-11-11.0.21+9/test/langtools/jdk/javadoc/doclet/testLinkOption/TestLinkOption.java | 4 openjdk-11-11.0.21+9/test/langtools/jdk/jshell/ExecPtyGetFlagsToSetTest.java | 8 openjdk-11-11.0.21+9/test/langtools/tools/javac/Paths/Util.sh | 8 openjdk-11-11.0.21+9/test/lib/jdk/test/lib/Utils.java | 12 openjdk-11-11.0.21+9/test/lib/jdk/test/lib/cds/CDSTestUtils.java | 4 openjdk-11-11.0.21+9/test/lib/jdk/test/lib/containers/cgroup/CgroupMetricsTester.java | 2 openjdk-11-11.0.21+9/test/lib/jdk/test/lib/containers/docker/DockerTestUtils.java | 4 openjdk-11-11.0.21+9/test/lib/jdk/test/lib/jfr/AppExecutorHelper.java | 2 openjdk-11-11.0.21+9/test/lib/jdk/test/lib/process/ProcessTools.java | 62 openjdk-11-11.0.21+9/test/lib/jdk/test/lib/security/DerUtils.java | 4 openjdk-11-11.0.21+9/test/lib/jdk/test/lib/security/TestCertificate.java | 105 openjdk-11-11.0.21+9/test/lib/jdk/test/lib/security/timestamp/TsaSigner.java | 4 openjdk-11-11.0.21+9/test/lib/jdk/test/lib/util/FileUtils.java | 93 openjdk-11-11.0.21+9/test/lib/sun/hotspot/WhiteBox.java | 8 openjdk-11-11.0.21+9/test/lib/sun/hotspot/code/Compiler.java | 2 1371 files changed, 55373 insertions(+), 34364 deletions(-) diff -Nru openjdk-11-11.0.20+8/.jcheck/conf openjdk-11-11.0.21+9/.jcheck/conf --- openjdk-11-11.0.20+8/.jcheck/conf 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/.jcheck/conf 2023-10-06 05:33:33.000000000 +0000 @@ -1,7 +1,7 @@ [general] project=jdk-updates jbs=JDK -version=11.0.20 +version=11.0.21 [checks] error=author,committer,reviewers,merge,issues,executable,symlink,message,hg-tag,whitespace diff -Nru openjdk-11-11.0.20+8/debian/changelog openjdk-11-11.0.21+9/debian/changelog --- openjdk-11-11.0.20+8/debian/changelog 2023-07-23 19:23:09.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/changelog 2023-10-27 06:54:07.000000000 +0000 @@ -1,8 +1,44 @@ -openjdk-11 (11.0.20+8-1~deb11u1) bullseye-security; urgency=medium +openjdk-11 (11.0.21+9-1~deb11u1) bullseye-security; urgency=medium - * Rebuild for bullseye + * Backport to bullseye. - -- Moritz Muehlenhoff Sun, 23 Jul 2023 21:23:09 +0200 + -- Emilio Pozuelo Monfort Fri, 27 Oct 2023 08:54:07 +0200 + +openjdk-11 (11.0.21+9-1) unstable; urgency=high + + * OpenJDK 11.0.21 release, build 9. + - CVE-2023-22081. + - Release notes: + https://www.oracle.com/java/technologies/javase/11-0-21-relnotes.html#R11_0_21 + + [ Vladimir Petko ] + * d/test: update problemlist. + * d/p: drop exclude-broken-tests.patch. + * d/p/reproducible-properties-timestamp.diff: use the privileged action + to read the system property (JDK-8272157, 914278). + + [ Matthias Klose ] + * Build using GCC 13 on development versions. + + [ Pushkar Kulkarni ] + * Handle limited ECC capabilities of NSS on older releases. + + -- Matthias Klose Wed, 18 Oct 2023 09:28:04 +0200 + +openjdk-11 (11.0.21~4ea-1) unstable; urgency=medium + + * OpenJDK 11.0.21 release, build 4 (early access). + + [ Vladimir Petko ] + * d/copyright: remove liblcms from excluded files. + * Refresh patch for 11.0.21+2 ea. + * d/t/jtreg-autopkgtest.{sh,in}: JDK-8232153 - set NSS_DEFAULT_DB_TYPE + to let sun/security/pkcs11/Secmod/AddTrustedCert.java pass. + + [ Matthias Klose ] + * Explicitly configure --without-jtreg with the nocheck profile + + -- Matthias Klose Thu, 24 Aug 2023 12:53:49 +0200 openjdk-11 (11.0.20+8-1) unstable; urgency=high diff -Nru openjdk-11-11.0.20+8/debian/copyright openjdk-11-11.0.21+9/debian/copyright --- openjdk-11-11.0.20+8/debian/copyright 2023-06-13 05:42:33.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/copyright 2023-10-27 06:52:36.000000000 +0000 @@ -2,8 +2,6 @@ Files-Excluded: .github/* .gitattributes - src/java.desktop/share/native/liblcms/cms*.c - src/java.desktop/share/native/liblcms/lcms2*.h src/java.base/share/native/libzip/zlib/* src/java.desktop/share/native/libsplashscreen/giflib/* src/java.desktop/share/native/libsplashscreen/libpng/* diff -Nru openjdk-11-11.0.20+8/debian/patches/exclude-broken-tests.patch openjdk-11-11.0.21+9/debian/patches/exclude-broken-tests.patch --- openjdk-11-11.0.20+8/debian/patches/exclude-broken-tests.patch 2023-04-20 02:25:28.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/patches/exclude-broken-tests.patch 1970-01-01 00:00:00.000000000 +0000 @@ -1,121 +0,0 @@ - Description: Disable failing tests - Disable tests that fail on Ubuntu pending investigation -Author: Vladimir Petko -Forwarded: not-needed -Last-Update: 2023-03-24 ---- a/test/hotspot/jtreg/ProblemList.txt -+++ b/test/hotspot/jtreg/ProblemList.txt -@@ -38,6 +38,26 @@ - # - ############################################################################# - -+# tests that need to be investigated -+ -+gc/shenandoah/mxbeans/TestChurnNotifications.java#aggressive 0000000 generic-all -+gc/shenandoah/mxbeans/TestChurnNotifications.java#iu 0000000 generic-all -+ -+#result: Failed. Execution failed: `main' threw exception: java.io.IOException: Mount point not found -+# https://bugs.openjdk.org/browse/JDK-8166162 -+ -+runtime/LoadClass/LongBCP.java 8166162 generic-all -+ -+# Intermittent failures because LingeredApp.class is not found -+ -+runtime/cds/appcds/jcmd/JCmdTestDynamicDump.java 000000 generic-all -+runtime/cds/appcds/jcmd/JCmdTestFileSafety.java 000000 generic-all -+runtime/cds/appcds/jcmd/JCmdTestStaticDump.java 000000 generic-all -+ -+# Unexpected exit from the test -+ -+runtime/NMT/SafepointPollingPages.java 000000 generic-all -+ - # :hotspot_compiler - - compiler/aot/verification/vmflags/TrackedFlagTest.java 8215224 generic-all ---- a/test/langtools/ProblemList.txt -+++ b/test/langtools/ProblemList.txt -@@ -23,6 +23,32 @@ - # - ########################################################################### - -+# Wrong test environment in autopkgtest -+# java.lang.IllegalStateException: Launching JShell execution engine threw: ERROR: transport error 202: getaddrinfo: failed to parse address -+ -+jdk/jshell/JdiListeningLocalhostExecutionControlTest.java 0000000 generic-all -+ -+# tests failing due to disable-doclint-by-default.diff -+ -+jdk/javadoc/doclet/testSupplementary/TestSupplementary.java 0000000 generic-all -+jdk/javadoc/doclet/testPackageHtml/TestPackageHtml.java 0000000 generic-all -+jdk/javadoc/doclet/testSummaryTag/TestSummaryTag.java 0000000 generic-all -+jdk/javadoc/doclet/testStylesheet/TestStylesheet.java 0000000 generic-all -+jdk/javadoc/doclet/testSeeTag/TestSeeTag.java 0000000 generic-all -+jdk/javadoc/doclet/testRelativeLinks/TestRelativeLinks.java 0000000 generic-all -+jdk/javadoc/doclet/testBadHtml/TestBadHtml.java 0000000 generic-all -+jdk/javadoc/doclet/testParamTaglet/TestParamTaglet.java 0000000 generic-all -+jdk/javadoc/doclet/testNonInlineHtmlTagRemoval/TestNonInlineHtmlTagRemoval.java 0000000 generic-all -+jdk/javadoc/doclet/dupThrowsTags/TestDupThrowsTags.java 0000000 generic-all -+jdk/javadoc/doclet/testLinkOption/TestLinkOption.java 0000000 generic-all -+jdk/javadoc/doclet/T6735320/T6735320.java 0000000 generic-all -+jdk/javadoc/doclet/testValueTag/TestValueTag.java 0000000 generic-all -+jdk/javadoc/tool/modules/Modules.java 0000000 generic-all -+jdk/javadoc/doclet/testWarnings/TestWarnings.java 0000000 generic-all -+jdk/javadoc/doclet/testHtmlTableStyles/TestHtmlTableStyles.java 0000000 generic-all -+jdk/javadoc/tool/doclint/DocLintTest.java 0000000 generic-all -+jdk/javadoc/doclet/testBadPackageFileInJar/TestBadPackageFileInJar.java 0000000 generic-all -+ - ########################################################################### - # - # javadoc ---- a/test/jdk/ProblemList.txt -+++ b/test/jdk/ProblemList.txt -@@ -110,6 +110,49 @@ - # - ############################################################################# - -+ -+ -+# to investigate -+# unable to read LD_LIBRARY_PATH env variable -+ -+tools/jpackage/share/AppLauncherEnvTest.java 0000000 generic-all -+ -+# java.lang.Exception: Proc abnormal end -+ -+sun/security/krb5/auto/Cleaners.java 0000000 generic-all -+ -+# result: Failed. Execution failed: `main' threw exception: java.io.IOException: Mount point not found -+# https://bugs.openjdk.org/browse/JDK-8166162 -+ -+java/io/File/createTempFile/TargetDirectory.java 8166162 generic-all -+java/nio/file/Files/CheckPermissions.java 8166162 generic-all -+java/nio/file/Files/TemporaryFiles.java 8166162 generic-all -+java/nio/file/Files/Misc.java 8166162 generic-all -+java/nio/file/Files/CopyAndMove.java 8166162 generic-all -+java/nio/file/Files/InterruptCopy.java 8166162 generic-all -+java/nio/file/Files/FileAttributes.java 8166162 generic-all -+java/nio/file/attribute/BasicFileAttributeView/SetTimesNanos.java 8166162 generic-all -+java/nio/file/attribute/AclFileAttributeView/Basic.java 8166162 generic-all -+java/nio/file/attribute/DosFileAttributeView/Basic.java 8166162 generic-all -+java/nio/file/attribute/PosixFileAttributeView/Basic.java 8166162 generic-all -+java/nio/file/attribute/UserDefinedFileAttributeView/Basic.java 8166162 generic-all -+java/nio/file/FileStore/Basic.java 8166162 generic-all -+java/nio/channels/FileChannel/directio/DirectIOTest.java 8166162 generic-all -+java/nio/channels/FileChannel/directio/ReadDirect.java 8166162 generic-all -+java/nio/channels/FileChannel/directio/PreadDirect.java 8166162 generic-all -+java/nio/channels/FileChannel/directio/PwriteDirect.java 8166162 generic-all -+java/nio/channels/FileChannel/directio/WriteDirect.java 8166162 generic-all -+ -+# utf-8 locale is missing on build machine -+# https://bugs.openjdk.org/browse/JDK-8249079 -+ -+java/lang/invoke/lambda/LambdaFileEncodingSerialization.java 8249079 generic-all -+ -+# reproducible-properties-timestamp.diff introduce a bug that breaks this test -+# remove after the patch is dropped -+ -+java/util/logging/LogManager/Configuration/updateConfiguration/SimpleUpdateConfigWithInputStreamTest.java 000000 generic-all -+ - ############################################################################ - - # jdk_awt diff -Nru openjdk-11-11.0.20+8/debian/patches/nss-limited-ecc-tests.patch openjdk-11-11.0.21+9/debian/patches/nss-limited-ecc-tests.patch --- openjdk-11-11.0.20+8/debian/patches/nss-limited-ecc-tests.patch 1970-01-01 00:00:00.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/patches/nss-limited-ecc-tests.patch 2023-10-27 06:52:36.000000000 +0000 @@ -0,0 +1,48 @@ +--- a/test/jdk/sun/security/pkcs11/PKCS11Test.java ++++ b/test/jdk/sun/security/pkcs11/PKCS11Test.java +@@ -99,7 +99,7 @@ + // NSS version info + public static enum ECCState { None, Basic, Extended }; + static double nss_version = -1; +- static ECCState nss_ecc_status = ECCState.Extended; ++ static ECCState nss_ecc_status = ECCState.Basic; + + // The NSS library we need to search for in getNSSLibDir() + // Default is "libsoftokn3.so", listed as "softokn3" +--- a/test/jdk/sun/security/pkcs11/ec/TestECDH.java ++++ b/test/jdk/sun/security/pkcs11/ec/TestECDH.java +@@ -124,8 +124,12 @@ + return; + } + +- test(p, pub192a, priv192a, pub192b, priv192b, secret192); +- test(p, pub163a, priv163a, pub163b, priv163b, secret163); ++ if (getSupportedECParameterSpec("secp192r1", p).isPresent()) { ++ test(p, pub192a, priv192a, pub192b, priv192b, secret192); ++ } ++ if (getSupportedECParameterSpec("sect163r1", p).isPresent()) { ++ test(p, pub163a, priv163a, pub163b, priv163b, secret163); ++ } + + if (getSupportedECParameterSpec("brainpoolP256r1", p).isPresent()) { + test(p, pubBrainpoolP256r1a, privBrainpoolP256r1a, pubBrainpoolP256r1b, privBrainpoolP256r1b, secretBrainpoolP256r1); +--- a/test/jdk/sun/security/pkcs11/ec/TestECDSA.java ++++ b/test/jdk/sun/security/pkcs11/ec/TestECDSA.java +@@ -156,12 +156,14 @@ + return; + } + +- if (getNSSECC() != ECCState.Basic) { ++ if (getSupportedECParameterSpec("secp192r1", provider).isPresent()) { + test(provider, pub192, priv192, sig192); ++ } ++ if (getSupportedECParameterSpec("sect163r1", provider).isPresent()) { + test(provider, pub163, priv163, sig163); ++ } ++ if (getSupportedECParameterSpec("sect571r1", provider).isPresent()) { + test(provider, pub571, priv571, sig571); +- } else { +- System.out.println("ECC Basic only, skipping 192, 163 and 571."); + } + test(provider, pub521, priv521, sig521); + diff -Nru openjdk-11-11.0.20+8/debian/patches/reproducible-properties-timestamp.diff openjdk-11-11.0.21+9/debian/patches/reproducible-properties-timestamp.diff --- openjdk-11-11.0.20+8/debian/patches/reproducible-properties-timestamp.diff 2023-04-20 02:25:28.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/patches/reproducible-properties-timestamp.diff 2023-10-27 06:52:36.000000000 +0000 @@ -3,7 +3,17 @@ Forwarded: no --- a/src/java.base/share/classes/java/util/Properties.java +++ b/src/java.base/share/classes/java/util/Properties.java -@@ -929,7 +929,7 @@ +@@ -53,6 +53,9 @@ + import sun.nio.cs.UTF_8; + import sun.nio.cs.ISO_8859_1; + ++import java.security.AccessController; ++import java.security.PrivilegedAction; ++ + /** + * The {@code Properties} class represents a persistent set of + * properties. The {@code Properties} can be saved to a stream +@@ -929,7 +932,7 @@ if (comments != null) { writeComments(bw, comments); } @@ -12,7 +22,7 @@ bw.newLine(); synchronized (this) { for (Map.Entry e : entrySet()) { -@@ -1579,4 +1579,22 @@ +@@ -1579,4 +1582,27 @@ } this.map = map; } @@ -23,14 +33,19 @@ + * environment variable is specified. In this case the format used is + * locale and timezone insensitive to ensure the output is reproducible. + */ ++ @SuppressWarnings("removal") + private String getFormattedTimestamp() { -+ if (System.getenv("SOURCE_DATE_EPOCH") == null) { ++ String epoch = AccessController.doPrivileged(new PrivilegedAction(){ ++ public String run() { return System.getenv("SOURCE_DATE_EPOCH"); } ++ }); ++ ++ if (epoch == null) { + return new Date().toString(); + } else { + // Use the SOURCE_DATE_EPOCH timestamp and make the format locale/timezone insensitive + java.text.SimpleDateFormat fmt = new java.text.SimpleDateFormat("yyyy-MM-dd HH:mm:ss z", java.util.Locale.ENGLISH); + fmt.setTimeZone(java.util.TimeZone.getTimeZone("UTC")); -+ Date date = new Date(1000 * Long.parseLong(System.getenv("SOURCE_DATE_EPOCH"))); ++ Date date = new Date(1000 * Long.parseLong(epoch)); + return fmt.format(date); + } + } diff -Nru openjdk-11-11.0.20+8/debian/patches/series openjdk-11-11.0.21+9/debian/patches/series --- openjdk-11-11.0.20+8/debian/patches/series 2023-04-20 02:25:28.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/patches/series 2023-10-27 06:52:36.000000000 +0000 @@ -38,4 +38,4 @@ update-permission-test.patch ldap-timeout-test-use-ip.patch test-use-ip-address.patch -exclude-broken-tests.patch +nss-limited-ecc-tests.patch diff -Nru openjdk-11-11.0.20+8/debian/rules openjdk-11-11.0.21+9/debian/rules --- openjdk-11-11.0.20+8/debian/rules 2023-07-19 06:40:22.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/rules 2023-10-27 06:52:36.000000000 +0000 @@ -78,6 +78,7 @@ endif is_upstream_release = yes +#is_upstream_release = srcdir = . builddir = build @@ -335,10 +336,14 @@ export CC = $(DEB_HOST_GNU_TYPE)-gcc-11 export CXX = $(DEB_HOST_GNU_TYPE)-g++-11 bd_gcc = g++-11 , -else +else ifneq (,$(filter $(distrel),bookworm lunar)) export CC = $(DEB_HOST_GNU_TYPE)-gcc-12 export CXX = $(DEB_HOST_GNU_TYPE)-g++-12 bd_gcc = g++-12 , +else + export CC = $(DEB_HOST_GNU_TYPE)-gcc-13 + export CXX = $(DEB_HOST_GNU_TYPE)-g++-13 + bd_gcc = g++-13 , endif # until we are able to b-d on gcc-for-host ... @@ -1878,8 +1883,9 @@ dh_builddeb -a $(nodemo) $(nojrez) #$(bd_options) is_release = yes +#is_release = git_project = jdk11u -git_tag = jdk-11.0.20+8 +git_tag = jdk-11.0.21+9 package_version = $(subst jdk-,,$(git_tag)) package_version = $(shell echo $(PKGVERSION) | sed 's/-[^-][^-]*$$//') ifneq ($(is_release),yes) diff -Nru openjdk-11-11.0.20+8/debian/tests/hotspot openjdk-11-11.0.21+9/debian/tests/hotspot --- openjdk-11-11.0.20+8/debian/tests/hotspot 2023-04-20 02:25:28.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/tests/hotspot 2023-10-27 06:52:36.000000000 +0000 @@ -4,13 +4,8 @@ set -o pipefail set -o nounset -problem_list=${AUTOPKGTEST_TMP}/hotspot-problems.txt -cat test/hotspot/jtreg/ProblemList.txt > ${problem_list} - -host_arch="${DEB_HOST_ARCH:-$(dpkg --print-architecture)}" -if [[ -f debian/tests/problems-${host_arch}.txt ]]; then - cat debian/tests/problems-${host_arch}.txt >> ${problem_list} -fi +problem_list=${AUTOPKGTEST_TMP}/problems.txt +debian/tests/write-problems ${problem_list} test/hotspot/jtreg/ProblemList.txt hotspot native_path=$(pwd)/build/images/test/hotspot/jtreg/native debian/tests/jtreg-autopkgtest.sh hotspot \ diff -Nru openjdk-11-11.0.20+8/debian/tests/jaxp openjdk-11-11.0.21+9/debian/tests/jaxp --- openjdk-11-11.0.20+8/debian/tests/jaxp 2023-04-20 02:25:28.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/tests/jaxp 2023-10-27 06:52:36.000000000 +0000 @@ -4,10 +4,12 @@ set -o pipefail set -o nounset +problem_list=${AUTOPKGTEST_TMP}/problems.txt +debian/tests/write-problems ${problem_list} test/jaxp/ProblemList.txt jaxp + debian/tests/jtreg-autopkgtest.sh jaxp \ - -exclude:test/jaxp/ProblemList.txt \ + -exclude:${problem_list} \ -dir:test/jaxp \ -k:!stress \ :tier1 :tier2 - debian/tests/jtdiff-autopkgtest.sh jaxp diff -Nru openjdk-11-11.0.20+8/debian/tests/jdk openjdk-11-11.0.21+9/debian/tests/jdk --- openjdk-11-11.0.20+8/debian/tests/jdk 2023-04-20 02:25:28.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/tests/jdk 2023-10-27 06:52:36.000000000 +0000 @@ -4,6 +4,7 @@ set -o pipefail set -o nounset + cleanup() { # kill window manager to clean up (rest will exit automatically) pid="$(jobs -p)" @@ -25,13 +26,8 @@ debian/tests/start-xvfb.sh 10 & sleep 3 -problem_list=${AUTOPKGTEST_TMP}/jdk-problems.txt -cat test/jdk/ProblemList.txt > ${problem_list} - -host_arch="${DEB_HOST_ARCH:-$(dpkg --print-architecture)}" -if [[ -f debian/tests/problems-${host_arch}.txt ]]; then - cat debian/tests/problems-${host_arch}.txt >> ${problem_list} -fi +problem_list=${AUTOPKGTEST_TMP}/problems.txt +debian/tests/write-problems ${problem_list} test/jdk/ProblemList.txt jdk native_path=$(pwd)/build/images/test/jdk/jtreg/native debian/tests/jtreg-autopkgtest.sh jdk \ diff -Nru openjdk-11-11.0.20+8/debian/tests/jtreg-autopkgtest.in openjdk-11-11.0.21+9/debian/tests/jtreg-autopkgtest.in --- openjdk-11-11.0.20+8/debian/tests/jtreg-autopkgtest.in 2023-04-20 02:25:28.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/tests/jtreg-autopkgtest.in 2023-10-27 06:52:36.000000000 +0000 @@ -32,7 +32,7 @@ if dpkg --compare-versions ${jtreg_version} ge 4.2; then jt_options+=" -conc:auto" fi - + # check java binary if [ ! -x "${JDK_TO_TEST}/bin/java" ]; then echo "Error: '${JDK_TO_TEST}/bin/java' is not an executable." >&2 @@ -104,6 +104,9 @@ -jdk:${JDK_TO_TEST} \ -vmoption:-Dtest.boot.jdk=${BOOTJDK_HOME} \ -vmoption:-XX:MaxRAMPercentage=25 \ + -vmoption:-Duser.home=${AUTOPKGTEST_TMP} \ + -vmoption:-Djava.io.tmpdir=${AUTOPKGTEST_TMP} \ + -e:NSS_DEFAULT_DB_TYPE=sql \ ${on_retry:-} $@ \ && exit_code=0 || exit_code=$? diff -Nru openjdk-11-11.0.20+8/debian/tests/jtreg-autopkgtest.sh openjdk-11-11.0.21+9/debian/tests/jtreg-autopkgtest.sh --- openjdk-11-11.0.20+8/debian/tests/jtreg-autopkgtest.sh 2023-04-20 02:25:28.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/tests/jtreg-autopkgtest.sh 2023-10-27 06:52:36.000000000 +0000 @@ -109,7 +109,10 @@ -reportDir:"${report_dir}" \ -jdk:${JDK_TO_TEST} \ -vmoption:-Dtest.boot.jdk=${BOOTJDK_HOME} \ + -vmoption:-Duser.home=${AUTOPKGTEST_TMP} \ + -vmoption:-Djava.io.tmpdir=${AUTOPKGTEST_TMP} \ -vmoption:-XX:MaxRAMPercentage=25 \ + -e:NSS_DEFAULT_DB_TYPE=sql \ ${on_retry:-} $@ \ && exit_code=0 || exit_code=$? diff -Nru openjdk-11-11.0.20+8/debian/tests/langtools openjdk-11-11.0.21+9/debian/tests/langtools --- openjdk-11-11.0.20+8/debian/tests/langtools 2023-04-20 02:25:28.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/tests/langtools 2023-10-27 06:52:36.000000000 +0000 @@ -4,10 +4,12 @@ set -o pipefail set -o nounset +problem_list=${AUTOPKGTEST_TMP}/problems.txt +debian/tests/write-problems ${problem_list} test/langtools/ProblemList.txt langtools + debian/tests/jtreg-autopkgtest.sh langtools \ - -exclude:test/langtools/ProblemList.txt \ - -dir:test/langtools \ + -exclude:${problem_list} \ + -dir:test/langtools \ -k:!stress \ :tier1 :tier2 - debian/tests/jtdiff-autopkgtest.sh langtools diff -Nru openjdk-11-11.0.20+8/debian/tests/problems-armhf.txt openjdk-11-11.0.21+9/debian/tests/problems-armhf.txt --- openjdk-11-11.0.20+8/debian/tests/problems-armhf.txt 2023-04-20 02:25:28.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/tests/problems-armhf.txt 2023-10-27 06:52:36.000000000 +0000 @@ -18,5 +18,20 @@ # this test passes but is very slow in CI, causing timeout jdk/sun/security/rsa/SignedObjectChain.java 000000 generic-all +sun/security/rsa/SignedObjectChain.java 000000 generic-all sun/security/ec/ed/EdDSATest.java 000000 generic-all -java/security/SignedObject/Chain.java 000000 generic-all \ No newline at end of file +java/security/SignedObject/Chain.java 000000 generic-all + +# timeout in SSL connection +java/net/httpclient/ManyRequestsLegacy.java 000000 generic-all +# deadlock +java/util/Random/RandomTestBsi1999.java 000000 generic-all + +# runner issue, disk space size exceeds 32 bit integer +java/io/File/GetXSpace.java 000000 generic-all + +# https://bugs.openjdk.org/browse/JDK-8303168 +serviceability/AsyncGetCallTrace/MyPackage/ASGCTBaseTest.java 000000 generic-all + +# native stack not implemented +runtime/jni/nativeStack/TestNativeStack.java 000000 generic-all diff -Nru openjdk-11-11.0.20+8/debian/tests/problems-hotspot.txt openjdk-11-11.0.21+9/debian/tests/problems-hotspot.txt --- openjdk-11-11.0.20+8/debian/tests/problems-hotspot.txt 1970-01-01 00:00:00.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/tests/problems-hotspot.txt 2023-10-27 06:52:36.000000000 +0000 @@ -0,0 +1,21 @@ +# tests that need to be investigated + +gc/shenandoah/mxbeans/TestChurnNotifications.java#aggressive 0000000 generic-all +gc/shenandoah/mxbeans/TestChurnNotifications.java#iu 0000000 generic-all + +#result: Failed. Execution failed: `main' threw exception: java.io.IOException: Mount point not found +# https://bugs.openjdk.org/browse/JDK-8166162 + +runtime/LoadClass/LongBCP.java 8166162 generic-all + +# flaky test +compiler/vectorization/runner/MultipleLoopsTest.java 000000 generic-all + +# Intermittent failures because LingeredApp.class is not found +runtime/cds/appcds/jcmd/JCmdTestDynamicDump.java 000000 generic-all +runtime/cds/appcds/jcmd/JCmdTestFileSafety.java 000000 generic-all +runtime/cds/appcds/jcmd/JCmdTestStaticDump.java 000000 generic-all + +# Unexpected exit from the test +runtime/NMT/SafepointPollingPages.java 000000 generic-all + diff -Nru openjdk-11-11.0.20+8/debian/tests/problems-i386.txt openjdk-11-11.0.21+9/debian/tests/problems-i386.txt --- openjdk-11-11.0.20+8/debian/tests/problems-i386.txt 2023-04-20 02:25:28.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/tests/problems-i386.txt 2023-10-27 06:52:36.000000000 +0000 @@ -13,3 +13,6 @@ tools/jlink/JLinkTest.java 000000 generic-all java/net/httpclient/http2/HpackBinaryTestDriver.java 000000 generic-all + +# runner issue, disk space size exceeds 32 bit integer +java/io/File/GetXSpace.java 000000 generic-all diff -Nru openjdk-11-11.0.20+8/debian/tests/problems-jdk.txt openjdk-11-11.0.21+9/debian/tests/problems-jdk.txt --- openjdk-11-11.0.20+8/debian/tests/problems-jdk.txt 1970-01-01 00:00:00.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/tests/problems-jdk.txt 2023-10-27 06:52:36.000000000 +0000 @@ -0,0 +1,45 @@ +# NSS3 failure when processing SHA3 hashes (needs investigation) +sun/security/pkcs11/Signature/KeyAndParamCheckForPSS.java 0000000 generic-all +sun/security/pkcs11/MessageDigest/TestCloning.java 0000000 generic-all +sun/security/pkcs11/Signature/SignatureTestPSS.java 0000000 generic-all + +# https://bugs.openjdk.org/browse/JDK-8312488 +tools/jpackage/share/AppLauncherEnvTest.java 0000000 generic-all + +# java.lang.Exception: Proc abnormal end +sun/security/krb5/auto/Cleaners.java 0000000 generic-all + +# result: Failed. Execution failed: `main' threw exception: java.io.IOException: Mount point not found +# https://bugs.openjdk.org/browse/JDK-8166162 + +java/io/File/createTempFile/TargetDirectory.java 8166162 generic-all +java/nio/file/Files/CheckPermissions.java 8166162 generic-all +java/nio/file/Files/TemporaryFiles.java 8166162 generic-all +java/nio/file/Files/Misc.java 8166162 generic-all +java/nio/file/Files/CopyAndMove.java 8166162 generic-all +java/nio/file/Files/InterruptCopy.java 8166162 generic-all +java/nio/file/Files/FileAttributes.java 8166162 generic-all +java/nio/file/attribute/BasicFileAttributeView/SetTimesNanos.java 8166162 generic-all +java/nio/file/attribute/AclFileAttributeView/Basic.java 8166162 generic-all +java/nio/file/attribute/DosFileAttributeView/Basic.java 8166162 generic-all +java/nio/file/attribute/PosixFileAttributeView/Basic.java 8166162 generic-all +java/nio/file/attribute/UserDefinedFileAttributeView/Basic.java 8166162 generic-all +java/nio/file/FileStore/Basic.java 8166162 generic-all +java/nio/channels/FileChannel/directio/DirectIOTest.java 8166162 generic-all +java/nio/channels/FileChannel/directio/ReadDirect.java 8166162 generic-all +java/nio/channels/FileChannel/directio/PreadDirect.java 8166162 generic-all +java/nio/channels/FileChannel/directio/PwriteDirect.java 8166162 generic-all +java/nio/channels/FileChannel/directio/WriteDirect.java 8166162 generic-all + +# utf-8 locale is missing on build machine +# https://bugs.openjdk.org/browse/JDK-8249079 + +java/lang/invoke/lambda/LambdaFileEncodingSerialization.java 8249079 generic-all + +# disable scoped value (incubating feature) test pending investigation + +jdk/incubator/concurrent/ScopedValue/StressStackOverflow.java 000000 generic-all +java/lang/ScopedValue/StressStackOverflow.java 000000 generic-all + +# https://bugs.openjdk.org/browse/JDK-8309214 +sun/security/pkcs11/KeyStore/CertChainRemoval.java 000000 generic-all diff -Nru openjdk-11-11.0.20+8/debian/tests/problems-langtools.txt openjdk-11-11.0.21+9/debian/tests/problems-langtools.txt --- openjdk-11-11.0.20+8/debian/tests/problems-langtools.txt 1970-01-01 00:00:00.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/tests/problems-langtools.txt 2023-10-27 06:52:36.000000000 +0000 @@ -0,0 +1,24 @@ +# Wrong test environment in autopkgtest +# java.lang.IllegalStateException: Launching JShell execution engine threw: ERROR: transport error 202: getaddrinfo: failed to parse address +jdk/jshell/JdiListeningLocalhostExecutionControlTest.java 0000000 generic-all + +# tests failing due to disable-doclint-by-default.diff + +jdk/javadoc/doclet/testSupplementary/TestSupplementary.java 0000000 generic-all +jdk/javadoc/doclet/testPackageHtml/TestPackageHtml.java 0000000 generic-all +jdk/javadoc/doclet/testSummaryTag/TestSummaryTag.java 0000000 generic-all +jdk/javadoc/doclet/testStylesheet/TestStylesheet.java 0000000 generic-all +jdk/javadoc/doclet/testSeeTag/TestSeeTag.java 0000000 generic-all +jdk/javadoc/doclet/testRelativeLinks/TestRelativeLinks.java 0000000 generic-all +jdk/javadoc/doclet/testBadHtml/TestBadHtml.java 0000000 generic-all +jdk/javadoc/doclet/testParamTaglet/TestParamTaglet.java 0000000 generic-all +jdk/javadoc/doclet/testNonInlineHtmlTagRemoval/TestNonInlineHtmlTagRemoval.java 0000000 generic-all +jdk/javadoc/doclet/dupThrowsTags/TestDupThrowsTags.java 0000000 generic-all +jdk/javadoc/doclet/testLinkOption/TestLinkOption.java 0000000 generic-all +jdk/javadoc/doclet/T6735320/T6735320.java 0000000 generic-all +jdk/javadoc/doclet/testValueTag/TestValueTag.java 0000000 generic-all +jdk/javadoc/tool/modules/Modules.java 0000000 generic-all +jdk/javadoc/doclet/testWarnings/TestWarnings.java 0000000 generic-all +jdk/javadoc/doclet/testHtmlTableStyles/TestHtmlTableStyles.java 0000000 generic-all +jdk/javadoc/tool/doclint/DocLintTest.java 0000000 generic-all +jdk/javadoc/doclet/testBadPackageFileInJar/TestBadPackageFileInJar.java 0000000 generic-all diff -Nru openjdk-11-11.0.20+8/debian/tests/problems-s390x.txt openjdk-11-11.0.21+9/debian/tests/problems-s390x.txt --- openjdk-11-11.0.20+8/debian/tests/problems-s390x.txt 1970-01-01 00:00:00.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/tests/problems-s390x.txt 2023-10-27 06:52:36.000000000 +0000 @@ -0,0 +1,3 @@ +# https://bugs.openjdk.org/browse/JDK-8309698 +runtime/NMT/VirtualAllocCommitMerge.java 000000 generic-all + diff -Nru openjdk-11-11.0.20+8/debian/tests/write-problems openjdk-11-11.0.21+9/debian/tests/write-problems --- openjdk-11-11.0.20+8/debian/tests/write-problems 1970-01-01 00:00:00.000000000 +0000 +++ openjdk-11-11.0.21+9/debian/tests/write-problems 2023-10-27 06:52:36.000000000 +0000 @@ -0,0 +1,25 @@ +#!/bin/bash + +problem_list=$1 +upstream_problems=$2 +suite=$3 + +cat ${upstream_problems} > ${problem_list} + +if [[ -f debian/tests/problems-${suite}.txt ]]; then + cat debian/tests/problems-${suite}.txt >> ${problem_list} +fi + +distrel=`lsb_release --codename --short` +if [[ -f debian/tests/problems-${distrel}.txt ]]; then + cat debian/tests/problems-${distrel}.txt >> ${problem_list} +fi + +host_arch="${DEB_HOST_ARCH:-$(dpkg --print-architecture)}" +if [[ -f debian/tests/problems-${host_arch}.txt ]]; then + cat debian/tests/problems-${host_arch}.txt >> ${problem_list} +fi + +if [[ -f debian/tests/problems-${distrel}-${host_arch}.txt ]]; then + cat debian/tests/problems-${distrel}-${host_arch}.txt >> ${problem_list} +fi diff -Nru openjdk-11-11.0.20+8/make/autoconf/hotspot.m4 openjdk-11-11.0.21+9/make/autoconf/hotspot.m4 --- openjdk-11-11.0.20+8/make/autoconf/hotspot.m4 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/make/autoconf/hotspot.m4 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ # -# Copyright (c) 2011, 2021, Oracle and/or its affiliates. All rights reserved. +# Copyright (c) 2011, 2023, Oracle and/or its affiliates. All rights reserved. # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. # # This code is free software; you can redistribute it and/or modify it @@ -165,8 +165,11 @@ DTRACE_DEP_MISSING=false - AC_MSG_CHECKING([for dtrace tool]) - if test "x$DTRACE" != "x" && test -x "$DTRACE"; then + AC_MSG_CHECKING([for dtrace tool and platform support]) + if test "x$OPENJDK_TARGET_CPU_ARCH" = "xppc"; then + AC_MSG_RESULT([no, $OPENJDK_TARGET_CPU_ARCH]) + DTRACE_DEP_MISSING=true + elif test "x$DTRACE" != "x" && test -x "$DTRACE"; then AC_MSG_RESULT([$DTRACE]) else AC_MSG_RESULT([not found, cannot build dtrace]) diff -Nru openjdk-11-11.0.20+8/make/autoconf/version-numbers openjdk-11-11.0.21+9/make/autoconf/version-numbers --- openjdk-11-11.0.20+8/make/autoconf/version-numbers 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/make/autoconf/version-numbers 2023-10-06 05:33:33.000000000 +0000 @@ -28,12 +28,12 @@ DEFAULT_VERSION_FEATURE=11 DEFAULT_VERSION_INTERIM=0 -DEFAULT_VERSION_UPDATE=20 +DEFAULT_VERSION_UPDATE=21 DEFAULT_VERSION_PATCH=0 DEFAULT_VERSION_EXTRA1=0 DEFAULT_VERSION_EXTRA2=0 DEFAULT_VERSION_EXTRA3=0 -DEFAULT_VERSION_DATE=2023-07-18 +DEFAULT_VERSION_DATE=2023-10-17 DEFAULT_VERSION_CLASSFILE_MAJOR=55 # "`$EXPR $DEFAULT_VERSION_FEATURE + 44`" DEFAULT_VERSION_CLASSFILE_MINOR=0 DEFAULT_ACCEPTABLE_BOOT_VERSIONS="10 11" diff -Nru openjdk-11-11.0.20+8/make/data/cacerts/certignarootca openjdk-11-11.0.21+9/make/data/cacerts/certignarootca --- openjdk-11-11.0.20+8/make/data/cacerts/certignarootca 1970-01-01 00:00:00.000000000 +0000 +++ openjdk-11-11.0.21+9/make/data/cacerts/certignarootca 2023-10-06 05:33:33.000000000 +0000 @@ -0,0 +1,43 @@ +Owner: CN=Certigna Root CA, OU=0002 48146308100036, O=Dhimyotis, C=FR +Issuer: CN=Certigna Root CA, OU=0002 48146308100036, O=Dhimyotis, C=FR +Serial number: cae91b89f155030da3e6416dc4e3a6e1 +Valid from: Tue Oct 01 08:32:27 GMT 2013 until: Sat Oct 01 08:32:27 GMT 2033 +Signature algorithm name: SHA256withRSA +Subject Public Key Algorithm: 4096-bit RSA key +Version: 3 +-----BEGIN CERTIFICATE----- +MIIGWzCCBEOgAwIBAgIRAMrpG4nxVQMNo+ZBbcTjpuEwDQYJKoZIhvcNAQELBQAw +WjELMAkGA1UEBhMCRlIxEjAQBgNVBAoMCURoaW15b3RpczEcMBoGA1UECwwTMDAw +MiA0ODE0NjMwODEwMDAzNjEZMBcGA1UEAwwQQ2VydGlnbmEgUm9vdCBDQTAeFw0x +MzEwMDEwODMyMjdaFw0zMzEwMDEwODMyMjdaMFoxCzAJBgNVBAYTAkZSMRIwEAYD +VQQKDAlEaGlteW90aXMxHDAaBgNVBAsMEzAwMDIgNDgxNDYzMDgxMDAwMzYxGTAX +BgNVBAMMEENlcnRpZ25hIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw +ggIKAoICAQDNGDllGlmx6mQWDoyUJJV8g9PFOSbcDO8WV43X2KyjQn+Cyu3NW9sO +ty3tRQgXstmzy9YXUnIo245Onoq2C/mehJpNdt4iKVzSs9IGPjA5qXSjklYcoW9M +CiBtnyN6tMbaLOQdLNyzKNAT8kxOAkmhVECe5uUFoC2EyP+YbNDrihqECB63aCPu +I9Vwzm1RaRDuoXrC0SIxwoKF0vJVdlB8JXrJhFwLrN1CTivngqIkicuQstDuI7pm +TLtipPlTWmR7fJj6o0ieD5Wupxj0auwuA0Wv8HT4Ks16XdG+RCYyKfHx9WzMfgIh +C59vpD++nVPiz32pLHxYGpfhPTc3GGYo0kDFUYqMwy3OU4gkWGQwFsWq4NYKpkDf +ePb1BHxpE4S80dGnBs8B92jAqFe7OmGtBIyT46388NtEbVncSVmurJqZNjBBe3Yz +IoejwpKGbvlw7q6Hh5UbxHq9MfPU0uWZ/75I7HX1eBYdpnDBfzwboZL7z8g81sWT +Co/1VTp2lc5ZmIoJlXcymoO6LAQ6l73UL77XbJuiyn1tJslV1c/DeVIICZkHJC1k +JWumIWmbat10TWuXekG9qxf5kBdIjzb5LdXF2+6qhUVB+s06RbFo5jZMm5BX7CO5 +hwjCxAnxl4YqKE3idMDaxIzb3+KhF1nOJFl0Mdp//TBt2dzhauH8XwIDAQABo4IB +GjCCARYwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYE +FBiHVuBud+4kNTxOc5of1uHieX4rMB8GA1UdIwQYMBaAFBiHVuBud+4kNTxOc5of +1uHieX4rMEQGA1UdIAQ9MDswOQYEVR0gADAxMC8GCCsGAQUFBwIBFiNodHRwczov +L3d3d3cuY2VydGlnbmEuZnIvYXV0b3JpdGVzLzBtBgNVHR8EZjBkMC+gLaArhilo +dHRwOi8vY3JsLmNlcnRpZ25hLmZyL2NlcnRpZ25hcm9vdGNhLmNybDAxoC+gLYYr +aHR0cDovL2NybC5kaGlteW90aXMuY29tL2NlcnRpZ25hcm9vdGNhLmNybDANBgkq +hkiG9w0BAQsFAAOCAgEAlLieT/DjlQgi581oQfccVdV8AOItOoldaDgvUSILSo3L +6btdPrtcPbEo/uRTVRPPoZAbAh1fZkYJMyjhDSSXcNMQH+pkV5a7XdrnxIxPTGRG +HVyH41neQtGbqH6mid2PHMkwgu07nM3A6RngatgCdTer9zQoKJHyBApPNeNgJgH6 +0BGM+RFq7q89w1DTj18zeTyGqHNFkIwgtnJzFyO+B2XleJINugHA64wcZr+shncB +lA2c5uk5jR+mUYyZDDl34bSb+hxnV29qao6pK0xXeXpXIs/NX2NGjVxZOob4Mkdi +o2cNGJHc+6Zr9UhhcyNZjgKnvETq9Emd8VRY+WCv2hikLyhF3HqgiIZd8zvn/yk1 +gPxkQ5Tm4xxvvq0OKmOZK8l+hfZx6AYDlf7ej0gcWtSS6Cvu5zHbugRqh5jnxV/v +faci9wHYTfmJ0A6aBVmknpjZbyvKcL5kwlWj9Omvw5Ip3IgWJJk8jSaYtlu3zM63 +Nwf9JtmYhST/WSMDmu2dnajkXjjO11INb9I/bbEFa0nOipFGc/T2L/Coc3cOZayh +jWZSaX5LaAzHHjcng6WMxwLkFM1JAbBzs/3GkDpv0mztO+7skb6iQ12LAEpmJURw +3kAP+HwV96LOPNdeE4yBFxgX0b3xdxA61GU5wSesVywlVP+i2k+KYTlerj1KjL0= +-----END CERTIFICATE----- diff -Nru openjdk-11-11.0.20+8/make/data/cacerts/secomscrootca1 openjdk-11-11.0.21+9/make/data/cacerts/secomscrootca1 --- openjdk-11-11.0.20+8/make/data/cacerts/secomscrootca1 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/make/data/cacerts/secomscrootca1 1970-01-01 00:00:00.000000000 +0000 @@ -1,27 +0,0 @@ -Owner: OU=Security Communication RootCA1, O=SECOM Trust.net, C=JP -Issuer: OU=Security Communication RootCA1, O=SECOM Trust.net, C=JP -Serial number: 0 -Valid from: Tue Sep 30 04:20:49 GMT 2003 until: Sat Sep 30 04:20:49 GMT 2023 -Signature algorithm name: SHA1withRSA -Subject Public Key Algorithm: 2048-bit RSA key -Version: 3 ------BEGIN CERTIFICATE----- -MIIDWjCCAkKgAwIBAgIBADANBgkqhkiG9w0BAQUFADBQMQswCQYDVQQGEwJKUDEY -MBYGA1UEChMPU0VDT00gVHJ1c3QubmV0MScwJQYDVQQLEx5TZWN1cml0eSBDb21t -dW5pY2F0aW9uIFJvb3RDQTEwHhcNMDMwOTMwMDQyMDQ5WhcNMjMwOTMwMDQyMDQ5 -WjBQMQswCQYDVQQGEwJKUDEYMBYGA1UEChMPU0VDT00gVHJ1c3QubmV0MScwJQYD -VQQLEx5TZWN1cml0eSBDb21tdW5pY2F0aW9uIFJvb3RDQTEwggEiMA0GCSqGSIb3 -DQEBAQUAA4IBDwAwggEKAoIBAQCzs/5/022x7xZ8V6UMbXaKL0u/ZPtM7orw8yl8 -9f/uKuDp6bpbZCKamm8sOiZpUQWZJtzVHGpxxpp9Hp3dfGzGjGdnSj74cbAZJ6kJ -DKaVv0uMDPpVmDvY6CKhS3E4eayXkmmziX7qIWgGmBSWh9JhNrxtJ1aeV+7AwFb9 -Ms+k2Y7CI9eNqPPYJayX5HA49LY6tJ07lyZDo6G8SVlyTCMwhwFY9k6+HGhWZq/N -QV3Is00qVUarH9oe4kA92819uZKAnDfdDJZkndwi92SL32HeFZRSFaB9UslLqCHJ -xrHty8OVYNEP8Ktw+N/LTX7s1vqr2b1/VPKl6Xn62dZ2JChzAgMBAAGjPzA9MB0G -A1UdDgQWBBSgc0mZaNyFW2XjmygvV5+9M7wHSDALBgNVHQ8EBAMCAQYwDwYDVR0T -AQH/BAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAaECpqLvkT115swW1F7NgE+vG -kl3g0dNq/vu+m22/xwVtWSDEHPC32oRYAmP6SBbvT6UL90qY8j+eG61Ha2POCEfr -Uj94nK9NrvjVT8+amCoQQTlSxN3Zmw7vkwGusi7KaEIkQmywszo+zenaSMQVy+n5 -Bw+SUEmK3TGXX8npN6o7WWWXlDLJs58+OmJYxUmtYg5xpTKqL8aJdkNAExNnPaJU -JRDL8Try2frbSVa7pv6nQTXD4IhhyYjH3zYQIphZ6rBK+1YWc26sTfcioU+tHXot -RSflMMFe8toTyyVCUZVHA4xsIcx0Qu1T/zOLjw9XARYvz6buyXAiFL39vmwLAw== ------END CERTIFICATE----- diff -Nru openjdk-11-11.0.20+8/make/data/publicsuffixlist/VERSION openjdk-11-11.0.21+9/make/data/publicsuffixlist/VERSION --- openjdk-11-11.0.20+8/make/data/publicsuffixlist/VERSION 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/make/data/publicsuffixlist/VERSION 2023-10-06 05:33:33.000000000 +0000 @@ -1,2 +1,2 @@ -Github: https://raw.githubusercontent.com/publicsuffix/list/3c213aab32b3c014f171b1673d4ce9b5cd72bf1c/public_suffix_list.dat -Date: 2021-11-27 +Github: https://raw.githubusercontent.com/publicsuffix/list/88467c960d6cdad2ca1623e892e5e17506bc269f/public_suffix_list.dat +Date: 2023-04-14 diff -Nru openjdk-11-11.0.20+8/make/data/publicsuffixlist/public_suffix_list.dat openjdk-11-11.0.21+9/make/data/publicsuffixlist/public_suffix_list.dat --- openjdk-11-11.0.20+8/make/data/publicsuffixlist/public_suffix_list.dat 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/make/data/publicsuffixlist/public_suffix_list.dat 2023-10-06 05:33:33.000000000 +0000 @@ -9,7 +9,7 @@ // ===BEGIN ICANN DOMAINS=== -// ac : https://en.wikipedia.org/wiki/.ac +// ac : http://nic.ac/rules.htm ac com.ac edu.ac @@ -22,8 +22,7 @@ ad nom.ad -// ae : https://en.wikipedia.org/wiki/.ae -// see also: "Domain Name Eligibility Policy" at http://www.aeda.ae/eng/aepolicy.php +// ae : https://tdra.gov.ae/en/aeda/ae-policies ae co.ae net.ae @@ -381,11 +380,29 @@ // biz : https://en.wikipedia.org/wiki/.biz biz -// bj : https://en.wikipedia.org/wiki/.bj +// bj : https://nic.bj/bj-suffixes.txt +// submitted by registry bj -asso.bj -barreau.bj -gouv.bj +africa.bj +agro.bj +architectes.bj +assur.bj +avocats.bj +co.bj +com.bj +eco.bj +econo.bj +edu.bj +info.bj +loisirs.bj +money.bj +net.bj +org.bj +ote.bj +resto.bj +restaurant.bj +tourism.bj +univ.bj // bm : http://www.bermudanic.bm/dnr-text.txt bm @@ -865,6 +882,7 @@ // cy : http://www.nic.cy/ // Submitted by registry Panayiotou Fotia +// namespace policies URL https://www.nic.cy/portal//sites/default/files/symfonia_gia_eggrafi.pdf cy ac.cy biz.cy @@ -872,10 +890,9 @@ ekloges.cy gov.cy ltd.cy -name.cy +mil.cy net.cy org.cy -parliament.cy press.cy pro.cy tm.cy @@ -1034,8 +1051,7 @@ // fo : https://en.wikipedia.org/wiki/.fo fo -// fr : http://www.afnic.fr/ -// domaines descriptifs : https://www.afnic.fr/medias/documents/Cadre_legal/Afnic_Naming_Policy_12122016_VEN.pdf +// fr : https://www.afnic.fr/ https://www.afnic.fr/wp-media/uploads/2022/12/afnic-naming-policy-2023-01-01.pdf fr asso.fr com.fr @@ -1043,7 +1059,7 @@ nom.fr prd.fr tm.fr -// domaines sectoriels : https://www.afnic.fr/en/products-and-services/the-fr-tld/sector-based-fr-domains-4.html +// Former "domaines sectoriels", still registration suffixes aeroport.fr avocat.fr avoues.fr @@ -1316,7 +1332,9 @@ ie gov.ie -// il : http://www.isoc.org.il/domains/ +// il : http://www.isoc.org.il/domains/ +// see also: https://en.isoc.org.il/il-cctld/registration-rules +// ISOC-IL (operated by .il Registry) il ac.il co.il @@ -1326,6 +1344,16 @@ muni.il net.il org.il +// xn--4dbrk0ce ("Israel", Hebrew) : IL +ישראל +// xn--4dbgdty6c.xn--4dbrk0ce. +אקדמיה.ישראל +// xn--5dbhl8d.xn--4dbrk0ce. +ישוב.ישראל +// xn--8dbq2a.xn--4dbrk0ce. +צהל.ישראל +// xn--hebda8b.xn--4dbrk0ce. +ממשל.ישראל // im : https://www.nic.im/ // Submitted by registry @@ -1341,22 +1369,51 @@ tv.im // in : https://en.wikipedia.org/wiki/.in -// see also: https://registry.in/Policies +// see also: https://registry.in/policies // Please note, that nic.in is not an official eTLD, but used by most // government institutions. in +5g.in +6g.in +ac.in +ai.in +am.in +bihar.in +biz.in +business.in +ca.in +cn.in co.in +com.in +coop.in +cs.in +delhi.in +dr.in +edu.in +er.in firm.in -net.in -org.in gen.in +gov.in +gujarat.in ind.in +info.in +int.in +internet.in +io.in +me.in +mil.in +net.in nic.in -ac.in -edu.in +org.in +pg.in +post.in +pro.in res.in -gov.in -mil.in +travel.in +tv.in +uk.in +up.in +us.in // info : https://en.wikipedia.org/wiki/.info info @@ -1366,7 +1423,7 @@ int eu.int -// io : http://www.nic.io/rules.html +// io : http://www.nic.io/rules.htm // list of other 2nd level tlds ? io com.io @@ -3765,11 +3822,10 @@ // ky : http://www.icta.ky/da_ky_reg_dom.php // Confirmed by registry 2008-06-17 ky -edu.ky -gov.ky com.ky -org.ky +edu.ky net.ky +org.ky // kz : https://en.wikipedia.org/wiki/.kz // see also: http://www.nic.kz/rules/index.jsp @@ -4013,555 +4069,8 @@ co.mu or.mu -// museum : http://about.museum/naming/ -// http://index.museum/ +// museum : https://welcome.museum/wp-content/uploads/2018/05/20180525-Registration-Policy-MUSEUM-EN_VF-2.pdf https://welcome.museum/buy-your-dot-museum-2/ museum -academy.museum -agriculture.museum -air.museum -airguard.museum -alabama.museum -alaska.museum -amber.museum -ambulance.museum -american.museum -americana.museum -americanantiques.museum -americanart.museum -amsterdam.museum -and.museum -annefrank.museum -anthro.museum -anthropology.museum -antiques.museum -aquarium.museum -arboretum.museum -archaeological.museum -archaeology.museum -architecture.museum -art.museum -artanddesign.museum -artcenter.museum -artdeco.museum -arteducation.museum -artgallery.museum -arts.museum -artsandcrafts.museum -asmatart.museum -assassination.museum -assisi.museum -association.museum -astronomy.museum -atlanta.museum -austin.museum -australia.museum -automotive.museum -aviation.museum -axis.museum -badajoz.museum -baghdad.museum -bahn.museum -bale.museum -baltimore.museum -barcelona.museum -baseball.museum -basel.museum -baths.museum -bauern.museum -beauxarts.museum -beeldengeluid.museum -bellevue.museum -bergbau.museum -berkeley.museum -berlin.museum -bern.museum -bible.museum -bilbao.museum -bill.museum -birdart.museum -birthplace.museum -bonn.museum -boston.museum -botanical.museum -botanicalgarden.museum -botanicgarden.museum -botany.museum -brandywinevalley.museum -brasil.museum -bristol.museum -british.museum -britishcolumbia.museum -broadcast.museum -brunel.museum -brussel.museum -brussels.museum -bruxelles.museum -building.museum -burghof.museum -bus.museum -bushey.museum -cadaques.museum -california.museum -cambridge.museum -can.museum -canada.museum -capebreton.museum -carrier.museum -cartoonart.museum -casadelamoneda.museum -castle.museum -castres.museum -celtic.museum -center.museum -chattanooga.museum -cheltenham.museum -chesapeakebay.museum -chicago.museum -children.museum -childrens.museum -childrensgarden.museum -chiropractic.museum -chocolate.museum -christiansburg.museum -cincinnati.museum -cinema.museum -circus.museum -civilisation.museum -civilization.museum -civilwar.museum -clinton.museum -clock.museum -coal.museum -coastaldefence.museum -cody.museum -coldwar.museum -collection.museum -colonialwilliamsburg.museum -coloradoplateau.museum -columbia.museum -columbus.museum -communication.museum -communications.museum -community.museum -computer.museum -computerhistory.museum -comunicações.museum -contemporary.museum -contemporaryart.museum -convent.museum -copenhagen.museum -corporation.museum -correios-e-telecomunicações.museum -corvette.museum -costume.museum -countryestate.museum -county.museum -crafts.museum -cranbrook.museum -creation.museum -cultural.museum -culturalcenter.museum -culture.museum -cyber.museum -cymru.museum -dali.museum -dallas.museum -database.museum -ddr.museum -decorativearts.museum -delaware.museum -delmenhorst.museum -denmark.museum -depot.museum -design.museum -detroit.museum -dinosaur.museum -discovery.museum -dolls.museum -donostia.museum -durham.museum -eastafrica.museum -eastcoast.museum -education.museum -educational.museum -egyptian.museum -eisenbahn.museum -elburg.museum -elvendrell.museum -embroidery.museum -encyclopedic.museum -england.museum -entomology.museum -environment.museum -environmentalconservation.museum -epilepsy.museum -essex.museum -estate.museum -ethnology.museum -exeter.museum -exhibition.museum -family.museum -farm.museum -farmequipment.museum -farmers.museum -farmstead.museum -field.museum -figueres.museum -filatelia.museum -film.museum -fineart.museum -finearts.museum -finland.museum -flanders.museum -florida.museum -force.museum -fortmissoula.museum -fortworth.museum -foundation.museum -francaise.museum -frankfurt.museum -franziskaner.museum -freemasonry.museum -freiburg.museum -fribourg.museum -frog.museum -fundacio.museum -furniture.museum -gallery.museum -garden.museum -gateway.museum -geelvinck.museum -gemological.museum -geology.museum -georgia.museum -giessen.museum -glas.museum -glass.museum -gorge.museum -grandrapids.museum -graz.museum -guernsey.museum -halloffame.museum -hamburg.museum -handson.museum -harvestcelebration.museum -hawaii.museum -health.museum -heimatunduhren.museum -hellas.museum -helsinki.museum -hembygdsforbund.museum -heritage.museum -histoire.museum -historical.museum -historicalsociety.museum -historichouses.museum -historisch.museum -historisches.museum -history.museum -historyofscience.museum -horology.museum -house.museum -humanities.museum -illustration.museum -imageandsound.museum -indian.museum -indiana.museum -indianapolis.museum -indianmarket.museum -intelligence.museum -interactive.museum -iraq.museum -iron.museum -isleofman.museum -jamison.museum -jefferson.museum -jerusalem.museum -jewelry.museum -jewish.museum -jewishart.museum -jfk.museum -journalism.museum -judaica.museum -judygarland.museum -juedisches.museum -juif.museum -karate.museum -karikatur.museum -kids.museum -koebenhavn.museum -koeln.museum -kunst.museum -kunstsammlung.museum -kunstunddesign.museum -labor.museum -labour.museum -lajolla.museum -lancashire.museum -landes.museum -lans.museum -läns.museum -larsson.museum -lewismiller.museum -lincoln.museum -linz.museum -living.museum -livinghistory.museum -localhistory.museum -london.museum -losangeles.museum -louvre.museum -loyalist.museum -lucerne.museum -luxembourg.museum -luzern.museum -mad.museum -madrid.museum -mallorca.museum -manchester.museum -mansion.museum -mansions.museum -manx.museum -marburg.museum -maritime.museum -maritimo.museum -maryland.museum -marylhurst.museum -media.museum -medical.museum -medizinhistorisches.museum -meeres.museum -memorial.museum -mesaverde.museum -michigan.museum -midatlantic.museum -military.museum -mill.museum -miners.museum -mining.museum -minnesota.museum -missile.museum -missoula.museum -modern.museum -moma.museum -money.museum -monmouth.museum -monticello.museum -montreal.museum -moscow.museum -motorcycle.museum -muenchen.museum -muenster.museum -mulhouse.museum -muncie.museum -museet.museum -museumcenter.museum -museumvereniging.museum -music.museum -national.museum -nationalfirearms.museum -nationalheritage.museum -nativeamerican.museum -naturalhistory.museum -naturalhistorymuseum.museum -naturalsciences.museum -nature.museum -naturhistorisches.museum -natuurwetenschappen.museum -naumburg.museum -naval.museum -nebraska.museum -neues.museum -newhampshire.museum -newjersey.museum -newmexico.museum -newport.museum -newspaper.museum -newyork.museum -niepce.museum -norfolk.museum -north.museum -nrw.museum -nyc.museum -nyny.museum -oceanographic.museum -oceanographique.museum -omaha.museum -online.museum -ontario.museum -openair.museum -oregon.museum -oregontrail.museum -otago.museum -oxford.museum -pacific.museum -paderborn.museum -palace.museum -paleo.museum -palmsprings.museum -panama.museum -paris.museum -pasadena.museum -pharmacy.museum -philadelphia.museum -philadelphiaarea.museum -philately.museum -phoenix.museum -photography.museum -pilots.museum -pittsburgh.museum -planetarium.museum -plantation.museum -plants.museum -plaza.museum -portal.museum -portland.museum -portlligat.museum -posts-and-telecommunications.museum -preservation.museum -presidio.museum -press.museum -project.museum -public.museum -pubol.museum -quebec.museum -railroad.museum -railway.museum -research.museum -resistance.museum -riodejaneiro.museum -rochester.museum -rockart.museum -roma.museum -russia.museum -saintlouis.museum -salem.museum -salvadordali.museum -salzburg.museum -sandiego.museum -sanfrancisco.museum -santabarbara.museum -santacruz.museum -santafe.museum -saskatchewan.museum -satx.museum -savannahga.museum -schlesisches.museum -schoenbrunn.museum -schokoladen.museum -school.museum -schweiz.museum -science.museum -scienceandhistory.museum -scienceandindustry.museum -sciencecenter.museum -sciencecenters.museum -science-fiction.museum -sciencehistory.museum -sciences.museum -sciencesnaturelles.museum -scotland.museum -seaport.museum -settlement.museum -settlers.museum -shell.museum -sherbrooke.museum -sibenik.museum -silk.museum -ski.museum -skole.museum -society.museum -sologne.museum -soundandvision.museum -southcarolina.museum -southwest.museum -space.museum -spy.museum -square.museum -stadt.museum -stalbans.museum -starnberg.museum -state.museum -stateofdelaware.museum -station.museum -steam.museum -steiermark.museum -stjohn.museum -stockholm.museum -stpetersburg.museum -stuttgart.museum -suisse.museum -surgeonshall.museum -surrey.museum -svizzera.museum -sweden.museum -sydney.museum -tank.museum -tcm.museum -technology.museum -telekommunikation.museum -television.museum -texas.museum -textile.museum -theater.museum -time.museum -timekeeping.museum -topology.museum -torino.museum -touch.museum -town.museum -transport.museum -tree.museum -trolley.museum -trust.museum -trustee.museum -uhren.museum -ulm.museum -undersea.museum -university.museum -usa.museum -usantiques.museum -usarts.museum -uscountryestate.museum -usculture.museum -usdecorativearts.museum -usgarden.museum -ushistory.museum -ushuaia.museum -uslivinghistory.museum -utah.museum -uvic.museum -valley.museum -vantaa.museum -versailles.museum -viking.museum -village.museum -virginia.museum -virtual.museum -virtuel.museum -vlaanderen.museum -volkenkunde.museum -wales.museum -wallonie.museum -war.museum -washingtondc.museum -watchandclock.museum -watch-and-clock.museum -western.museum -westfalen.museum -whaling.museum -wildlife.museum -williamsburg.museum -windmill.museum -workshop.museum -york.museum -yorkshire.museum -yosemite.museum -youth.museum -zoological.museum -zoology.museum -ירושלים.museum -иком.museum // mv : https://en.wikipedia.org/wiki/.mv // "mv" included because, contra Wikipedia, google.mv exists. @@ -5804,7 +5313,7 @@ zgora.pl zgorzelec.pl -// pm : http://www.afnic.fr/medias/documents/AFNIC-naming-policy2012.pdf +// pm : https://www.afnic.fr/wp-media/uploads/2022/12/afnic-naming-policy-2023-01-01.pdf pm // pn : http://www.government.pn/PnRegistry/policies.htm @@ -5902,7 +5411,7 @@ org.qa sch.qa -// re : http://www.afnic.re/obtenir/chartes/nommage-re/annexe-descriptifs +// re : https://www.afnic.fr/wp-media/uploads/2022/12/afnic-naming-policy-2023-01-01.pdf re asso.re com.re @@ -6037,7 +5546,7 @@ edu.sg per.sg -// sh : http://www.nic.sh/registrar.html +// sh : http://nic.sh/rules.htm sh com.sh net.sh @@ -6159,7 +5668,7 @@ // http://www.telnic.org/ tel -// tf : https://en.wikipedia.org/wiki/.tf +// tf : https://www.afnic.fr/wp-media/uploads/2022/12/afnic-naming-policy-2023-01-01.pdf tf // tg : https://en.wikipedia.org/wiki/.tg @@ -6778,7 +6287,7 @@ net.vu org.vu -// wf : http://www.afnic.fr/medias/documents/AFNIC-naming-policy2012.pdf +// wf : https://www.afnic.fr/wp-media/uploads/2022/12/afnic-naming-policy-2023-01-01.pdf wf // ws : https://en.wikipedia.org/wiki/.ws @@ -6790,7 +6299,7 @@ gov.ws edu.ws -// yt : http://www.afnic.fr/medias/documents/AFNIC-naming-policy2012.pdf +// yt : https://www.afnic.fr/wp-media/uploads/2022/12/afnic-naming-policy-2023-01-01.pdf yt // IDN ccTLDs @@ -7132,7 +6641,7 @@ // newGTLDs -// List of new gTLDs imported from https://www.icann.org/resources/registries/gtlds/v2/gtlds.json on 2021-11-13T15:12:42Z +// List of new gTLDs imported from https://www.icann.org/resources/registries/gtlds/v2/gtlds.json on 2023-04-14T15:13:16Z // This list is auto-generated, don't edit it manually. // aaa : 2015-02-26 American Automobile Association, Inc. aaa @@ -7182,9 +6691,6 @@ // actor : 2013-12-12 Dog Beach, LLC actor -// adac : 2015-07-16 Allgemeiner Deutscher Automobil-Club e.V. (ADAC) -adac - // ads : 2014-12-04 Charleston Road Registry Inc. ads @@ -7197,9 +6703,6 @@ // aetna : 2015-05-21 Aetna Life Insurance Company aetna -// afamilycompany : 2015-07-23 Johnson Shareholdings, Inc. -afamilycompany - // afl : 2014-10-02 Australian Football League afl @@ -7305,7 +6808,7 @@ // aramco : 2014-11-20 Aramco Services Company aramco -// archi : 2014-02-06 Afilias Limited +// archi : 2014-02-06 Identity Digital Limited archi // army : 2014-03-06 Dog Beach, LLC @@ -7338,7 +6841,7 @@ // audible : 2015-06-25 Amazon Registry Services, Inc. audible -// audio : 2014-03-20 UNR Corp. +// audio : 2014-03-20 XYZ.COM LLC audio // auspost : 2015-08-13 Australian Postal Corporation @@ -7353,7 +6856,7 @@ // autos : 2014-01-09 XYZ.COM LLC autos -// avianca : 2015-01-08 Avianca Holdings S.A. +// avianca : 2015-01-08 Avianca Inc. avianca // aws : 2015-06-25 AWS Registry LLC @@ -7449,7 +6952,7 @@ // bestbuy : 2015-07-31 BBY Solutions, Inc. bestbuy -// bet : 2015-05-07 Afilias Limited +// bet : 2015-05-07 Identity Digital Limited bet // bharti : 2014-01-09 Bharti Enterprises (Holding) Private Limited @@ -7470,13 +6973,13 @@ // bingo : 2014-12-04 Binky Moon, LLC bingo -// bio : 2014-03-06 Afilias Limited +// bio : 2014-03-06 Identity Digital Limited bio -// black : 2014-01-16 Afilias Limited +// black : 2014-01-16 Identity Digital Limited black -// blackfriday : 2014-01-16 UNR Corp. +// blackfriday : 2014-01-16 Registry Services, LLC blackfriday // blockbuster : 2015-07-30 Dish DBS Corporation @@ -7488,7 +6991,7 @@ // bloomberg : 2014-07-17 Bloomberg IP Holdings LLC bloomberg -// blue : 2013-11-07 Afilias Limited +// blue : 2013-11-07 Identity Digital Limited blue // bms : 2014-10-30 Bristol-Myers Squibb Company @@ -7530,7 +7033,7 @@ // bostik : 2015-05-28 Bostik SA bostik -// boston : 2015-12-10 Boston TLD Management, LLC +// boston : 2015-12-10 Registry Services, LLC boston // bot : 2014-12-18 Amazon Registry Services, Inc. @@ -7560,12 +7063,6 @@ // brussels : 2014-02-06 DNS.be vzw brussels -// budapest : 2013-11-21 Minds + Machines Group Limited -budapest - -// bugatti : 2015-07-23 Bugatti International SA -bugatti - // build : 2013-11-07 Plan Bee LLC build @@ -7599,7 +7096,7 @@ // calvinklein : 2015-07-30 PVH gTLD Holdings LLC calvinklein -// cam : 2016-04-21 AC Webconnecting Holding B.V. +// cam : 2016-04-21 Cam Connecting SARL cam // camera : 2013-08-27 Binky Moon, LLC @@ -7608,9 +7105,6 @@ // camp : 2013-11-07 Binky Moon, LLC camp -// cancerresearch : 2014-05-15 Australian Cancer Research Foundation -cancerresearch - // canon : 2014-09-12 Canon Inc. canon @@ -7647,7 +7141,7 @@ // casa : 2013-11-21 Registry Services, LLC casa -// case : 2015-09-03 Helium TLDs Ltd +// case : 2015-09-03 Digity, LLC case // cash : 2014-03-06 Binky Moon, LLC @@ -7695,7 +7189,7 @@ // channel : 2014-05-08 Charleston Road Registry Inc. channel -// charity : 2018-04-11 Binky Moon, LLC +// charity : 2018-04-11 Public Interest Registry charity // chase : 2015-04-30 JPMorgan Chase Bank, National Association @@ -7710,7 +7204,7 @@ // chintai : 2015-06-11 CHINTAI Corporation chintai -// christmas : 2013-11-21 UNR Corp. +// christmas : 2013-11-21 XYZ.COM LLC christmas // chrome : 2014-07-24 Charleston Road Registry Inc. @@ -7749,7 +7243,7 @@ // cleaning : 2013-12-05 Binky Moon, LLC cleaning -// click : 2014-06-05 UNR Corp. +// click : 2014-06-05 Internet Naming Company LLC click // clinic : 2014-03-20 Binky Moon, LLC @@ -7833,7 +7327,7 @@ // corsica : 2014-09-25 Collectivité de Corse corsica -// country : 2013-12-19 DotCountry LLC +// country : 2013-12-19 Internet Naming Company LLC country // coupon : 2015-02-26 Amazon Registry Services, Inc. @@ -7842,7 +7336,7 @@ // coupons : 2015-03-26 Binky Moon, LLC coupons -// courses : 2014-12-04 OPEN UNIVERSITIES AUSTRALIA PTY LTD +// courses : 2014-12-04 Registry Services, LLC courses // cpa : 2019-06-10 American Institute of Certified Public Accountants @@ -7872,9 +7366,6 @@ // cruises : 2013-12-05 Binky Moon, LLC cruises -// csc : 2014-09-25 Alliance-One Services, Inc. -csc - // cuisinella : 2014-04-03 SCHMIDT GROUPE S.A.S. cuisinella @@ -7962,7 +7453,7 @@ // diamonds : 2013-09-22 Binky Moon, LLC diamonds -// diet : 2014-06-26 UNR Corp. +// diet : 2014-06-26 XYZ.COM LLC diet // digital : 2014-03-06 Binky Moon, LLC @@ -8016,9 +7507,6 @@ // dubai : 2015-01-01 Dubai Smart Government Department dubai -// duck : 2015-07-23 Johnson Shareholdings, Inc. -duck - // dunlop : 2015-07-02 The Goodyear Tire & Rubber Company dunlop @@ -8034,7 +7522,7 @@ // dvr : 2016-05-26 DISH Technologies L.L.C. dvr -// earth : 2014-12-04 Interlink Co., Ltd. +// earth : 2014-12-04 Interlink Systems Innovation Institute K.K. earth // eat : 2014-01-23 Charleston Road Registry Inc. @@ -8211,7 +7699,7 @@ // florist : 2013-11-07 Binky Moon, LLC florist -// flowers : 2014-10-09 UNR Corp. +// flowers : 2014-10-09 XYZ.COM LLC flowers // fly : 2014-05-08 Charleston Road Registry Inc. @@ -8241,7 +7729,7 @@ // forum : 2015-04-02 Fegistry, LLC forum -// foundation : 2013-12-05 Binky Moon, LLC +// foundation : 2013-12-05 Public Interest Registry foundation // fox : 2015-09-11 FOX Registry, LLC @@ -8298,7 +7786,7 @@ // gallup : 2015-02-19 Gallup, Inc. gallup -// game : 2015-05-28 UNR Corp. +// game : 2015-05-28 XYZ.COM LLC game // games : 2015-05-28 Dog Beach, LLC @@ -8322,7 +7810,7 @@ // gea : 2014-12-04 GEA Group Aktiengesellschaft gea -// gent : 2014-01-23 COMBELL NV +// gent : 2014-01-23 Easyhost BV gent // genting : 2015-03-12 Resorts World Inc Pte. Ltd. @@ -8340,22 +7828,19 @@ // gifts : 2014-07-03 Binky Moon, LLC gifts -// gives : 2014-03-06 Dog Beach, LLC +// gives : 2014-03-06 Public Interest Registry gives -// giving : 2014-11-13 Giving Limited +// giving : 2014-11-13 Public Interest Registry giving -// glade : 2015-07-23 Johnson Shareholdings, Inc. -glade - // glass : 2013-11-07 Binky Moon, LLC glass // gle : 2014-07-24 Charleston Road Registry Inc. gle -// global : 2014-04-17 Dot Global Domain Registry Limited +// global : 2014-04-17 Identity Digital Limited global // globo : 2013-12-19 Globo Comunicação e Participações S.A @@ -8412,7 +7897,7 @@ // gratis : 2014-03-20 Binky Moon, LLC gratis -// green : 2014-05-08 Afilias Limited +// green : 2014-05-08 Identity Digital Limited green // gripe : 2014-03-06 Binky Moon, LLC @@ -8436,7 +7921,7 @@ // guide : 2013-09-13 Binky Moon, LLC guide -// guitars : 2013-11-14 UNR Corp. +// guitars : 2013-11-14 XYZ.COM LLC guitars // guru : 2013-08-27 Binky Moon, LLC @@ -8469,7 +7954,7 @@ // healthcare : 2014-06-12 Binky Moon, LLC healthcare -// help : 2014-06-26 UNR Corp. +// help : 2014-06-26 Innovation service Limited help // helsinki : 2015-02-05 City of Helsinki @@ -8484,7 +7969,7 @@ // hgtv : 2015-07-02 Lifestyle Domain Holdings, Inc. hgtv -// hiphop : 2014-03-06 UNR Corp. +// hiphop : 2014-03-06 Dot Hip Hop, LLC hiphop // hisamitsu : 2015-07-16 Hisamitsu Pharmaceutical Co.,Inc. @@ -8493,7 +7978,7 @@ // hitachi : 2014-10-31 Hitachi, Ltd. hitachi -// hiv : 2014-03-13 UNR Corp. +// hiv : 2014-03-13 Internet Naming Company LLC hiv // hkt : 2015-05-14 PCCW-HKT DataCom Services Limited @@ -8532,7 +8017,7 @@ // host : 2014-04-17 Radix FZC host -// hosting : 2014-05-29 UNR Corp. +// hosting : 2014-05-29 XYZ.COM LLC hosting // hot : 2015-08-27 Amazon Registry Services, Inc. @@ -8697,7 +8182,7 @@ // jprs : 2014-09-18 Japan Registry Services Co., Ltd. jprs -// juegos : 2014-03-20 UNR Corp. +// juegos : 2014-03-20 Internet Naming Company LLC juegos // juniper : 2015-07-30 JUNIPER NETWORKS, INC. @@ -8727,7 +8212,7 @@ // kids : 2021-08-13 DotKids Foundation Limited kids -// kim : 2013-09-23 Afilias Limited +// kim : 2013-09-23 Identity Digital Limited kim // kinder : 2014-11-07 Ferrero Trading Lux S.A. @@ -8796,7 +8281,7 @@ // lasalle : 2015-04-02 Jones Lang LaSalle Incorporated lasalle -// lat : 2014-10-16 ECOM-LAC Federaciòn de Latinoamèrica y el Caribe para Internet y el Comercio Electrònico +// lat : 2014-10-16 XYZ.COM LLC lat // latino : 2015-07-30 Dish DBS Corporation @@ -8832,7 +8317,7 @@ // lexus : 2015-04-23 TOYOTA MOTOR CORPORATION lexus -// lgbt : 2014-05-08 Afilias Limited +// lgbt : 2014-05-08 Identity Digital Limited lgbt // lidl : 2014-09-18 Schwarz Domains und Services GmbH & Co. KG @@ -8865,10 +8350,7 @@ // lincoln : 2014-11-13 Ford Motor Company lincoln -// linde : 2014-12-04 Linde Aktiengesellschaft -linde - -// link : 2013-11-14 UNR Corp. +// link : 2013-11-14 Nova Registry Ltd link // lipsy : 2015-06-25 Lipsy Ltd @@ -8880,13 +8362,10 @@ // living : 2015-07-30 Lifestyle Domain Holdings, Inc. living -// lixil : 2015-03-19 LIXIL Group Corporation -lixil - -// llc : 2017-12-14 Afilias Limited +// llc : 2017-12-14 Identity Digital Limited llc -// llp : 2019-08-26 UNR Corp. +// llp : 2019-08-26 Intercap Registry Inc. llp // loan : 2014-11-20 dot Loan Limited @@ -8901,10 +8380,7 @@ // locus : 2015-06-25 Locus Analytics LLC locus -// loft : 2015-07-30 Annco, Inc. -loft - -// lol : 2015-01-30 UNR Corp. +// lol : 2015-01-30 XYZ.COM LLC lol // london : 2013-11-14 Dot London Domains Limited @@ -8913,7 +8389,7 @@ // lotte : 2014-11-07 Lotte Holdings Co., Ltd. lotte -// lotto : 2014-04-10 Afilias Limited +// lotto : 2014-04-10 Identity Digital Limited lotto // love : 2014-12-22 Merchant Law Group LLP @@ -8940,9 +8416,6 @@ // luxury : 2013-10-17 Luxury Partners, LLC luxury -// macys : 2015-07-31 Macys, Inc. -macys - // madrid : 2014-05-01 Comunidad de Madrid madrid @@ -9021,7 +8494,7 @@ // merckmsd : 2016-07-14 MSD Registry Holdings, Inc. merckmsd -// miami : 2013-12-19 Minds + Machines Group Limited +// miami : 2013-12-19 Registry Services, LLC miami // microsoft : 2014-12-18 Microsoft Corporation @@ -9054,13 +8527,13 @@ // moda : 2013-11-07 Dog Beach, LLC moda -// moe : 2013-11-13 Interlink Co., Ltd. +// moe : 2013-11-13 Interlink Systems Innovation Institute K.K. moe // moi : 2014-12-18 Amazon Registry Services, Inc. moi -// mom : 2015-04-16 UNR Corp. +// mom : 2015-04-16 XYZ.COM LLC mom // monash : 2013-09-30 Monash University @@ -9216,9 +8689,6 @@ // observer : 2015-04-30 Dog Beach, LLC observer -// off : 2015-07-23 Johnson Shareholdings, Inc. -off - // office : 2015-03-12 Microsoft Corporation office @@ -9264,7 +8734,7 @@ // orange : 2015-03-12 Orange Brand Services Limited orange -// organic : 2014-03-27 Afilias Limited +// organic : 2014-03-27 Identity Digital Limited organic // origins : 2015-10-01 The Estée Lauder Companies Inc. @@ -9285,7 +8755,7 @@ // page : 2014-12-04 Charleston Road Registry Inc. page -// panasonic : 2015-07-30 Panasonic Corporation +// panasonic : 2015-07-30 Panasonic Holdings Corporation panasonic // paris : 2014-01-30 City of Paris @@ -9312,7 +8782,7 @@ // pccw : 2015-05-14 PCCW Enterprises Limited pccw -// pet : 2015-05-07 Afilias Limited +// pet : 2015-05-07 Identity Digital Limited pet // pfizer : 2015-09-11 Pfizer Inc. @@ -9330,7 +8800,7 @@ // phone : 2016-06-02 Dish DBS Corporation phone -// photo : 2013-11-14 UNR Corp. +// photo : 2013-11-14 Registry Services, LLC photo // photography : 2013-09-20 Binky Moon, LLC @@ -9342,7 +8812,7 @@ // physio : 2014-05-01 PhysBiz Pty Ltd physio -// pics : 2013-11-14 UNR Corp. +// pics : 2013-11-14 XYZ.COM LLC pics // pictet : 2014-06-26 Pictet Europe S.A. @@ -9360,7 +8830,7 @@ // ping : 2015-06-11 Ping Registry Provider, Inc. ping -// pink : 2013-10-01 Afilias Limited +// pink : 2013-10-01 Identity Digital Limited pink // pioneer : 2015-07-16 Pioneer Corporation @@ -9390,7 +8860,7 @@ // pohl : 2014-06-23 Deutsche Vermögensberatung Aktiengesellschaft DVAG pohl -// poker : 2014-07-03 Afilias Limited +// poker : 2014-07-03 Identity Digital Limited poker // politie : 2015-08-20 Politie Nederland @@ -9423,13 +8893,13 @@ // progressive : 2015-07-23 Progressive Casualty Insurance Company progressive -// promo : 2014-12-18 Afilias Limited +// promo : 2014-12-18 Identity Digital Limited promo // properties : 2013-12-05 Binky Moon, LLC properties -// property : 2014-05-22 UNR Corp. +// property : 2014-05-22 Internet Naming Company LLC property // protection : 2015-04-23 XYZ.COM LLC @@ -9447,7 +8917,7 @@ // pwc : 2015-10-29 PricewaterhouseCoopers LLP pwc -// qpon : 2013-11-14 dotCOOL, Inc. +// qpon : 2013-11-14 dotQPON LLC qpon // quebec : 2013-12-19 PointQuébec Inc @@ -9462,9 +8932,6 @@ // radio : 2016-07-21 European Broadcasting Union (EBU) radio -// raid : 2015-07-23 Johnson Shareholdings, Inc. -raid - // read : 2014-12-18 Amazon Registry Services, Inc. read @@ -9480,7 +8947,7 @@ // recipes : 2013-10-17 Binky Moon, LLC recipes -// red : 2013-11-07 Afilias Limited +// red : 2013-11-07 Identity Digital Limited red // redstone : 2014-10-31 Redstone Haute Couture Co., Ltd. @@ -9576,7 +9043,7 @@ // rugby : 2016-12-15 World Rugby Strategic Developments Limited rugby -// ruhr : 2013-10-02 regiodot GmbH & Co. KG +// ruhr : 2013-10-02 dotSaarland GmbH ruhr // run : 2015-03-19 Binky Moon, LLC @@ -9669,9 +9136,6 @@ // science : 2014-09-11 dot Science Limited science -// scjohnson : 2015-07-23 Johnson Shareholdings, Inc. -scjohnson - // scot : 2014-01-23 Dot Scot Registry Limited scot @@ -9699,9 +9163,6 @@ // services : 2014-02-27 Binky Moon, LLC services -// ses : 2015-07-23 SES -ses - // seven : 2015-08-06 Seven West Media Ltd seven @@ -9711,7 +9172,7 @@ // sex : 2014-11-13 ICM Registry SX LLC sex -// sexy : 2013-09-11 UNR Corp. +// sexy : 2013-09-11 Internet Naming Company LLC sexy // sfr : 2015-08-13 Societe Francaise du Radiotelephone - SFR @@ -9732,7 +9193,7 @@ // shia : 2014-09-04 Asia Green IT System Bilgisayar San. ve Tic. Ltd. Sti. shia -// shiksha : 2013-11-14 Afilias Limited +// shiksha : 2013-11-14 Identity Digital Limited shiksha // shoes : 2013-10-02 Binky Moon, LLC @@ -9765,7 +9226,7 @@ // site : 2015-01-15 Radix FZC site -// ski : 2015-04-09 Afilias Limited +// ski : 2015-04-09 Identity Digital Limited ski // skin : 2015-01-15 XYZ.COM LLC @@ -9786,7 +9247,7 @@ // smile : 2014-12-18 Amazon Registry Services, Inc. smile -// sncf : 2015-02-19 Société Nationale des Chemins de fer Francais S N C F +// sncf : 2015-02-19 Société Nationale SNCF sncf // soccer : 2015-03-26 Binky Moon, LLC @@ -9870,7 +9331,7 @@ // studio : 2015-02-11 Dog Beach, LLC studio -// study : 2014-12-11 OPEN UNIVERSITIES AUSTRALIA PTY LTD +// study : 2014-12-11 Registry Services, LLC study // style : 2014-12-04 Binky Moon, LLC @@ -9930,7 +9391,7 @@ // tatar : 2014-04-24 Limited Liability Company "Coordination Center of Regional Domain of Tatarstan Republic" tatar -// tattoo : 2013-08-30 UNR Corp. +// tattoo : 2013-08-30 Top Level Design, LLC tattoo // tax : 2014-03-20 Binky Moon, LLC @@ -10023,7 +9484,7 @@ // toshiba : 2014-04-10 TOSHIBA Corporation toshiba -// total : 2015-08-06 Total SA +// total : 2015-08-06 TotalEnergies SE total // tours : 2015-01-22 Binky Moon, LLC @@ -10059,7 +9520,7 @@ // travelersinsurance : 2015-03-26 Travelers TLD, LLC travelersinsurance -// trust : 2014-10-16 UNR Corp. +// trust : 2014-10-16 Internet Naming Company LLC trust // trv : 2015-03-26 Travelers TLD, LLC @@ -10206,7 +9667,7 @@ // watch : 2013-11-14 Binky Moon, LLC watch -// watches : 2014-12-22 Afilias Limited +// watches : 2014-12-22 Identity Digital Limited watches // weather : 2015-01-08 International Business Machines Corporation @@ -10341,7 +9802,7 @@ // xn--5tzm5g : 2014-12-22 Global Website TLD Asia Limited 网站 -// xn--6frz82g : 2013-09-23 Afilias Limited +// xn--6frz82g : 2013-09-23 Identity Digital Limited 移动 // xn--6qq986b3xl : 2013-09-13 Tycoon Treasure Limited @@ -10458,9 +9919,6 @@ // xn--jlq480n2rg : 2019-12-19 Amazon Registry Services, Inc. 亚马逊 -// xn--jlq61u9w7b : 2015-01-08 Nokia Corporation -诺基亚 - // xn--jvr189m : 2015-02-26 Amazon Registry Services, Inc. 食品 @@ -10648,6 +10106,14 @@ // Submitted by accesso Team *.devcdnaccesso.com +// Acorn Labs : https://acorn.io +// Submitted by Craig Jellick +*.on-acorn.io + +// ActiveTrail: https://www.activetrail.biz/ +// Submitted by Ofer Kalaora +activetrail.biz + // Adobe : https://www.adobe.com/ // Submitted by Ian Boston and Lars Trieloff adobeaemcloud.com @@ -10657,10 +10123,43 @@ hlx.page hlx3.page +// Adobe Developer Platform : https://developer.adobe.com +// Submitted by Jesse MacFadyen +adobeio-static.net +adobeioruntime.net + // Agnat sp. z o.o. : https://domena.pl // Submitted by Przemyslaw Plewa beep.pl +// Airkit : https://www.airkit.com/ +// Submitted by Grant Cooksey +airkitapps.com +airkitapps-au.com +airkitapps.eu + +// Aiven: https://aiven.io/ +// Submitted by Etienne Stalmans +aivencloud.com + +// Akamai : https://www.akamai.com/ +// Submitted by Akamai Team +akadns.net +akamai.net +akamai-staging.net +akamaiedge.net +akamaiedge-staging.net +akamaihd.net +akamaihd-staging.net +akamaiorigin.net +akamaiorigin-staging.net +akamaized.net +akamaized-staging.net +edgekey.net +edgekey-staging.net +edgesuite.net +edgesuite-staging.net + // alboto.ca : http://alboto.ca // Submitted by Anton Avramov barsy.ca @@ -10682,19 +10181,134 @@ // Submitted by Cyril alwaysdata.net -// Amazon CloudFront : https://aws.amazon.com/cloudfront/ +// Amaze Software : https://amaze.co +// Submitted by Domain Admin +myamaze.net + +// Amazon : https://www.amazon.com/ +// Submitted by AWS Security +// Subsections of Amazon/subsidiaries will appear until "concludes" tag + +// Amazon CloudFront // Submitted by Donavan Miller +// Reference: 54144616-fd49-4435-8535-19c6a601bdb3 cloudfront.net -// Amazon Elastic Compute Cloud : https://aws.amazon.com/ec2/ +// Amazon EC2 // Submitted by Luke Wells +// Reference: 4c38fa71-58ac-4768-99e5-689c1767e537 *.compute.amazonaws.com *.compute-1.amazonaws.com *.compute.amazonaws.com.cn us-east-1.amazonaws.com -// Amazon Elastic Beanstalk : https://aws.amazon.com/elasticbeanstalk/ +// Amazon S3 +// Submitted by Luke Wells +// Reference: d068bd97-f0a9-4838-a6d8-954b622ef4ae +s3.cn-north-1.amazonaws.com.cn +s3.dualstack.ap-northeast-1.amazonaws.com +s3.dualstack.ap-northeast-2.amazonaws.com +s3.ap-northeast-2.amazonaws.com +s3-website.ap-northeast-2.amazonaws.com +s3.dualstack.ap-south-1.amazonaws.com +s3.ap-south-1.amazonaws.com +s3-website.ap-south-1.amazonaws.com +s3.dualstack.ap-southeast-1.amazonaws.com +s3.dualstack.ap-southeast-2.amazonaws.com +s3.dualstack.ca-central-1.amazonaws.com +s3.ca-central-1.amazonaws.com +s3-website.ca-central-1.amazonaws.com +s3.dualstack.eu-central-1.amazonaws.com +s3.eu-central-1.amazonaws.com +s3-website.eu-central-1.amazonaws.com +s3.dualstack.eu-west-1.amazonaws.com +s3.dualstack.eu-west-2.amazonaws.com +s3.eu-west-2.amazonaws.com +s3-website.eu-west-2.amazonaws.com +s3.dualstack.eu-west-3.amazonaws.com +s3.eu-west-3.amazonaws.com +s3-website.eu-west-3.amazonaws.com +s3.amazonaws.com +s3-ap-northeast-1.amazonaws.com +s3-ap-northeast-2.amazonaws.com +s3-ap-south-1.amazonaws.com +s3-ap-southeast-1.amazonaws.com +s3-ap-southeast-2.amazonaws.com +s3-ca-central-1.amazonaws.com +s3-eu-central-1.amazonaws.com +s3-eu-west-1.amazonaws.com +s3-eu-west-2.amazonaws.com +s3-eu-west-3.amazonaws.com +s3-external-1.amazonaws.com +s3-fips-us-gov-west-1.amazonaws.com +s3-sa-east-1.amazonaws.com +s3-us-east-2.amazonaws.com +s3-us-gov-west-1.amazonaws.com +s3-us-west-1.amazonaws.com +s3-us-west-2.amazonaws.com +s3-website-ap-northeast-1.amazonaws.com +s3-website-ap-southeast-1.amazonaws.com +s3-website-ap-southeast-2.amazonaws.com +s3-website-eu-west-1.amazonaws.com +s3-website-sa-east-1.amazonaws.com +s3-website-us-east-1.amazonaws.com +s3-website-us-west-1.amazonaws.com +s3-website-us-west-2.amazonaws.com +s3.dualstack.sa-east-1.amazonaws.com +s3.dualstack.us-east-1.amazonaws.com +s3.dualstack.us-east-2.amazonaws.com +s3.us-east-2.amazonaws.com +s3-website.us-east-2.amazonaws.com + +// AWS Cloud9 +// Submitted by: AWS Security +// Reference: 2b6dfa9a-3a7f-4367-b2e7-0321e77c0d59 +vfs.cloud9.af-south-1.amazonaws.com +webview-assets.cloud9.af-south-1.amazonaws.com +vfs.cloud9.ap-east-1.amazonaws.com +webview-assets.cloud9.ap-east-1.amazonaws.com +vfs.cloud9.ap-northeast-1.amazonaws.com +webview-assets.cloud9.ap-northeast-1.amazonaws.com +vfs.cloud9.ap-northeast-2.amazonaws.com +webview-assets.cloud9.ap-northeast-2.amazonaws.com +vfs.cloud9.ap-northeast-3.amazonaws.com +webview-assets.cloud9.ap-northeast-3.amazonaws.com +vfs.cloud9.ap-south-1.amazonaws.com +webview-assets.cloud9.ap-south-1.amazonaws.com +vfs.cloud9.ap-southeast-1.amazonaws.com +webview-assets.cloud9.ap-southeast-1.amazonaws.com +vfs.cloud9.ap-southeast-2.amazonaws.com +webview-assets.cloud9.ap-southeast-2.amazonaws.com +vfs.cloud9.ca-central-1.amazonaws.com +webview-assets.cloud9.ca-central-1.amazonaws.com +vfs.cloud9.eu-central-1.amazonaws.com +webview-assets.cloud9.eu-central-1.amazonaws.com +vfs.cloud9.eu-north-1.amazonaws.com +webview-assets.cloud9.eu-north-1.amazonaws.com +vfs.cloud9.eu-south-1.amazonaws.com +webview-assets.cloud9.eu-south-1.amazonaws.com +vfs.cloud9.eu-west-1.amazonaws.com +webview-assets.cloud9.eu-west-1.amazonaws.com +vfs.cloud9.eu-west-2.amazonaws.com +webview-assets.cloud9.eu-west-2.amazonaws.com +vfs.cloud9.eu-west-3.amazonaws.com +webview-assets.cloud9.eu-west-3.amazonaws.com +vfs.cloud9.me-south-1.amazonaws.com +webview-assets.cloud9.me-south-1.amazonaws.com +vfs.cloud9.sa-east-1.amazonaws.com +webview-assets.cloud9.sa-east-1.amazonaws.com +vfs.cloud9.us-east-1.amazonaws.com +webview-assets.cloud9.us-east-1.amazonaws.com +vfs.cloud9.us-east-2.amazonaws.com +webview-assets.cloud9.us-east-2.amazonaws.com +vfs.cloud9.us-west-1.amazonaws.com +webview-assets.cloud9.us-west-1.amazonaws.com +vfs.cloud9.us-west-2.amazonaws.com +webview-assets.cloud9.us-west-2.amazonaws.com + +// AWS Elastic Beanstalk // Submitted by Luke Wells +// Reference: aa202394-43a0-4857-b245-8db04549137e cn-north-1.eb.amazonaws.com.cn cn-northwest-1.eb.amazonaws.com.cn elasticbeanstalk.com @@ -10716,71 +10330,24 @@ us-west-1.elasticbeanstalk.com us-west-2.elasticbeanstalk.com -// Amazon Elastic Load Balancing : https://aws.amazon.com/elasticloadbalancing/ +// (AWS) Elastic Load Balancing // Submitted by Luke Wells -*.elb.amazonaws.com +// Reference: 12a3d528-1bac-4433-a359-a395867ffed2 *.elb.amazonaws.com.cn +*.elb.amazonaws.com -// Amazon Global Accelerator : https://aws.amazon.com/global-accelerator/ +// AWS Global Accelerator // Submitted by Daniel Massaguer +// Reference: d916759d-a08b-4241-b536-4db887383a6a awsglobalaccelerator.com -// Amazon S3 : https://aws.amazon.com/s3/ -// Submitted by Luke Wells -s3.amazonaws.com -s3-ap-northeast-1.amazonaws.com -s3-ap-northeast-2.amazonaws.com -s3-ap-south-1.amazonaws.com -s3-ap-southeast-1.amazonaws.com -s3-ap-southeast-2.amazonaws.com -s3-ca-central-1.amazonaws.com -s3-eu-central-1.amazonaws.com -s3-eu-west-1.amazonaws.com -s3-eu-west-2.amazonaws.com -s3-eu-west-3.amazonaws.com -s3-external-1.amazonaws.com -s3-fips-us-gov-west-1.amazonaws.com -s3-sa-east-1.amazonaws.com -s3-us-gov-west-1.amazonaws.com -s3-us-east-2.amazonaws.com -s3-us-west-1.amazonaws.com -s3-us-west-2.amazonaws.com -s3.ap-northeast-2.amazonaws.com -s3.ap-south-1.amazonaws.com -s3.cn-north-1.amazonaws.com.cn -s3.ca-central-1.amazonaws.com -s3.eu-central-1.amazonaws.com -s3.eu-west-2.amazonaws.com -s3.eu-west-3.amazonaws.com -s3.us-east-2.amazonaws.com -s3.dualstack.ap-northeast-1.amazonaws.com -s3.dualstack.ap-northeast-2.amazonaws.com -s3.dualstack.ap-south-1.amazonaws.com -s3.dualstack.ap-southeast-1.amazonaws.com -s3.dualstack.ap-southeast-2.amazonaws.com -s3.dualstack.ca-central-1.amazonaws.com -s3.dualstack.eu-central-1.amazonaws.com -s3.dualstack.eu-west-1.amazonaws.com -s3.dualstack.eu-west-2.amazonaws.com -s3.dualstack.eu-west-3.amazonaws.com -s3.dualstack.sa-east-1.amazonaws.com -s3.dualstack.us-east-1.amazonaws.com -s3.dualstack.us-east-2.amazonaws.com -s3-website-us-east-1.amazonaws.com -s3-website-us-west-1.amazonaws.com -s3-website-us-west-2.amazonaws.com -s3-website-ap-northeast-1.amazonaws.com -s3-website-ap-southeast-1.amazonaws.com -s3-website-ap-southeast-2.amazonaws.com -s3-website-eu-west-1.amazonaws.com -s3-website-sa-east-1.amazonaws.com -s3-website.ap-northeast-2.amazonaws.com -s3-website.ap-south-1.amazonaws.com -s3-website.ca-central-1.amazonaws.com -s3-website.eu-central-1.amazonaws.com -s3-website.eu-west-2.amazonaws.com -s3-website.eu-west-3.amazonaws.com -s3-website.us-east-2.amazonaws.com +// eero +// Submitted by Yue Kang +// Reference: 264afe70-f62c-4c02-8ab9-b5281ed24461 +eero.online +eero-stage.online + +// concludes Amazon // Amune : https://amune.org/ // Submitted by Team Amune @@ -10833,6 +10400,14 @@ // Submitted by Sam Smyth cdn.prod.atlassian-dev.net +// Authentick UG (haftungsbeschränkt) : https://authentick.net +// Submitted by Lukas Reschke +translated.page + +// Autocode : https://autocode.com +// Submitted by Jacob Lee +autocode.dev + // AVM : https://avm.de // Submitted by Andreas Weise myfritz.net @@ -10847,7 +10422,7 @@ *.advisor.ws // AZ.pl sp. z.o.o: https://az.pl -// Submited by Krzysztof Wolski +// Submitted by Krzysztof Wolski ecommerce-shop.pl // b-data GmbH : https://www.b-data.io @@ -10873,6 +10448,26 @@ app.banzaicloud.io *.backyards.banzaicloud.io +// BASE, Inc. : https://binc.jp +// Submitted by Yuya NAGASAWA +base.ec +official.ec +buyshop.jp +fashionstore.jp +handcrafted.jp +kawaiishop.jp +supersale.jp +theshop.jp +shopselect.net +base.shop + +// BeagleBoard.org Foundation : https://beagleboard.org +// Submitted by Jason Kridner +beagleboard.io + +// Beget Ltd +// Submitted by Lev Nekrasov +*.beget.app // BetaInABox // Submitted by Adrian @@ -10941,6 +10536,11 @@ // Submitted by Marcus Popp mycd.eu +// Canva Pty Ltd : https://canva.com/ +// Submitted by Joel Aquilina +canva-apps.cn +canva-apps.com + // Carrd : https://carrd.co // Submitted by AJ drr.ac @@ -11070,8 +10670,11 @@ // Cloudflare, Inc. : https://www.cloudflare.com/ // Submitted by Cloudflare Team -pages.dev +cf-ipfs.com +cloudflare-ipfs.com trycloudflare.com +pages.dev +r2.dev workers.dev // Clovyr : https://clovyr.io @@ -11115,6 +10718,10 @@ // Submitted by Angelo Gladding cnpy.gdn +// Codeberg e. V. : https://codeberg.org +// Submitted by Moritz Marquardt +codeberg.page + // CoDNS B.V. co.nl co.no @@ -11241,11 +10848,21 @@ // Submitted by Peter Thomassen dedyn.io +// Deta: https://www.deta.sh/ +// Submitted by Aavash Shrestha +deta.app +deta.dev + // Diher Solutions : https://diher.solutions // Submitted by Didi Hermawan *.rss.my.id *.diher.solutions +// Discord Inc : https://discord.com +// Submitted by Sahn Lam +discordsays.com +discordsez.com + // DNS Africa Ltd https://dns.business // Submitted by Calvin Browne jozi.biz @@ -11634,10 +11251,10 @@ // Submitted by Vladimir Dudr e4.cz -// eero : https://eero.com/ -// Submitted by Yue Kang -eero.online -eero-stage.online +// Easypanel : https://easypanel.io +// Submitted by Andrei Canta +easypanel.app +easypanel.host // Elementor : Elementor Ltd. // Submitted by Anton Barkan @@ -11653,11 +11270,20 @@ mytuleap.com tuleap-partners.com +// Encoretivity AB: https://encore.dev +// Submitted by André Eriksson +encr.app +encoreapi.com + // ECG Robotics, Inc: https://ecgrobotics.org // Submitted by onred.one staging.onred.one +// encoway GmbH : https://www.encoway.de +// Submitted by Marcel Daus +eu.encoway.cloud + // EU.org https://eu.org/ // Submitted by Pierre Beyssac eu.org @@ -11832,6 +11458,7 @@ // Fastly Inc. : http://www.fastly.com/ // Submitted by Fastly Security edgecompute.app +fastly-edge.com fastly-terrarium.com fastlylb.net map.fastlylb.net @@ -11843,6 +11470,10 @@ b.ssl.fastly.net global.ssl.fastly.net +// Fastmail : https://www.fastmail.com/ +// Submitted by Marc Bradshaw +*.user.fm + // FASTVPS EESTI OU : https://fastvps.ru/ // Submitted by Likhachev Vasiliy fastvps-server.com @@ -11861,8 +11492,6 @@ // FearWorks Media Ltd. : https://fearworksmedia.co.uk // submitted by Keith Fairley -couk.me -ukco.me conn.uk copro.uk hosp.uk @@ -11921,6 +11550,10 @@ // Submitted by Koen Rouwhorst framer.app framercanvas.com +framer.media +framer.photos +framer.website +framer.wiki // Frusky MEDIA&PR : https://www.frusky.de // Submitted by Victor Pupynin @@ -11966,10 +11599,22 @@ *.kunden.ortsinfo.at *.statics.cloud -// GDS : https://www.gov.uk/service-manual/operations/operating-servicegovuk-subdomains -// Submitted by David Illsley +// GDS : https://www.gov.uk/service-manual/technology/managing-domain-names +// Submitted by Stephen Ford +independent-commission.uk +independent-inquest.uk +independent-inquiry.uk +independent-panel.uk +independent-review.uk +public-inquiry.uk +royal-commission.uk +campaign.gov.uk service.gov.uk +// CDDO : https://www.gov.uk/guidance/get-an-api-domain-on-govuk +// Submitted by Jamie Tanna +api.gov.uk + // Gehirn Inc. : https://www.gehirn.co.jp/ // Submitted by Kohei YOSHIDA gehirn.ne.jp @@ -12019,8 +11664,114 @@ shop.ro // GMO Pepabo, Inc. : https://pepabo.com/ -// Submitted by dojineko +// Submitted by Hosting Div lolipop.io +angry.jp +babyblue.jp +babymilk.jp +backdrop.jp +bambina.jp +bitter.jp +blush.jp +boo.jp +boy.jp +boyfriend.jp +but.jp +candypop.jp +capoo.jp +catfood.jp +cheap.jp +chicappa.jp +chillout.jp +chips.jp +chowder.jp +chu.jp +ciao.jp +cocotte.jp +coolblog.jp +cranky.jp +cutegirl.jp +daa.jp +deca.jp +deci.jp +digick.jp +egoism.jp +fakefur.jp +fem.jp +flier.jp +floppy.jp +fool.jp +frenchkiss.jp +girlfriend.jp +girly.jp +gloomy.jp +gonna.jp +greater.jp +hacca.jp +heavy.jp +her.jp +hiho.jp +hippy.jp +holy.jp +hungry.jp +icurus.jp +itigo.jp +jellybean.jp +kikirara.jp +kill.jp +kilo.jp +kuron.jp +littlestar.jp +lolipopmc.jp +lolitapunk.jp +lomo.jp +lovepop.jp +lovesick.jp +main.jp +mods.jp +mond.jp +mongolian.jp +moo.jp +namaste.jp +nikita.jp +nobushi.jp +noor.jp +oops.jp +parallel.jp +parasite.jp +pecori.jp +peewee.jp +penne.jp +pepper.jp +perma.jp +pigboat.jp +pinoko.jp +punyu.jp +pupu.jp +pussycat.jp +pya.jp +raindrop.jp +readymade.jp +sadist.jp +schoolbus.jp +secret.jp +staba.jp +stripper.jp +sub.jp +sunnyday.jp +thick.jp +tonkotsu.jp +under.jp +upper.jp +velvet.jp +verse.jp +versus.jp +vivian.jp +watson.jp +weblike.jp +whitesnow.jp +zombie.jp +heteml.net // GOV.UK Platform as a Service : https://www.cloud.service.gov.uk/ // Submitted by Tom Whitwell @@ -12142,6 +11893,10 @@ // Submitted by Niels Martignene goupile.fr +// Government of the Netherlands: https://www.government.nl +// Submitted by +gov.nl + // Group 53, LLC : https://www.group53.com // Submitted by Tyler Todd awsmppl.com @@ -12152,7 +11907,7 @@ günstigliefern.de // Hakaran group: http://hakaran.cz -// Submited by Arseniy Sokolov +// Submitted by Arseniy Sokolov fin.ci free.hr caa.li @@ -12187,20 +11942,25 @@ // Hibernating Rhinos // Submitted by Oren Eini -myravendb.com +ravendb.cloud ravendb.community ravendb.me development.run ravendb.run // home.pl S.A.: https://home.pl -// Submited by Krzysztof Wolski +// Submitted by Krzysztof Wolski homesklep.pl // Hong Kong Productivity Council: https://www.hkpc.org/ // Submitted by SECaaS Team secaas.hk +// Hoplix : https://www.hoplix.com +// Submitted by Danilo De Franco +hoplix.shop + + // HOSTBIP REGISTRY : https://www.hostbip.com/ // Submitted by Atanunu Igbunuroghene orx.biz @@ -12212,7 +11972,10 @@ ngo.ng edu.scot sch.so -org.yt + +// HostFly : https://www.ie.ua +// Submitted by Bohdan Dub +ie.ua // HostyHosting (hostyhosting.com) hostyhosting.io @@ -12230,6 +11993,11 @@ // Submitted by Hannu Aronsson iki.fi +// iliad italia: https://www.iliad.it +// Submitted by Marios Makassikis +ibxos.it +iliadboxos.it + // Impertrix Solutions : // Submitted by Zhixiang Zhao impertrixcdn.com @@ -12299,7 +12067,7 @@ pixolino.com // Internet-Pro, LLP: https://netangels.ru/ -// Submited by Vasiliy Sheredeko +// Submitted by Vasiliy Sheredeko na4u.ru // iopsys software solutions AB : https://iopsys.eu/ @@ -12310,9 +12078,11 @@ // Submitted by Matthew Hardeman ipifony.net -// IServ GmbH : https://iserv.eu -// Submitted by Kim-Alexander Brodowski +// IServ GmbH : https://iserv.de +// Submitted by Mario Hoberg +iservschule.de mein-iserv.de +schulplattform.de schulserver.de test-iserv.de iserv.dev @@ -12322,7 +12092,7 @@ iobb.net // Jelastic, Inc. : https://jelastic.com/ -// Submited by Ihor Kolodyuk +// Submitted by Ihor Kolodyuk mel.cloudlets.com.au cloud.interhostsolutions.be users.scale.virtualcloud.com.br @@ -12433,6 +12203,14 @@ kaas.gg khplay.nl +// Kakao : https://www.kakaocorp.com/ +// Submitted by JaeYoong Lee +ktistory.com + +// Kapsi : https://kapsi.fi +// Submitted by Tomi Juntunen +kapsi.fi + // Keyweb AG : https://www.keyweb.de // Submitted by Martin Dannehl keymachine.de @@ -12446,6 +12224,10 @@ // Submitted by Roy Keene knightpoint.systems +// KoobinEvent, SL: https://www.koobin.com +// Submitted by Iván Oliva +koobin.events + // KUROKU LTD : https://kuroku.ltd/ // Submitted by DisposaBoy oya.to @@ -12510,6 +12292,10 @@ // Submitted by Victor Velchev we.bs +// Localcert : https://localcert.dev +// Submitted by Lann Martin +*.user.localcert.dev + // localzone.xyz // Submitted by Kenny Niehage localzone.xyz @@ -12618,6 +12404,10 @@ miniserver.com memset.net +// Messerli Informatik AG : https://www.messerli.ch/ +// Submitted by Ruben Schmidmeister +messerli.app + // MetaCentrum, CESNET z.s.p.o. : https://www.metacentrum.cz/en/ // Submitted by Zdeněk Šustr *.cloud.metacentrum.cz @@ -12637,12 +12427,15 @@ co.pl // Microsoft Corporation : http://microsoft.com -// Submitted by Mitch Webster +// Submitted by Public Suffix List Admin *.azurecontainer.io azurewebsites.net azure-mobile.net cloudapp.net azurestaticapps.net +1.azurestaticapps.net +2.azurestaticapps.net +3.azurestaticapps.net centralus.azurestaticapps.net eastasia.azurestaticapps.net eastus2.azurestaticapps.net @@ -12695,24 +12488,9 @@ // Submitted by Paulus Schoutsen ui.nabu.casa -// Names.of.London : https://names.of.london/ -// Submitted by James Stevens or -pony.club -of.fashion -in.london -of.london -from.marketing -with.marketing -for.men -repair.men -and.mom -for.mom -for.one -under.one -for.sale -that.win -from.work -to.work +// Net at Work Gmbh : https://www.netatwork.de +// Submitted by Jan Jaeschke +cloud.nospamproxy.com // Netlify : https://www.netlify.com // Submitted by Jessica Parsons @@ -12724,7 +12502,19 @@ // ngrok : https://ngrok.com/ // Submitted by Alan Shreve +ngrok.app +ngrok-free.app +ngrok.dev +ngrok-free.dev ngrok.io +ap.ngrok.io +au.ngrok.io +eu.ngrok.io +in.ngrok.io +jp.ngrok.io +sa.ngrok.io +us.ngrok.io +ngrok.pizza // Nimbus Hosting Ltd. : https://www.nimbushosting.co.uk/ // Submitted by Nicholas Ford @@ -12742,7 +12532,10 @@ // Northflank Ltd. : https://northflank.com/ // Submitted by Marco Suter *.northflank.app +*.build.run *.code.run +*.database.run +*.migration.run // Noticeable : https://noticeable.io // Submitted by Laurent Pellegrino @@ -12873,11 +12666,6 @@ // Submitted by Konstantin Nosov stage.nodeart.io -// Nodum B.V. : https://nodum.io/ -// Submitted by Wietse Wind -nodum.co -nodum.io - // Nucleos Inc. : https://nucleos.com // Submitted by Piotr Zduniak pcloud.host @@ -12908,7 +12696,26 @@ // One.com: https://www.one.com/ // Submitted by Jacob Bunk Nielsen +123hjemmeside.dk +123hjemmeside.no +123homepage.it +123kotisivu.fi +123minsida.se +123miweb.es +123paginaweb.pt +123sait.ru +123siteweb.fr +123webseite.at +123webseite.de +123website.be +123website.ch +123website.lu +123website.nl service.one +simplesite.com +simplesite.com.br +simplesite.gr +simplesite.pl // One Fold Media : http://www.onefoldmedia.com/ // Submitted by Eddie Jones @@ -12930,8 +12737,12 @@ // Submitted by Yngve Pettersen operaunite.com +// Orange : https://www.orange.com +// Submitted by Alexandre Linte +tech.orange + // Oursky Limited : https://authgear.com/, https://skygear.io/ -// Submited by Authgear Team , Skygear Developer +// Submitted by Authgear Team , Skygear Developer authgear-staging.com authgearapps.com skygearapp.com @@ -13039,6 +12850,10 @@ // Submitted by Maximilian Schieder dyn53.io +// Porter : https://porter.run/ +// Submitted by Rudraksh MK +onporter.run + // Positive Codes Technology Company : http://co.bn/faq.html // Submitted by Zulfais co.bn @@ -13096,6 +12911,10 @@ // Submitted by Xavier De Cock qualifioapp.com +// Quality Unit: https://qualityunit.com +// Submitted by Vasyl Tsalko +ladesk.com + // QuickBackend: https://www.quickbackend.com // Submitted by Dani Biro qbuser.com @@ -13169,7 +12988,9 @@ onrender.com // Repl.it : https://repl.it -// Submitted by Mason Clayton +// Submitted by Lincoln Bergeson +firewalledreplit.co +id.firewalledreplit.co repl.co id.repl.co repl.run @@ -13200,6 +13021,10 @@ // Submitted by Jennifer Herting git-pages.rit.edu +// Rocky Enterprise Software Foundation : https://resf.org +// Submitted by Neil Hanlon +rocky.page + // Rusnames Limited: http://rusnames.ru/ // Submitted by Sergey Zotov биз.рус @@ -13213,6 +13038,62 @@ спб.рус я.рус +// SAKURA Internet Inc. : https://www.sakura.ad.jp/ +// Submitted by Internet Service Department +180r.com +dojin.com +sakuratan.com +sakuraweb.com +x0.com +2-d.jp +bona.jp +crap.jp +daynight.jp +eek.jp +flop.jp +halfmoon.jp +jeez.jp +matrix.jp +mimoza.jp +ivory.ne.jp +mail-box.ne.jp +mints.ne.jp +mokuren.ne.jp +opal.ne.jp +sakura.ne.jp +sumomo.ne.jp +topaz.ne.jp +netgamers.jp +nyanta.jp +o0o0.jp +rdy.jp +rgr.jp +rulez.jp +s3.isk01.sakurastorage.jp +s3.isk02.sakurastorage.jp +saloon.jp +sblo.jp +skr.jp +tank.jp +uh-oh.jp +undo.jp +rs.webaccel.jp +user.webaccel.jp +websozai.jp +xii.jp +squares.net +jpn.org +kirara.st +x0.to +from.tv +sakura.tv + +// Salesforce.com, Inc. https://salesforce.com/ +// Submitted by Michael Biven +*.builder.code.com +*.dev-builder.code.com +*.stg-builder.code.com + // Sandstorm Development Group, Inc. : https://sandcats.io/ // Submitted by Asheesh Laroia sandcats.io @@ -13222,6 +13103,34 @@ logoip.de logoip.com +// Scaleway : https://www.scaleway.com/ +// Submitted by Rémy Léone +fr-par-1.baremetal.scw.cloud +fr-par-2.baremetal.scw.cloud +nl-ams-1.baremetal.scw.cloud +fnc.fr-par.scw.cloud +functions.fnc.fr-par.scw.cloud +k8s.fr-par.scw.cloud +nodes.k8s.fr-par.scw.cloud +s3.fr-par.scw.cloud +s3-website.fr-par.scw.cloud +whm.fr-par.scw.cloud +priv.instances.scw.cloud +pub.instances.scw.cloud +k8s.scw.cloud +k8s.nl-ams.scw.cloud +nodes.k8s.nl-ams.scw.cloud +s3.nl-ams.scw.cloud +s3-website.nl-ams.scw.cloud +whm.nl-ams.scw.cloud +k8s.pl-waw.scw.cloud +nodes.k8s.pl-waw.scw.cloud +s3.pl-waw.scw.cloud +s3-website.pl-waw.scw.cloud +scalebook.scw.cloud +smartlabeling.scw.cloud +dedibox.fr + // schokokeks.org GbR : https://schokokeks.org/ // Submitted by Hanno Böck schokokeks.net @@ -13329,6 +13238,13 @@ // Submitted by Dan Kozak vp4.me +// Snowflake Inc : https://www.snowflake.com/ +// Submitted by Faith Olapade +snowflake.app +privatelink.snowflake.app +streamlit.app +streamlitapp.com + // Snowplow Analytics : https://snowplowanalytics.com/ // Submitted by Ian Streeter try-snowplow.com @@ -13342,6 +13258,8 @@ stackhero-network.com // Staclar : https://staclar.com +// Submitted by Q Misell +musician.io // Submitted by Matthias Merkel novecore.site @@ -13440,25 +13358,28 @@ // Synology, Inc. : https://www.synology.com/ // Submitted by Rony Weng -diskstation.me dscloud.biz -dscloud.me -dscloud.mobi +direct.quickconnect.cn dsmynas.com -dsmynas.net -dsmynas.org familyds.com -familyds.net -familyds.org +diskstation.me +dscloud.me i234.me myds.me synology.me +dscloud.mobi +dsmynas.net +familyds.net +dsmynas.org +familyds.org vpnplus.to direct.quickconnect.to // Tabit Technologies Ltd. : https://tabit.cloud/ // Submitted by Oren Agiv tabitorder.co.il +mytabit.co.il +mytabit.com // TAIFUN Software AG : http://taifun-software.de // Submitted by Bjoern Henke @@ -13476,9 +13397,14 @@ med.pl sopot.pl +// team.blue https://team.blue +// Submitted by Cedric Dubois +site.tb-hosting.com + // Teckids e.V. : https://www.teckids.org // Submitted by Dominik George -edugit.org +edugit.io +s3.teckids.org // Telebit : https://telebit.cloud // Submitted by AJ ONeal @@ -13486,10 +13412,6 @@ telebit.io *.telebit.xyz -// The Gwiddle Foundation : https://gwiddlefoundation.org.uk -// Submitted by Joshua Bayfield -gwiddle.co.uk - // Thingdust AG : https://thingdust.com/ // Submitted by Adrian Imboden *.firenet.ch @@ -13524,10 +13446,6 @@ bloxcms.com townnews-staging.com -// TradableBits: https://tradablebits.com -// Submitted by Dmitry Khrisanov dmitry@tradablebits.com -tbits.me - // TrafficPlex GmbH : https://www.trafficplex.de/ // Submitted by Phillipp Röll 12hp.at @@ -13556,6 +13474,10 @@ *.transurl.eu *.transurl.nl +// TransIP: https://www.transip.nl +// Submitted by Cedric Dubois +site.transip.me + // TuxFamily : http://tuxfamily.org // Submitted by TuxFamily administrators tuxfamily.org @@ -13576,6 +13498,14 @@ synology-diskstation.de synology-ds.de +// Typedream : https://typedream.com +// Submitted by Putri Karunia +typedream.app + +// Typeform : https://www.typeform.com +// Submitted by Sergi Ferriz +pro.typeform.com + // Uberspace : https://uberspace.de // Submitted by Moritz Werner uber.space @@ -13588,6 +13518,19 @@ ltd.hk inc.hk +// UK Intis Telecom LTD : https://it.com +// Submitted by ITComdomains +it.com + +// UNIVERSAL DOMAIN REGISTRY : https://www.udr.org.yt/ +// see also: whois -h whois.udr.org.yt help +// Submitted by Atanunu Igbunuroghene +name.pm +sch.tf +biz.wf +sch.wf +org.yt + // United Gameserver GmbH : https://united-gameserver.de // Submitted by Stefan Schwarz virtualuser.de @@ -13674,19 +13617,14 @@ // Submitted by Serhii Rostilo v.ua +// Vultr Objects : https://www.vultr.com/products/object-storage/ +// Submitted by Niels Maumenee +*.vultrobjects.com + // Waffle Computer Inc., Ltd. : https://docs.waffleinfo.com // Submitted by Masayuki Note wafflecell.com -// WapBlog.ID : https://www.wapblog.id -// Submitted by Fajar Sodik -idnblogger.com -indowapblog.com -bloger.id -wblog.id -wbq.me -fastblog.net - // WebHare bv: https://www.webhare.com/ // Submitted by Arnold Hendriks *.webhare.dev @@ -13723,6 +13661,10 @@ panel.gg daemon.panel.gg +// Wizard Zines : https://wizardzines.com +// Submitted by Julia Evans +messwithdns.com + // WoltLab GmbH : https://www.woltlab.com // Submitted by Tim Düsterhus woltlab-demo.com diff -Nru openjdk-11-11.0.20+8/make/lib/Awt2dLibraries.gmk openjdk-11-11.0.21+9/make/lib/Awt2dLibraries.gmk --- openjdk-11-11.0.20+8/make/lib/Awt2dLibraries.gmk 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/make/lib/Awt2dLibraries.gmk 2023-10-06 05:33:33.000000000 +0000 @@ -527,6 +527,7 @@ E_END_OF_LOOP_CODE_NOT_REACHED, \ DISABLED_WARNINGS_microsoft := 4018 4267 4244 4312 4819, \ DISABLED_WARNINGS_gcc := implicit-fallthrough cast-function-type bad-function-cast, \ + DISABLED_WARNINGS_clang := missing-declarations, \ LDFLAGS := $(LDFLAGS_JDKLIB) \ $(call SET_SHARED_LIBRARY_ORIGIN), \ )) @@ -559,10 +560,12 @@ # hb-ft.cc is not presently needed, and requires freetype 2.4.2 or later. LIBFONTMANAGER_EXCLUDE_FILES += libharfbuzz/hb-ft.cc - HARFBUZZ_DISABLED_WARNINGS_gcc := type-limits missing-field-initializers strict-aliasing + HARFBUZZ_DISABLED_WARNINGS_gcc := type-limits missing-field-initializers strict-aliasing \ + array-bounds # noexcept-type required for GCC 7 builds. Not required for GCC 8+. + # expansion-to-defined required for GCC 9 builds. Not required for GCC 10+. HARFBUZZ_DISABLED_WARNINGS_CXX_gcc := reorder delete-non-virtual-dtor strict-overflow \ - maybe-uninitialized class-memaccess unused-result extra noexcept-type + maybe-uninitialized class-memaccess unused-result extra noexcept-type expansion-to-defined HARFBUZZ_DISABLED_WARNINGS_clang := unused-value incompatible-pointer-types \ tautological-constant-out-of-range-compare int-to-pointer-cast \ undef missing-field-initializers deprecated-declarations c++11-narrowing range-loop-analysis diff -Nru openjdk-11-11.0.20+8/src/hotspot/cpu/aarch64/aarch64.ad openjdk-11-11.0.21+9/src/hotspot/cpu/aarch64/aarch64.ad --- openjdk-11-11.0.20+8/src/hotspot/cpu/aarch64/aarch64.ad 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/cpu/aarch64/aarch64.ad 2023-10-06 05:33:33.000000000 +0000 @@ -971,6 +971,26 @@ V3, V3_H ); +// Class for 128 bit register v4 +reg_class v4_reg( + V4, V4_H +); + +// Class for 128 bit register v5 +reg_class v5_reg( + V5, V5_H +); + +// Class for 128 bit register v6 +reg_class v6_reg( + V6, V6_H +); + +// Class for 128 bit register v7 +reg_class v7_reg( + V7, V7_H +); + // Singleton class for condition codes reg_class int_flags(RFLAGS); @@ -4884,6 +4904,42 @@ interface(REG_INTER); %} +operand vRegD_V4() +%{ + constraint(ALLOC_IN_RC(v4_reg)); + match(RegD); + op_cost(0); + format %{ %} + interface(REG_INTER); +%} + +operand vRegD_V5() +%{ + constraint(ALLOC_IN_RC(v5_reg)); + match(RegD); + op_cost(0); + format %{ %} + interface(REG_INTER); +%} + +operand vRegD_V6() +%{ + constraint(ALLOC_IN_RC(v6_reg)); + match(RegD); + op_cost(0); + format %{ %} + interface(REG_INTER); +%} + +operand vRegD_V7() +%{ + constraint(ALLOC_IN_RC(v7_reg)); + match(RegD); + op_cost(0); + format %{ %} + interface(REG_INTER); +%} + // Flags register, used as output of signed compare instructions // note that on AArch64 we also use this register as the output for @@ -15390,14 +15446,17 @@ %} instruct string_indexofUU(iRegP_R1 str1, iRegI_R4 cnt1, iRegP_R3 str2, iRegI_R2 cnt2, - iRegI_R0 result, iRegINoSp tmp1, iRegINoSp tmp2, iRegINoSp tmp3, - iRegINoSp tmp4, iRegINoSp tmp5, iRegINoSp tmp6, rFlagsReg cr) + iRegI_R0 result, iRegINoSp tmp1, iRegINoSp tmp2, + iRegINoSp tmp3, iRegINoSp tmp4, iRegINoSp tmp5, iRegINoSp tmp6, + vRegD_V0 vtmp0, vRegD_V1 vtmp1, rFlagsReg cr) %{ predicate(((StrIndexOfNode*)n)->encoding() == StrIntrinsicNode::UU); match(Set result (StrIndexOf (Binary str1 cnt1) (Binary str2 cnt2))); effect(USE_KILL str1, USE_KILL str2, USE_KILL cnt1, USE_KILL cnt2, - TEMP tmp1, TEMP tmp2, TEMP tmp3, TEMP tmp4, TEMP tmp5, TEMP tmp6, KILL cr); - format %{ "String IndexOf $str1,$cnt1,$str2,$cnt2 -> $result (UU)" %} + TEMP tmp1, TEMP tmp2, TEMP tmp3, TEMP tmp4, TEMP tmp5, TEMP tmp6, + TEMP vtmp0, TEMP vtmp1, KILL cr); + format %{ "String IndexOf $str1,$cnt1,$str2,$cnt2 -> $result (UU) " + "# KILL $str1 $cnt1 $str2 $cnt2 $tmp1 $tmp2 $tmp3 $tmp4 $tmp5 $tmp6 V0-V1 cr" %} ins_encode %{ __ string_indexof($str1$$Register, $str2$$Register, @@ -15411,14 +15470,17 @@ %} instruct string_indexofLL(iRegP_R1 str1, iRegI_R4 cnt1, iRegP_R3 str2, iRegI_R2 cnt2, - iRegI_R0 result, iRegINoSp tmp1, iRegINoSp tmp2, iRegINoSp tmp3, - iRegINoSp tmp4, iRegINoSp tmp5, iRegINoSp tmp6, rFlagsReg cr) + iRegI_R0 result, iRegINoSp tmp1, iRegINoSp tmp2, iRegINoSp tmp3, + iRegINoSp tmp4, iRegINoSp tmp5, iRegINoSp tmp6, + vRegD_V0 vtmp0, vRegD_V1 vtmp1, rFlagsReg cr) %{ predicate(((StrIndexOfNode*)n)->encoding() == StrIntrinsicNode::LL); match(Set result (StrIndexOf (Binary str1 cnt1) (Binary str2 cnt2))); effect(USE_KILL str1, USE_KILL str2, USE_KILL cnt1, USE_KILL cnt2, - TEMP tmp1, TEMP tmp2, TEMP tmp3, TEMP tmp4, TEMP tmp5, TEMP tmp6, KILL cr); - format %{ "String IndexOf $str1,$cnt1,$str2,$cnt2 -> $result (LL)" %} + TEMP tmp1, TEMP tmp2, TEMP tmp3, TEMP tmp4, TEMP tmp5, TEMP tmp6, + TEMP vtmp0, TEMP vtmp1, KILL cr); + format %{ "String IndexOf $str1,$cnt1,$str2,$cnt2 -> $result (LL) " + "# KILL $str1 $cnt1 $str2 $cnt2 $tmp1 $tmp2 $tmp3 $tmp4 $tmp5 $tmp6 V0-V1 cr" %} ins_encode %{ __ string_indexof($str1$$Register, $str2$$Register, @@ -15432,14 +15494,17 @@ %} instruct string_indexofUL(iRegP_R1 str1, iRegI_R4 cnt1, iRegP_R3 str2, iRegI_R2 cnt2, - iRegI_R0 result, iRegINoSp tmp1, iRegINoSp tmp2, iRegINoSp tmp3, - iRegINoSp tmp4, iRegINoSp tmp5, iRegINoSp tmp6, rFlagsReg cr) + iRegI_R0 result, iRegINoSp tmp1, iRegINoSp tmp2, iRegINoSp tmp3, + iRegINoSp tmp4, iRegINoSp tmp5, iRegINoSp tmp6, + vRegD_V0 vtmp0, vRegD_V1 vtmp1, rFlagsReg cr) %{ predicate(((StrIndexOfNode*)n)->encoding() == StrIntrinsicNode::UL); match(Set result (StrIndexOf (Binary str1 cnt1) (Binary str2 cnt2))); effect(USE_KILL str1, USE_KILL str2, USE_KILL cnt1, USE_KILL cnt2, - TEMP tmp1, TEMP tmp2, TEMP tmp3, TEMP tmp4, TEMP tmp5, TEMP tmp6, KILL cr); - format %{ "String IndexOf $str1,$cnt1,$str2,$cnt2 -> $result (UL)" %} + TEMP tmp1, TEMP tmp2, TEMP tmp3, TEMP tmp4, TEMP tmp5, + TEMP tmp6, TEMP vtmp0, TEMP vtmp1, KILL cr); + format %{ "String IndexOf $str1,$cnt1,$str2,$cnt2 -> $result (UL) " + "# KILL $str1 cnt1 $str2 $cnt2 $tmp1 $tmp2 $tmp3 $tmp4 $tmp5 $tmp6 V0-V1 cr" %} ins_encode %{ __ string_indexof($str1$$Register, $str2$$Register, @@ -15453,14 +15518,15 @@ %} instruct string_indexof_conUU(iRegP_R1 str1, iRegI_R4 cnt1, iRegP_R3 str2, - immI_le_4 int_cnt2, iRegI_R0 result, iRegINoSp tmp1, iRegINoSp tmp2, - iRegINoSp tmp3, iRegINoSp tmp4, rFlagsReg cr) + immI_le_4 int_cnt2, iRegI_R0 result, iRegINoSp tmp1, + iRegINoSp tmp2, iRegINoSp tmp3, iRegINoSp tmp4, rFlagsReg cr) %{ predicate(((StrIndexOfNode*)n)->encoding() == StrIntrinsicNode::UU); match(Set result (StrIndexOf (Binary str1 cnt1) (Binary str2 int_cnt2))); effect(USE_KILL str1, USE_KILL str2, USE_KILL cnt1, TEMP tmp1, TEMP tmp2, TEMP tmp3, TEMP tmp4, KILL cr); - format %{ "String IndexOf $str1,$cnt1,$str2,$int_cnt2 -> $result (UU)" %} + format %{ "String IndexOf $str1,$cnt1,$str2,$int_cnt2 -> $result (UU) " + "# KILL $str1 $cnt1 $str2 $tmp1 $tmp2 $tmp3 $tmp4 cr" %} ins_encode %{ int icnt2 = (int)$int_cnt2$$constant; @@ -15474,14 +15540,15 @@ %} instruct string_indexof_conLL(iRegP_R1 str1, iRegI_R4 cnt1, iRegP_R3 str2, - immI_le_4 int_cnt2, iRegI_R0 result, iRegINoSp tmp1, iRegINoSp tmp2, - iRegINoSp tmp3, iRegINoSp tmp4, rFlagsReg cr) + immI_le_4 int_cnt2, iRegI_R0 result, iRegINoSp tmp1, + iRegINoSp tmp2, iRegINoSp tmp3, iRegINoSp tmp4, rFlagsReg cr) %{ predicate(((StrIndexOfNode*)n)->encoding() == StrIntrinsicNode::LL); match(Set result (StrIndexOf (Binary str1 cnt1) (Binary str2 int_cnt2))); effect(USE_KILL str1, USE_KILL str2, USE_KILL cnt1, TEMP tmp1, TEMP tmp2, TEMP tmp3, TEMP tmp4, KILL cr); - format %{ "String IndexOf $str1,$cnt1,$str2,$int_cnt2 -> $result (LL)" %} + format %{ "String IndexOf $str1,$cnt1,$str2,$int_cnt2 -> $result (LL) " + "# KILL $str1 $cnt1 $str2 $tmp1 $tmp2 $tmp3 $tmp4 cr" %} ins_encode %{ int icnt2 = (int)$int_cnt2$$constant; @@ -15495,14 +15562,15 @@ %} instruct string_indexof_conUL(iRegP_R1 str1, iRegI_R4 cnt1, iRegP_R3 str2, - immI_1 int_cnt2, iRegI_R0 result, iRegINoSp tmp1, iRegINoSp tmp2, - iRegINoSp tmp3, iRegINoSp tmp4, rFlagsReg cr) + immI_1 int_cnt2, iRegI_R0 result, iRegINoSp tmp1, + iRegINoSp tmp2, iRegINoSp tmp3, iRegINoSp tmp4, rFlagsReg cr) %{ predicate(((StrIndexOfNode*)n)->encoding() == StrIntrinsicNode::UL); match(Set result (StrIndexOf (Binary str1 cnt1) (Binary str2 int_cnt2))); effect(USE_KILL str1, USE_KILL str2, USE_KILL cnt1, TEMP tmp1, TEMP tmp2, TEMP tmp3, TEMP tmp4, KILL cr); - format %{ "String IndexOf $str1,$cnt1,$str2,$int_cnt2 -> $result (UL)" %} + format %{ "String IndexOf $str1,$cnt1,$str2,$int_cnt2 -> $result (UL) " + "# KILL $str1 $cnt1 $str2 $tmp1 $tmp2 $tmp3 $tmp4 cr" %} ins_encode %{ int icnt2 = (int)$int_cnt2$$constant; @@ -15567,13 +15635,17 @@ instruct array_equalsB(iRegP_R1 ary1, iRegP_R2 ary2, iRegI_R0 result, iRegP_R3 tmp1, iRegP_R4 tmp2, iRegP_R5 tmp3, + vRegD_V0 vtmp0, vRegD_V1 vtmp1, vRegD_V2 vtmp2, vRegD_V3 vtmp3, + vRegD_V4 vtmp4, vRegD_V5 vtmp5, vRegD_V6 vtmp6, vRegD_V7 vtmp7, iRegP_R10 tmp, rFlagsReg cr) %{ predicate(((AryEqNode*)n)->encoding() == StrIntrinsicNode::LL); match(Set result (AryEq ary1 ary2)); - effect(KILL tmp, USE_KILL ary1, USE_KILL ary2, TEMP tmp1, TEMP tmp2, TEMP tmp3, KILL cr); + effect(KILL tmp, USE_KILL ary1, USE_KILL ary2, TEMP tmp1, TEMP tmp2, TEMP tmp3, + TEMP vtmp0, TEMP vtmp1, TEMP vtmp2, TEMP vtmp3, TEMP vtmp4, TEMP vtmp5, + TEMP vtmp6, TEMP vtmp7, KILL cr); - format %{ "Array Equals $ary1,ary2 -> $result // KILL $tmp" %} + format %{ "Array Equals $ary1,ary2 -> $result # KILL $ary1 $ary2 $tmp $tmp1 $tmp2 $tmp3 V0-V7 cr" %} ins_encode %{ address tpc = __ arrays_equals($ary1$$Register, $ary2$$Register, $tmp1$$Register, $tmp2$$Register, $tmp3$$Register, @@ -15588,13 +15660,17 @@ instruct array_equalsC(iRegP_R1 ary1, iRegP_R2 ary2, iRegI_R0 result, iRegP_R3 tmp1, iRegP_R4 tmp2, iRegP_R5 tmp3, + vRegD_V0 vtmp0, vRegD_V1 vtmp1, vRegD_V2 vtmp2, vRegD_V3 vtmp3, + vRegD_V4 vtmp4, vRegD_V5 vtmp5, vRegD_V6 vtmp6, vRegD_V7 vtmp7, iRegP_R10 tmp, rFlagsReg cr) %{ predicate(((AryEqNode*)n)->encoding() == StrIntrinsicNode::UU); match(Set result (AryEq ary1 ary2)); - effect(KILL tmp, USE_KILL ary1, USE_KILL ary2, TEMP tmp1, TEMP tmp2, TEMP tmp3, KILL cr); + effect(KILL tmp, USE_KILL ary1, USE_KILL ary2, TEMP tmp1, TEMP tmp2, TEMP tmp3, + TEMP vtmp0, TEMP vtmp1, TEMP vtmp2, TEMP vtmp3, TEMP vtmp4, TEMP vtmp5, + TEMP vtmp6, TEMP vtmp7, KILL cr); - format %{ "Array Equals $ary1,ary2 -> $result // KILL $tmp" %} + format %{ "Array Equals $ary1,ary2 -> $result # KILL $ary1 $ary2 $tmp $tmp1 $tmp2 $tmp3 V0-V7 cr" %} ins_encode %{ address tpc = __ arrays_equals($ary1$$Register, $ary2$$Register, $tmp1$$Register, $tmp2$$Register, $tmp3$$Register, @@ -15624,35 +15700,40 @@ // fast char[] to byte[] compression instruct string_compress(iRegP_R2 src, iRegP_R1 dst, iRegI_R3 len, - vRegD_V0 tmp1, vRegD_V1 tmp2, - vRegD_V2 tmp3, vRegD_V3 tmp4, + vRegD_V0 vtmp0, vRegD_V1 vtmp1, vRegD_V2 vtmp2, + vRegD_V3 vtmp3, vRegD_V4 vtmp4, vRegD_V5 vtmp5, iRegI_R0 result, rFlagsReg cr) %{ match(Set result (StrCompressedCopy src (Binary dst len))); - effect(TEMP tmp1, TEMP tmp2, TEMP tmp3, TEMP tmp4, USE_KILL src, USE_KILL dst, USE_KILL len, KILL cr); + effect(TEMP vtmp0, TEMP vtmp1, TEMP vtmp2, TEMP vtmp3, TEMP vtmp4, TEMP vtmp5, + USE_KILL src, USE_KILL dst, USE_KILL len, KILL cr); - format %{ "String Compress $src,$dst -> $result // KILL R1, R2, R3, R4" %} + format %{ "String Compress $src,$dst -> $result # KILL $src $dst $len V0-V5 cr" %} ins_encode %{ __ char_array_compress($src$$Register, $dst$$Register, $len$$Register, - $tmp1$$FloatRegister, $tmp2$$FloatRegister, - $tmp3$$FloatRegister, $tmp4$$FloatRegister, + $vtmp0$$FloatRegister, $vtmp1$$FloatRegister, + $vtmp2$$FloatRegister, $vtmp3$$FloatRegister, + $vtmp4$$FloatRegister, $vtmp5$$FloatRegister, $result$$Register); %} ins_pipe( pipe_slow ); %} // fast byte[] to char[] inflation -instruct string_inflate(Universe dummy, iRegP_R0 src, iRegP_R1 dst, iRegI_R2 len, - vRegD_V0 tmp1, vRegD_V1 tmp2, vRegD_V2 tmp3, iRegP_R3 tmp4, rFlagsReg cr) +instruct string_inflate(Universe dummy, iRegP_R0 src, iRegP_R1 dst, iRegI_R2 len, iRegP_R3 tmp, + vRegD_V0 vtmp0, vRegD_V1 vtmp1, vRegD_V2 vtmp2, vRegD_V3 vtmp3, + vRegD_V4 vtmp4, vRegD_V5 vtmp5, vRegD_V6 vtmp6, rFlagsReg cr) %{ match(Set dummy (StrInflatedCopy src (Binary dst len))); - effect(TEMP tmp1, TEMP tmp2, TEMP tmp3, TEMP tmp4, USE_KILL src, USE_KILL dst, USE_KILL len, KILL cr); + effect(TEMP vtmp0, TEMP vtmp1, TEMP vtmp2, TEMP vtmp3, + TEMP vtmp4, TEMP vtmp5, TEMP vtmp6, TEMP tmp, + USE_KILL src, USE_KILL dst, USE_KILL len, KILL cr); - format %{ "String Inflate $src,$dst // KILL $tmp1, $tmp2" %} + format %{ "String Inflate $src,$dst # KILL $tmp $src $dst $len V0-V6 cr" %} ins_encode %{ address tpc = __ byte_array_inflate($src$$Register, $dst$$Register, $len$$Register, - $tmp1$$FloatRegister, $tmp2$$FloatRegister, - $tmp3$$FloatRegister, $tmp4$$Register); + $vtmp0$$FloatRegister, $vtmp1$$FloatRegister, + $vtmp2$$FloatRegister, $tmp$$Register); if (tpc == NULL) { ciEnv::current()->record_failure("CodeCache is full"); return; @@ -15663,19 +15744,20 @@ // encode char[] to byte[] in ISO_8859_1 instruct encode_iso_array(iRegP_R2 src, iRegP_R1 dst, iRegI_R3 len, - vRegD_V0 Vtmp1, vRegD_V1 Vtmp2, - vRegD_V2 Vtmp3, vRegD_V3 Vtmp4, + vRegD_V0 vtmp0, vRegD_V1 vtmp1, vRegD_V2 vtmp2, + vRegD_V3 vtmp3, vRegD_V4 vtmp4, vRegD_V5 vtmp5, iRegI_R0 result, rFlagsReg cr) %{ match(Set result (EncodeISOArray src (Binary dst len))); - effect(USE_KILL src, USE_KILL dst, USE_KILL len, - KILL Vtmp1, KILL Vtmp2, KILL Vtmp3, KILL Vtmp4, KILL cr); + effect(USE_KILL src, USE_KILL dst, USE_KILL len, KILL vtmp0, KILL vtmp1, + KILL vtmp2, KILL vtmp3, KILL vtmp4, KILL vtmp5, KILL cr); - format %{ "Encode array $src,$dst,$len -> $result" %} + format %{ "Encode array $src,$dst,$len -> $result # KILL $src $dst $len V0-V5 cr" %} ins_encode %{ __ encode_iso_array($src$$Register, $dst$$Register, $len$$Register, - $result$$Register, $Vtmp1$$FloatRegister, $Vtmp2$$FloatRegister, - $Vtmp3$$FloatRegister, $Vtmp4$$FloatRegister); + $result$$Register, $vtmp0$$FloatRegister, $vtmp1$$FloatRegister, + $vtmp2$$FloatRegister, $vtmp3$$FloatRegister, + $vtmp4$$FloatRegister, $vtmp5$$FloatRegister); %} ins_pipe( pipe_class_memory ); %} diff -Nru openjdk-11-11.0.20+8/src/hotspot/cpu/aarch64/frame_aarch64.cpp openjdk-11-11.0.21+9/src/hotspot/cpu/aarch64/frame_aarch64.cpp --- openjdk-11-11.0.20+8/src/hotspot/cpu/aarch64/frame_aarch64.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/cpu/aarch64/frame_aarch64.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -542,7 +542,7 @@ // first the method - Method* m = *interpreter_frame_method_addr(); + Method* m = safe_interpreter_frame_method(); // validate the method we'd find in this potential sender if (!Method::is_valid_method(m)) return false; diff -Nru openjdk-11-11.0.20+8/src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp openjdk-11-11.0.21+9/src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp --- openjdk-11-11.0.20+8/src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -4332,6 +4332,7 @@ typedef void (MacroAssembler::* chr_insn)(Register Rt, const Address &adr); // Search for str1 in str2 and return index or -1 +// Clobbers: rscratch1, rscratch2, rflags. May also clobber v0-v1, when icnt1==-1. void MacroAssembler::string_indexof(Register str2, Register str1, Register cnt2, Register cnt1, Register tmp1, Register tmp2, @@ -5123,6 +5124,8 @@ return pc(); } +// Clobbers: rscratch1, rscratch2, rflags +// May also clobber v0-v7 when (!UseSimpleArrayEquals && UseSIMDForArrayEquals) address MacroAssembler::arrays_equals(Register a1, Register a2, Register tmp3, Register tmp4, Register tmp5, Register result, Register cnt1, int elem_size) { @@ -5615,10 +5618,13 @@ // Intrinsic for sun/nio/cs/ISO_8859_1$Encoder.implEncodeISOArray and // java/lang/StringUTF16.compress. +// +// Clobbers: src, dst, res, rscratch1, rscratch2, rflags void MacroAssembler::encode_iso_array(Register src, Register dst, - Register len, Register result, - FloatRegister Vtmp1, FloatRegister Vtmp2, - FloatRegister Vtmp3, FloatRegister Vtmp4) + Register len, Register result, + FloatRegister Vtmp1, FloatRegister Vtmp2, + FloatRegister Vtmp3, FloatRegister Vtmp4, + FloatRegister Vtmp5, FloatRegister Vtmp6) { Label DONE, SET_RESULT, NEXT_32, NEXT_32_PRFM, LOOP_8, NEXT_8, LOOP_1, NEXT_1, NEXT_32_START, NEXT_32_PRFM_START; @@ -5641,13 +5647,13 @@ ld1(Vtmp1, Vtmp2, Vtmp3, Vtmp4, T8H, src); BIND(NEXT_32_PRFM_START); prfm(Address(src, SoftwarePrefetchHintDistance)); - orr(v4, T16B, Vtmp1, Vtmp2); - orr(v5, T16B, Vtmp3, Vtmp4); + orr(Vtmp5, T16B, Vtmp1, Vtmp2); + orr(Vtmp6, T16B, Vtmp3, Vtmp4); uzp1(Vtmp1, T16B, Vtmp1, Vtmp2); uzp1(Vtmp3, T16B, Vtmp3, Vtmp4); - uzp2(v5, T16B, v4, v5); // high bytes - umov(tmp2, v5, D, 1); - fmovd(tmp1, v5); + uzp2(Vtmp6, T16B, Vtmp5, Vtmp6); // high bytes + umov(tmp2, Vtmp6, D, 1); + fmovd(tmp1, Vtmp6); orr(tmp1, tmp1, tmp2); cbnz(tmp1, LOOP_8); stpq(Vtmp1, Vtmp3, dst); @@ -5666,8 +5672,8 @@ ld1(Vtmp1, Vtmp2, Vtmp3, Vtmp4, T8H, src); } prfm(Address(src, SoftwarePrefetchHintDistance)); - uzp1(v4, T16B, Vtmp1, Vtmp2); - uzp1(v5, T16B, Vtmp3, Vtmp4); + uzp1(Vtmp5, T16B, Vtmp1, Vtmp2); + uzp1(Vtmp6, T16B, Vtmp3, Vtmp4); orr(Vtmp1, T16B, Vtmp1, Vtmp2); orr(Vtmp3, T16B, Vtmp3, Vtmp4); uzp2(Vtmp1, T16B, Vtmp1, Vtmp3); // high bytes @@ -5675,7 +5681,7 @@ fmovd(tmp1, Vtmp1); orr(tmp1, tmp1, tmp2); cbnz(tmp1, LOOP_8); - stpq(v4, v5, dst); + stpq(Vtmp5, Vtmp6, dst); sub(len, len, 32); add(dst, dst, 32); add(src, src, 64); @@ -5720,6 +5726,7 @@ // Inflate byte[] array to char[]. +// Clobbers: src, dst, len, rflags, rscratch1, v0-v6 address MacroAssembler::byte_array_inflate(Register src, Register dst, Register len, FloatRegister vtmp1, FloatRegister vtmp2, FloatRegister vtmp3, Register tmp4) { @@ -5828,9 +5835,10 @@ void MacroAssembler::char_array_compress(Register src, Register dst, Register len, FloatRegister tmp1Reg, FloatRegister tmp2Reg, FloatRegister tmp3Reg, FloatRegister tmp4Reg, + FloatRegister tmp5Reg, FloatRegister tmp6Reg, Register result) { encode_iso_array(src, dst, len, result, - tmp1Reg, tmp2Reg, tmp3Reg, tmp4Reg); + tmp1Reg, tmp2Reg, tmp3Reg, tmp4Reg, tmp5Reg, tmp6Reg); cmp(len, zr); csel(result, result, zr, EQ); } diff -Nru openjdk-11-11.0.20+8/src/hotspot/cpu/aarch64/macroAssembler_aarch64.hpp openjdk-11-11.0.21+9/src/hotspot/cpu/aarch64/macroAssembler_aarch64.hpp --- openjdk-11-11.0.20+8/src/hotspot/cpu/aarch64/macroAssembler_aarch64.hpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/cpu/aarch64/macroAssembler_aarch64.hpp 2023-10-06 05:33:33.000000000 +0000 @@ -1245,12 +1245,14 @@ void char_array_compress(Register src, Register dst, Register len, FloatRegister tmp1Reg, FloatRegister tmp2Reg, FloatRegister tmp3Reg, FloatRegister tmp4Reg, + FloatRegister tmp5Reg, FloatRegister tmp6Reg, Register result); void encode_iso_array(Register src, Register dst, Register len, Register result, FloatRegister Vtmp1, FloatRegister Vtmp2, - FloatRegister Vtmp3, FloatRegister Vtmp4); + FloatRegister Vtmp3, FloatRegister Vtmp4, + FloatRegister Vtmp5, FloatRegister Vtmp6); void string_indexof(Register str1, Register str2, Register cnt1, Register cnt2, Register tmp1, Register tmp2, diff -Nru openjdk-11-11.0.20+8/src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp openjdk-11-11.0.21+9/src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp --- openjdk-11-11.0.20+8/src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -4118,6 +4118,7 @@ // result = r0 - return value. Already contains "false" // cnt1 = r10 - amount of elements left to check, reduced by wordSize // r3-r5 are reserved temporary registers + // Clobbers: v0-v7 when UseSIMDForArrayEquals, rscratch1, rscratch2 address generate_large_array_equals() { Register a1 = r1, a2 = r2, result = r0, cnt1 = r10, tmp1 = rscratch1, tmp2 = rscratch2, tmp3 = r3, tmp4 = r4, tmp5 = r5, tmp6 = r11, @@ -4522,6 +4523,8 @@ // R2 = cnt1 // R3 = str1 // R4 = cnt2 + // Clobbers: rscratch1, rscratch2, v0, v1, rflags + // // This generic linear code use few additional ideas, which makes it faster: // 1) we can safely keep at least 1st register of pattern(since length >= 8) // in order to skip initial loading(help in systems with 1 ld pipeline) @@ -4836,6 +4839,7 @@ // R3 = len >> 3 // V0 = 0 // v1 = loaded 8 bytes + // Clobbers: r0, r1, r3, rscratch1, rflags, v0-v6 address generate_large_byte_array_inflate() { __ align(CodeEntryAlignment); StubCodeMark mark(this, "StubRoutines", "large_byte_array_inflate"); diff -Nru openjdk-11-11.0.20+8/src/hotspot/cpu/arm/frame_arm.cpp openjdk-11-11.0.21+9/src/hotspot/cpu/arm/frame_arm.cpp --- openjdk-11-11.0.20+8/src/hotspot/cpu/arm/frame_arm.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/cpu/arm/frame_arm.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -497,7 +497,7 @@ // first the method - Method* m = *interpreter_frame_method_addr(); + Method* m = safe_interpreter_frame_method(); // validate the method we'd find in this potential sender if (!Method::is_valid_method(m)) return false; diff -Nru openjdk-11-11.0.20+8/src/hotspot/cpu/ppc/frame_ppc.cpp openjdk-11-11.0.21+9/src/hotspot/cpu/ppc/frame_ppc.cpp --- openjdk-11-11.0.20+8/src/hotspot/cpu/ppc/frame_ppc.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/cpu/ppc/frame_ppc.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -302,7 +302,7 @@ // first the method - Method* m = *interpreter_frame_method_addr(); + Method* m = safe_interpreter_frame_method(); // validate the method we'd find in this potential sender if (!Method::is_valid_method(m)) return false; diff -Nru openjdk-11-11.0.20+8/src/hotspot/cpu/x86/frame_x86.cpp openjdk-11-11.0.21+9/src/hotspot/cpu/x86/frame_x86.cpp --- openjdk-11-11.0.20+8/src/hotspot/cpu/x86/frame_x86.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/cpu/x86/frame_x86.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -523,7 +523,7 @@ // do some validation of frame elements // first the method - Method* m = *interpreter_frame_method_addr(); + Method* m = safe_interpreter_frame_method(); // validate the method we'd find in this potential sender if (!Method::is_valid_method(m)) return false; diff -Nru openjdk-11-11.0.20+8/src/hotspot/os/linux/os_linux.cpp openjdk-11-11.0.21+9/src/hotspot/os/linux/os_linux.cpp --- openjdk-11-11.0.20+8/src/hotspot/os/linux/os_linux.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/os/linux/os_linux.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -835,6 +835,106 @@ return 0; } +// On Linux, glibc places static TLS blocks (for __thread variables) on +// the thread stack. This decreases the stack size actually available +// to threads. +// +// For large static TLS sizes, this may cause threads to malfunction due +// to insufficient stack space. This is a well-known issue in glibc: +// http://sourceware.org/bugzilla/show_bug.cgi?id=11787. +// +// As a workaround, we call a private but assumed-stable glibc function, +// __pthread_get_minstack() to obtain the minstack size and derive the +// static TLS size from it. We then increase the user requested stack +// size by this TLS size. The same function is used to determine whether +// adjustStackSizeForGuardPages() needs to be true. +// +// Due to compatibility concerns, this size adjustment is opt-in and +// controlled via AdjustStackSizeForTLS. +typedef size_t (*GetMinStack)(const pthread_attr_t *attr); + +GetMinStack _get_minstack_func = NULL; // Initialized via os::init_2() + +// Returns the size of the static TLS area glibc puts on thread stacks. +// The value is cached on first use, which occurs when the first thread +// is created during VM initialization. +static size_t get_static_tls_area_size(const pthread_attr_t *attr) { + size_t tls_size = 0; + if (_get_minstack_func != NULL) { + // Obtain the pthread minstack size by calling __pthread_get_minstack. + size_t minstack_size = _get_minstack_func(attr); + + // Remove non-TLS area size included in minstack size returned + // by __pthread_get_minstack() to get the static TLS size. + // If adjustStackSizeForGuardPages() is true, minstack size includes + // guard_size. Otherwise guard_size is automatically added + // to the stack size by pthread_create and is no longer included + // in minstack size. In both cases, the guard_size is taken into + // account, so there is no need to adjust the result for that. + // + // Although __pthread_get_minstack() is a private glibc function, + // it is expected to have a stable behavior across future glibc + // versions while glibc still allocates the static TLS blocks off + // the stack. Following is glibc 2.28 __pthread_get_minstack(): + // + // size_t + // __pthread_get_minstack (const pthread_attr_t *attr) + // { + // return GLRO(dl_pagesize) + __static_tls_size + PTHREAD_STACK_MIN; + // } + // + // + // The following 'minstack_size > os::vm_page_size() + PTHREAD_STACK_MIN' + // if check is done for precaution. + if (minstack_size > (size_t)os::vm_page_size() + PTHREAD_STACK_MIN) { + tls_size = minstack_size - (size_t)os::vm_page_size() - PTHREAD_STACK_MIN; + } + } + + log_info(os, thread)("Stack size adjustment for TLS is " SIZE_FORMAT, + tls_size); + return tls_size; +} + +// In glibc versions prior to 2.27 the guard size mechanism +// was not implemented properly. The POSIX standard requires adding +// the size of the guard pages to the stack size, instead glibc +// took the space out of 'stacksize'. Thus we need to adapt the requested +// stack_size by the size of the guard pages to mimic proper behaviour. +// The fix in glibc 2.27 has now been backported to numerous earlier +// glibc versions so we need to do a dynamic runtime check. +static bool _adjustStackSizeForGuardPages = true; +bool os::Linux::adjustStackSizeForGuardPages() { + return _adjustStackSizeForGuardPages; +} + +// Dummy decl as substitute for cmdline parameter. TLS not in jdk11. +static const bool AdjustStackSizeForTLS = false; + +#if defined(__GLIBC__) +static void init_adjust_stacksize_for_guard_pages() { + assert(_get_minstack_func == NULL, "initialization error"); + _get_minstack_func =(GetMinStack)dlsym(RTLD_DEFAULT, "__pthread_get_minstack"); + log_info(os, thread)("Lookup of __pthread_get_minstack %s", + _get_minstack_func == NULL ? "failed" : "succeeded"); + + if (_get_minstack_func != NULL) { + pthread_attr_t attr; + pthread_attr_init(&attr); + size_t min_stack = _get_minstack_func(&attr); + size_t guard = 16 * K; // Actual value doesn't matter as it is not examined + pthread_attr_setguardsize(&attr, guard); + size_t min_stack2 = _get_minstack_func(&attr); + pthread_attr_destroy(&attr); + // If the minimum stack size changed when we added the guard page space + // then we need to perform the adjustment. + _adjustStackSizeForGuardPages = (min_stack2 != min_stack); + log_info(os)("Glibc stack size guard page adjustment is %sneeded", + _adjustStackSizeForGuardPages ? "" : "not "); + } +} +#endif // GLIBC + bool os::create_thread(Thread* thread, ThreadType thr_type, size_t req_stack_size) { assert(thread->osthread() == NULL, "caller responsible"); @@ -860,16 +960,24 @@ // Calculate stack size if it's not specified by caller. size_t stack_size = os::Posix::get_initial_stack_size(thr_type, req_stack_size); - // In the Linux NPTL pthread implementation the guard size mechanism - // is not implemented properly. The posix standard requires adding - // the size of the guard pages to the stack size, instead Linux - // takes the space out of 'stacksize'. Thus we adapt the requested - // stack_size by the size of the guard pages to mimick proper - // behaviour. However, be careful not to end up with a size - // of zero due to overflow. Don't add the guard page in that case. size_t guard_size = os::Linux::default_guard_size(thr_type); - if (stack_size <= SIZE_MAX - guard_size) { - stack_size += guard_size; + // Configure glibc guard page. Must happen before calling + // get_static_tls_area_size(), which uses the guard_size. + pthread_attr_setguardsize(&attr, guard_size); + + // Apply stack size adjustments if needed. However, be careful not to end up + // with a size of zero due to overflow. Don't add the adjustment in that case. + size_t stack_adjust_size = 0; + if (AdjustStackSizeForTLS) { + // Adjust the stack_size for on-stack TLS - see get_static_tls_area_size(). + stack_adjust_size += get_static_tls_area_size(&attr); + } else if (os::Linux::adjustStackSizeForGuardPages()) { + stack_adjust_size += guard_size; + } + + stack_adjust_size = align_up(stack_adjust_size, os::vm_page_size()); + if (stack_size <= SIZE_MAX - stack_adjust_size) { + stack_size += stack_adjust_size; } assert(is_aligned(stack_size, os::vm_page_size()), "stack_size not aligned"); @@ -1005,8 +1113,10 @@ // and save the caller's signal mask os::Linux::hotspot_sigmask(thread); - log_info(os, thread)("Thread attached (tid: " UINTX_FORMAT ", pthread id: " UINTX_FORMAT ").", - os::current_thread_id(), (uintx) pthread_self()); + log_info(os, thread)("Thread attached (tid: " UINTX_FORMAT ", pthread id: " UINTX_FORMAT + ", stack: " PTR_FORMAT " - " PTR_FORMAT " (" SIZE_FORMAT "k) ).", + os::current_thread_id(), (uintx) pthread_self(), + p2i(thread->stack_base()), p2i(thread->stack_end()), thread->stack_size() / K); return true; } @@ -1421,7 +1531,7 @@ // Note, that some kernels may support the current thread // clock (CLOCK_THREAD_CPUTIME_ID) but not the clocks // returned by the pthread_getcpuclockid(). - // If the fast Posix clocks are supported then the sys_clock_getres() + // If the fast POSIX clocks are supported then the clock_getres() // must return at least tp.tv_sec == 0 which means a resolution // better than 1 sec. This is extra check for reliability. @@ -5518,6 +5628,11 @@ log_info(os)("HotSpot is running with %s, %s", Linux::libc_version(), Linux::libpthread_version()); +#ifdef __GLIBC__ + // Check if we need to adjust the stack size for glibc guard pages. + init_adjust_stacksize_for_guard_pages(); +#endif + if (UseNUMA) { if (!Linux::libnuma_init()) { UseNUMA = false; @@ -6410,9 +6525,9 @@ // // ** P1 (aka bottom) and size (P2 = P1 - size) are the address and stack size // returned from pthread_attr_getstack(). -// ** Due to NPTL implementation error, linux takes the glibc guard page out -// of the stack size given in pthread_attr. We work around this for -// threads created by the VM. (We adapt bottom to be P1 and size accordingly.) +// ** If adjustStackSizeForGuardPages() is true the guard pages have been taken +// out of the stack size given in pthread_attr. We work around this for +// threads created by the VM. We adjust bottom to be P1 and size accordingly. // #ifndef ZERO static void current_stack_region(address * bottom, size_t * size) { @@ -6439,14 +6554,15 @@ fatal("Cannot locate current stack attributes!"); } - // Work around NPTL stack guard error. - size_t guard_size = 0; - rslt = pthread_attr_getguardsize(&attr, &guard_size); - if (rslt != 0) { - fatal("pthread_attr_getguardsize failed with error = %d", rslt); - } - *bottom += guard_size; - *size -= guard_size; + if (os::Linux::adjustStackSizeForGuardPages()) { + size_t guard_size = 0; + rslt = pthread_attr_getguardsize(&attr, &guard_size); + if (rslt != 0) { + fatal("pthread_attr_getguardsize failed with error = %d", rslt); + } + *bottom += guard_size; + *size -= guard_size; + } pthread_attr_destroy(&attr); diff -Nru openjdk-11-11.0.20+8/src/hotspot/os/linux/os_linux.hpp openjdk-11-11.0.21+9/src/hotspot/os/linux/os_linux.hpp --- openjdk-11-11.0.20+8/src/hotspot/os/linux/os_linux.hpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/os/linux/os_linux.hpp 2023-10-06 05:33:33.000000000 +0000 @@ -198,6 +198,8 @@ // Return default guard size for the specified thread type static size_t default_guard_size(os::ThreadType thr_type); + static bool adjustStackSizeForGuardPages(); // See comments in os_linux.cpp + static void capture_initial_stack(size_t max_size); // Stack overflow handling diff -Nru openjdk-11-11.0.20+8/src/hotspot/os/posix/os_posix.cpp openjdk-11-11.0.21+9/src/hotspot/os/posix/os_posix.cpp --- openjdk-11-11.0.20+8/src/hotspot/os/posix/os_posix.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/os/posix/os_posix.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -1429,8 +1429,8 @@ int detachstate = 0; pthread_attr_getstacksize(attr, &stack_size); pthread_attr_getguardsize(attr, &guard_size); - // Work around linux NPTL implementation error, see also os::create_thread() in os_linux.cpp. - LINUX_ONLY(stack_size -= guard_size); + // Work around glibc stack guard issue, see os::create_thread() in os_linux.cpp. + LINUX_ONLY(if (os::Linux::adjustStackSizeForGuardPages()) stack_size -= guard_size;) pthread_attr_getdetachstate(attr, &detachstate); jio_snprintf(buf, buflen, "stacksize: " SIZE_FORMAT "k, guardsize: " SIZE_FORMAT "k, %s", stack_size / 1024, guard_size / 1024, diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/c1/c1_LinearScan.cpp openjdk-11-11.0.21+9/src/hotspot/share/c1/c1_LinearScan.cpp --- openjdk-11-11.0.20+8/src/hotspot/share/c1/c1_LinearScan.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/c1/c1_LinearScan.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -1947,6 +1947,14 @@ // interval at the throwing instruction must be searched using the operands // of the phi function Value from_value = phi->operand_at(handler->phi_operand()); + if (from_value == NULL) { + // We have reached here in a kotlin application running with JVMTI + // capability "can_access_local_variables". + // The illegal state is not yet propagated to this phi. Do it here. + phi->make_illegal(); + // We can skip the illegal phi edge. + return; + } // with phi functions it can happen that the same from_value is used in // multiple mappings, so notify move-resolver that this is allowed diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/classfile/altHashing.cpp openjdk-11-11.0.21+9/src/hotspot/share/classfile/altHashing.cpp --- openjdk-11-11.0.20+8/src/hotspot/share/classfile/altHashing.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/classfile/altHashing.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012, 2020, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2012, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -31,9 +31,7 @@ /* SipHash reference C implementation - Copyright (c) 2012-2021 Jean-Philippe Aumasson - - Copyright (c) 2012-2014 Daniel J. Bernstein + Copyright (c) 2016 Jean-Philippe Aumasson To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/classfile/dictionary.cpp openjdk-11-11.0.21+9/src/hotspot/share/classfile/dictionary.cpp --- openjdk-11-11.0.20+8/src/hotspot/share/classfile/dictionary.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/classfile/dictionary.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -208,6 +208,7 @@ if (lt.is_enabled()) { LogStream ls(lt); print_count(&ls); + ls.cr(); } } diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/classfile/dictionary.hpp openjdk-11-11.0.21+9/src/hotspot/share/classfile/dictionary.hpp --- openjdk-11-11.0.20+8/src/hotspot/share/classfile/dictionary.hpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/classfile/dictionary.hpp 2023-10-06 05:33:33.000000000 +0000 @@ -195,7 +195,7 @@ current = current->_next) { count++; } - st->print_cr("pd set count = #%d", count); + st->print("pd set count = #%d", count); } void verify(); diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/classfile/loaderConstraints.cpp openjdk-11-11.0.21+9/src/hotspot/share/classfile/loaderConstraints.cpp --- openjdk-11-11.0.20+8/src/hotspot/share/classfile/loaderConstraints.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/classfile/loaderConstraints.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -189,6 +189,7 @@ bool LoaderConstraintTable::add_entry(Symbol* class_name, InstanceKlass* klass1, Handle class_loader1, InstanceKlass* klass2, Handle class_loader2) { + LogTarget(Info, class, loader, constraints) lt; if (klass1 != NULL && klass2 != NULL) { if (klass1 == klass2) { @@ -242,9 +243,8 @@ p->set_loaders(NEW_C_HEAP_ARRAY(ClassLoaderData*, 2, mtClass)); p->set_loader(0, class_loader1()); p->set_loader(1, class_loader2()); - p->set_klass(klass); - p->set_next(bucket(index)); - set_entry(index, p); + Hashtable::add_entry(index, p); + if (lt.is_enabled()) { ResourceMark rm; lt.print("adding new constraint for name: %s, loader[0]: %s," @@ -478,13 +478,15 @@ probe != NULL; probe = probe->next()) { st->print("%4d: ", cindex); - probe->name()->print_on(st); - st->print(" , loaders:"); + st->print("Symbol: %s loaders:", probe->name()->as_C_string()); for (int n = 0; n < probe->num_loaders(); n++) { + st->cr(); + st->print(" "); probe->loader_data(n)->print_value_on(st); - st->print(", "); } st->cr(); } } } + +void LoaderConstraintTable::print() const { print_on(tty); } diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/classfile/loaderConstraints.hpp openjdk-11-11.0.21+9/src/hotspot/share/classfile/loaderConstraints.hpp --- openjdk-11-11.0.20+8/src/hotspot/share/classfile/loaderConstraints.hpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/classfile/loaderConstraints.hpp 2023-10-06 05:33:33.000000000 +0000 @@ -79,6 +79,7 @@ void purge_loader_constraints(); void verify(PlaceholderTable* placeholders); + void print() const; void print_on(outputStream* st) const; }; diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/gc/cms/concurrentMarkSweepGeneration.cpp openjdk-11-11.0.21+9/src/hotspot/share/gc/cms/concurrentMarkSweepGeneration.cpp --- openjdk-11-11.0.20+8/src/hotspot/share/gc/cms/concurrentMarkSweepGeneration.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/gc/cms/concurrentMarkSweepGeneration.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -5788,6 +5788,9 @@ if (!_virtual_space.initialize(rs, rs.size())) { fatal("Not enough swap for expanded marking stack"); } + // Record NMT memory type + MemTracker::record_virtual_memory_type(rs.base(), mtGC); + _base = (oop*)(_virtual_space.low()); _index = 0; _capacity = new_capacity; diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/gc/shared/stringdedup/stringDedupTable.cpp openjdk-11-11.0.21+9/src/hotspot/share/gc/shared/stringdedup/stringDedupTable.cpp --- openjdk-11-11.0.20+8/src/hotspot/share/gc/shared/stringdedup/stringDedupTable.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/gc/shared/stringdedup/stringDedupTable.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -506,6 +506,7 @@ while (*entry != NULL) { oop* p = (oop*)(*entry)->obj_addr(); if (cl->is_alive(*p)) { + typeArrayOop value = (typeArrayOop)*p; cl->keep_alive(p); if (is_resizing()) { // We are resizing the table, transfer entry to the new table @@ -517,7 +518,6 @@ // at this point since we don't have exclusive access to all // destination partitions. finish_rehash() will do a single // threaded transfer of all entries. - typeArrayOop value = (typeArrayOop)*p; bool latin1 = (*entry)->latin1(); unsigned int hash = hash_code(value, latin1); (*entry)->set_hash(hash); diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/interpreter/interpreterRuntime.cpp openjdk-11-11.0.21+9/src/hotspot/share/interpreter/interpreterRuntime.cpp --- openjdk-11-11.0.20+8/src/hotspot/share/interpreter/interpreterRuntime.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/interpreter/interpreterRuntime.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -854,24 +854,17 @@ CallInfo info; constantPoolHandle pool(thread, last_frame.method()->constants()); + methodHandle resolved_method; + { JvmtiHideSingleStepping jhss(thread); LinkResolver::resolve_invoke(info, receiver, pool, last_frame.get_index_u2_cpcache(bytecode), bytecode, CHECK); - if (JvmtiExport::can_hotswap_or_post_breakpoint()) { - int retry_count = 0; - while (info.resolved_method()->is_old()) { - // It is very unlikely that method is redefined more than 100 times - // in the middle of resolve. If it is looping here more than 100 times - // means then there could be a bug here. - guarantee((retry_count++ < 100), - "Could not resolve to latest version of redefined method"); - // method is redefined in the middle of resolve so re-try. - LinkResolver::resolve_invoke(info, receiver, pool, - last_frame.get_index_u2_cpcache(bytecode), bytecode, - CHECK); - } + if (JvmtiExport::can_hotswap_or_post_breakpoint() && info.resolved_method()->is_old()) { + resolved_method = methodHandle(thread, info.resolved_method()->get_new_method()); + } else { + resolved_method = info.resolved_method(); } } // end JvmtiHideSingleStepping @@ -881,22 +874,20 @@ #ifdef ASSERT if (bytecode == Bytecodes::_invokeinterface) { - if (info.resolved_method()->method_holder() == - SystemDictionary::Object_klass()) { + if (resolved_method->method_holder() == SystemDictionary::Object_klass()) { // NOTE: THIS IS A FIX FOR A CORNER CASE in the JVM spec // (see also CallInfo::set_interface for details) assert(info.call_kind() == CallInfo::vtable_call || info.call_kind() == CallInfo::direct_call, ""); - methodHandle rm = info.resolved_method(); - assert(rm->is_final() || info.has_vtable_index(), + assert(resolved_method->is_final() || info.has_vtable_index(), "should have been set already"); - } else if (!info.resolved_method()->has_itable_index()) { + } else if (!resolved_method->has_itable_index()) { // Resolved something like CharSequence.toString. Use vtable not itable. assert(info.call_kind() != CallInfo::itable_call, ""); } else { // Setup itable entry assert(info.call_kind() == CallInfo::itable_call, ""); - int index = info.resolved_method()->itable_index(); + int index = resolved_method->itable_index(); assert(info.itable_index() == index, ""); } } else if (bytecode == Bytecodes::_invokespecial) { @@ -916,20 +907,20 @@ case CallInfo::direct_call: cp_cache_entry->set_direct_call( bytecode, - info.resolved_method(), + resolved_method, sender->is_interface()); break; case CallInfo::vtable_call: cp_cache_entry->set_vtable_call( bytecode, - info.resolved_method(), + resolved_method, info.vtable_index()); break; case CallInfo::itable_call: cp_cache_entry->set_itable_call( bytecode, info.resolved_klass(), - info.resolved_method(), + resolved_method, info.itable_index()); break; default: ShouldNotReachHere(); diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/memory/metaspace.cpp openjdk-11-11.0.21+9/src/hotspot/share/memory/metaspace.cpp --- openjdk-11-11.0.20+8/src/hotspot/share/memory/metaspace.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/memory/metaspace.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -758,6 +758,7 @@ out->print_cr(" Non-Class:"); } Metaspace::space_list()->print_on(out, scale); + out->cr(); if (Metaspace::using_class_space()) { out->print_cr(" Class:"); Metaspace::class_space_list()->print_on(out, scale); diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/memory/metaspaceShared.cpp openjdk-11-11.0.21+9/src/hotspot/share/memory/metaspaceShared.cpp --- openjdk-11-11.0.20+8/src/hotspot/share/memory/metaspaceShared.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/memory/metaspaceShared.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -1344,12 +1344,6 @@ FileMapInfo::check_nonempty_dir_in_shared_path_table(); NOT_PRODUCT(SystemDictionary::verify();) - // The following guarantee is meant to ensure that no loader constraints - // exist yet, since the constraints table is not shared. This becomes - // more important now that we don't re-initialize vtables/itables for - // shared classes at runtime, where constraints were previously created. - guarantee(SystemDictionary::constraints()->number_of_entries() == 0, - "loader constraints are not saved"); guarantee(SystemDictionary::placeholders()->number_of_entries() == 0, "placeholders are not saved"); // Revisit and implement this if we prelink method handle call sites: diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/oops/klass.cpp openjdk-11-11.0.21+9/src/hotspot/share/oops/klass.cpp --- openjdk-11-11.0.20+8/src/hotspot/share/oops/klass.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/oops/klass.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -25,7 +25,7 @@ #include "precompiled.hpp" #include "classfile/classLoaderData.inline.hpp" #include "classfile/dictionary.hpp" -#include "classfile/javaClasses.hpp" +#include "classfile/javaClasses.inline.hpp" #include "classfile/systemDictionary.hpp" #include "classfile/vmSymbols.hpp" #include "gc/shared/collectedHeap.inline.hpp" @@ -735,7 +735,7 @@ } if (java_mirror_no_keepalive() != NULL) { - guarantee(oopDesc::is_oop(java_mirror_no_keepalive()), "should be instance"); + guarantee(java_lang_Class::is_instance(java_mirror_no_keepalive()), "should be instance"); } } diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/oops/klass.hpp openjdk-11-11.0.21+9/src/hotspot/share/oops/klass.hpp --- openjdk-11-11.0.20+8/src/hotspot/share/oops/klass.hpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/oops/klass.hpp 2023-10-06 05:33:33.000000000 +0000 @@ -269,9 +269,8 @@ // Both mirrors are on the ClassLoaderData::_handles list already so no // barriers are needed. void set_java_mirror_handle(OopHandle mirror) { _java_mirror = mirror; } - OopHandle java_mirror_handle() const { - return _java_mirror; - } + OopHandle java_mirror_handle() const { return _java_mirror; } + void swap_java_mirror_handle(OopHandle& mirror) { _java_mirror.swap(mirror); } // modifier flags jint modifier_flags() const { return _modifier_flags; } diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/oops/method.hpp openjdk-11-11.0.21+9/src/hotspot/share/oops/method.hpp --- openjdk-11-11.0.20+8/src/hotspot/share/oops/method.hpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/oops/method.hpp 2023-10-06 05:33:33.000000000 +0000 @@ -984,6 +984,15 @@ // Deallocation function for redefine classes or if an error occurs void deallocate_contents(ClassLoaderData* loader_data); + Method* get_new_method() const { + InstanceKlass* holder = method_holder(); + Method* new_method = holder->method_with_idnum(orig_method_idnum()); + + assert(new_method != NULL, "method_with_idnum() should not be null"); + assert(this != new_method, "sanity check"); + return new_method; + } + // Printing #ifndef PRODUCT void print_on(outputStream* st) const; diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/oops/oopHandle.hpp openjdk-11-11.0.21+9/src/hotspot/share/oops/oopHandle.hpp --- openjdk-11-11.0.20+8/src/hotspot/share/oops/oopHandle.hpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/oops/oopHandle.hpp 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2017, 2022, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -43,6 +43,10 @@ OopHandle() : _obj(NULL) {} OopHandle(oop* w) : _obj(w) {} + void swap(OopHandle& copy) { + ::swap(_obj, copy._obj); + } + inline oop resolve() const; inline oop peek() const; diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/opto/library_call.cpp openjdk-11-11.0.21+9/src/hotspot/share/opto/library_call.cpp --- openjdk-11-11.0.20+8/src/hotspot/share/opto/library_call.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/opto/library_call.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -279,8 +279,13 @@ bool inline_arraycopy(); AllocateArrayNode* tightly_coupled_allocation(Node* ptr, RegionNode* slow_region); + static CallStaticJavaNode* get_uncommon_trap_from_success_proj(Node* node); + SafePointNode* create_safepoint_with_state_before_array_allocation(const AllocateArrayNode* alloc) const; + void replace_unrelated_uncommon_traps_with_alloc_state(AllocateArrayNode* alloc, JVMState* saved_jvms_before_guards); + void replace_unrelated_uncommon_traps_with_alloc_state(JVMState* saved_jvms_before_guards); + void create_new_uncommon_trap(CallStaticJavaNode* uncommon_trap_call); JVMState* arraycopy_restore_alloc_state(AllocateArrayNode* alloc, int& saved_reexecute_sp); - void arraycopy_move_allocation_here(AllocateArrayNode* alloc, Node* dest, JVMState* saved_jvms, int saved_reexecute_sp, + void arraycopy_move_allocation_here(AllocateArrayNode* alloc, Node* dest, JVMState* saved_jvms_before_guards, int saved_reexecute_sp, uint new_idx); typedef enum { LS_get_add, LS_get_set, LS_cmp_swap, LS_cmp_swap_weak, LS_cmp_exchange } LoadStoreKind; @@ -1428,7 +1433,7 @@ } assert(callee()->signature()->size() == 4, "String.indexOfChar() has 4 arguments"); Node* src = argument(0); // byte[] - Node* tgt = argument(1); // tgt is int ch + Node* int_ch = argument(1); Node* from_index = argument(2); Node* max = argument(3); @@ -1440,6 +1445,15 @@ // Range checks generate_string_range_check(src, src_offset, src_count, true); + + // Check for int_ch >= 0 + Node* int_ch_cmp = _gvn.transform(new CmpINode(int_ch, intcon(0))); + Node* int_ch_bol = _gvn.transform(new BoolNode(int_ch_cmp, BoolTest::ge)); + { + BuildCutout unless(this, int_ch_bol, PROB_MAX); + uncommon_trap(Deoptimization::Reason_intrinsic, + Deoptimization::Action_maybe_recompile); + } if (stopped()) { return true; } @@ -1447,7 +1461,7 @@ RegionNode* region = new RegionNode(3); Node* phi = new PhiNode(region, TypeInt::INT); - Node* result = new StrIndexOfCharNode(control(), memory(TypeAryPtr::BYTES), src_start, src_count, tgt, StrIntrinsicNode::none); + Node* result = new StrIndexOfCharNode(control(), memory(TypeAryPtr::BYTES), src_start, src_count, int_ch, StrIntrinsicNode::none); C->set_has_split_ifs(true); // Has chance for split-if optimization _gvn.transform(result); @@ -4534,24 +4548,7 @@ } if (no_interfering_store) { - JVMState* old_jvms = alloc->jvms()->clone_shallow(C); - uint size = alloc->req(); - SafePointNode* sfpt = new SafePointNode(size, old_jvms); - old_jvms->set_map(sfpt); - for (uint i = 0; i < size; i++) { - sfpt->init_req(i, alloc->in(i)); - } - // re-push array length for deoptimization - sfpt->ins_req(old_jvms->stkoff() + old_jvms->sp(), alloc->in(AllocateNode::ALength)); - old_jvms->set_sp(old_jvms->sp()+1); - old_jvms->set_monoff(old_jvms->monoff()+1); - old_jvms->set_scloff(old_jvms->scloff()+1); - old_jvms->set_endoff(old_jvms->endoff()+1); - old_jvms->set_should_reexecute(true); - - sfpt->set_i_o(map()->i_o()); - sfpt->set_memory(map()->memory()); - sfpt->set_control(map()->control()); + SafePointNode* sfpt = create_safepoint_with_state_before_array_allocation(alloc); JVMState* saved_jvms = jvms(); saved_reexecute_sp = _reexecute_sp; @@ -4566,6 +4563,30 @@ return NULL; } +// Clone the JVMState of the array allocation and create a new safepoint with it. Re-push the array length to the stack +// such that uncommon traps can be emitted to re-execute the array allocation in the interpreter. +SafePointNode* LibraryCallKit::create_safepoint_with_state_before_array_allocation(const AllocateArrayNode* alloc) const { + JVMState* old_jvms = alloc->jvms()->clone_shallow(C); + uint size = alloc->req(); + SafePointNode* sfpt = new SafePointNode(size, old_jvms); + old_jvms->set_map(sfpt); + for (uint i = 0; i < size; i++) { + sfpt->init_req(i, alloc->in(i)); + } + // re-push array length for deoptimization + sfpt->ins_req(old_jvms->stkoff() + old_jvms->sp(), alloc->in(AllocateNode::ALength)); + old_jvms->set_sp(old_jvms->sp()+1); + old_jvms->set_monoff(old_jvms->monoff()+1); + old_jvms->set_scloff(old_jvms->scloff()+1); + old_jvms->set_endoff(old_jvms->endoff()+1); + old_jvms->set_should_reexecute(true); + + sfpt->set_i_o(map()->i_o()); + sfpt->set_memory(map()->memory()); + sfpt->set_control(map()->control()); + return sfpt; +} + // In case of a deoptimization, we restart execution at the // allocation, allocating a new array. We would leave an uninitialized // array in the heap that GCs wouldn't expect. Move the allocation @@ -4573,18 +4594,20 @@ // deoptimize. This is possible because tightly_coupled_allocation() // guarantees there's no observer of the allocated array at this point // and the control flow is simple enough. -void LibraryCallKit::arraycopy_move_allocation_here(AllocateArrayNode* alloc, Node* dest, JVMState* saved_jvms, +void LibraryCallKit::arraycopy_move_allocation_here(AllocateArrayNode* alloc, Node* dest, JVMState* saved_jvms_before_guards, int saved_reexecute_sp, uint new_idx) { - if (saved_jvms != NULL && !stopped()) { + if (saved_jvms_before_guards != NULL && !stopped()) { + replace_unrelated_uncommon_traps_with_alloc_state(alloc, saved_jvms_before_guards); + assert(alloc != NULL, "only with a tightly coupled allocation"); // restore JVM state to the state at the arraycopy - saved_jvms->map()->set_control(map()->control()); - assert(saved_jvms->map()->memory() == map()->memory(), "memory state changed?"); - assert(saved_jvms->map()->i_o() == map()->i_o(), "IO state changed?"); + saved_jvms_before_guards->map()->set_control(map()->control()); + assert(saved_jvms_before_guards->map()->memory() == map()->memory(), "memory state changed?"); + assert(saved_jvms_before_guards->map()->i_o() == map()->i_o(), "IO state changed?"); // If we've improved the types of some nodes (null check) while // emitting the guards, propagate them to the current state - map()->replaced_nodes().apply(saved_jvms->map(), new_idx); - set_jvms(saved_jvms); + map()->replaced_nodes().apply(saved_jvms_before_guards->map(), new_idx); + set_jvms(saved_jvms_before_guards); _reexecute_sp = saved_reexecute_sp; // Remove the allocation from above the guards @@ -4660,6 +4683,58 @@ } } +// Unrelated UCTs between the array allocation and the array copy, which are considered safe by tightly_coupled_allocation(), +// need to be replaced by an UCT with a state before the array allocation (including the array length). This is necessary +// because we could hit one of these UCTs (which are executed before the emitted array copy guards and the actual array +// allocation which is moved down in arraycopy_move_allocation_here()). When later resuming execution in the interpreter, +// we would have wrongly skipped the array allocation. To prevent this, we resume execution at the array allocation in +// the interpreter similar to what we are doing for the newly emitted guards for the array copy. +void LibraryCallKit::replace_unrelated_uncommon_traps_with_alloc_state(AllocateArrayNode* alloc, + JVMState* saved_jvms_before_guards) { + if (saved_jvms_before_guards->map()->control()->is_IfProj()) { + // There is at least one unrelated uncommon trap which needs to be replaced. + SafePointNode* sfpt = create_safepoint_with_state_before_array_allocation(alloc); + + JVMState* saved_jvms = jvms(); + const int saved_reexecute_sp = _reexecute_sp; + set_jvms(sfpt->jvms()); + _reexecute_sp = jvms()->sp(); + + replace_unrelated_uncommon_traps_with_alloc_state(saved_jvms_before_guards); + + // Restore state + set_jvms(saved_jvms); + _reexecute_sp = saved_reexecute_sp; + } +} + +// Replace the unrelated uncommon traps with new uncommon trap nodes by reusing the action and reason. The new uncommon +// traps will have the state of the array allocation. Let the old uncommon trap nodes die. +void LibraryCallKit::replace_unrelated_uncommon_traps_with_alloc_state(JVMState* saved_jvms_before_guards) { + Node* if_proj = saved_jvms_before_guards->map()->control(); // Start the search right before the newly emitted guards + while (if_proj->is_IfProj()) { + CallStaticJavaNode* uncommon_trap = get_uncommon_trap_from_success_proj(if_proj); + if (uncommon_trap != NULL) { + create_new_uncommon_trap(uncommon_trap); + } + assert(if_proj->in(0)->is_If(), "must be If"); + if_proj = if_proj->in(0)->in(0); + } + assert(if_proj->is_Proj() && if_proj->in(0)->is_Initialize(), + "must have reached control projection of init node"); +} + +void LibraryCallKit::create_new_uncommon_trap(CallStaticJavaNode* uncommon_trap_call) { + const int trap_request = uncommon_trap_call->uncommon_trap_request(); + assert(trap_request != 0, "no valid UCT trap request"); + PreserveJVMState pjvms(this); + set_control(uncommon_trap_call->in(0)); + uncommon_trap(Deoptimization::trap_request_reason(trap_request), + Deoptimization::trap_request_action(trap_request)); + assert(stopped(), "Should be stopped"); + _gvn.hash_delete(uncommon_trap_call); + uncommon_trap_call->set_req(0, top()); // not used anymore, kill it +} //------------------------------inline_arraycopy----------------------- // public static native void java.lang.System.arraycopy(Object src, int srcPos, @@ -4680,12 +4755,12 @@ AllocateArrayNode* alloc = tightly_coupled_allocation(dest, NULL); int saved_reexecute_sp = -1; - JVMState* saved_jvms = arraycopy_restore_alloc_state(alloc, saved_reexecute_sp); + JVMState* saved_jvms_before_guards = arraycopy_restore_alloc_state(alloc, saved_reexecute_sp); // See arraycopy_restore_alloc_state() comment // if alloc == NULL we don't have to worry about a tightly coupled allocation so we can emit all needed guards - // if saved_jvms != NULL (then alloc != NULL) then we can handle guards and a tightly coupled allocation - // if saved_jvms == NULL and alloc != NULL, we can't emit any guards - bool can_emit_guards = (alloc == NULL || saved_jvms != NULL); + // if saved_jvms_before_guards != NULL (then alloc != NULL) then we can handle guards and a tightly coupled allocation + // if saved_jvms_before_guards == NULL and alloc != NULL, we can't emit any guards + bool can_emit_guards = (alloc == NULL || saved_jvms_before_guards != NULL); // The following tests must be performed // (1) src and dest are arrays. @@ -4701,12 +4776,12 @@ // (3) src and dest must not be null. // always do this here because we need the JVM state for uncommon traps Node* null_ctl = top(); - src = saved_jvms != NULL ? null_check_oop(src, &null_ctl, true, true) : null_check(src, T_ARRAY); + src = saved_jvms_before_guards != NULL ? null_check_oop(src, &null_ctl, true, true) : null_check(src, T_ARRAY); assert(null_ctl->is_top(), "no null control here"); dest = null_check(dest, T_ARRAY); if (!can_emit_guards) { - // if saved_jvms == NULL and alloc != NULL, we don't emit any + // if saved_jvms_before_guards == NULL and alloc != NULL, we don't emit any // guards but the arraycopy node could still take advantage of a // tightly allocated allocation. tightly_coupled_allocation() is // called again to make sure it takes the null check above into @@ -4820,7 +4895,7 @@ ciMethod* trap_method = method(); int trap_bci = bci(); - if (saved_jvms != NULL) { + if (saved_jvms_before_guards != NULL) { trap_method = alloc->jvms()->method(); trap_bci = alloc->jvms()->bci(); } @@ -4891,10 +4966,9 @@ const TypeKlassPtr* dest_klass_t = _gvn.type(dest_klass)->is_klassptr(); const Type *toop = TypeOopPtr::make_from_klass(dest_klass_t->klass()); src = _gvn.transform(new CheckCastPPNode(control(), src, toop)); + arraycopy_move_allocation_here(alloc, dest, saved_jvms_before_guards, saved_reexecute_sp, new_idx); } - arraycopy_move_allocation_here(alloc, dest, saved_jvms, saved_reexecute_sp, new_idx); - if (stopped()) { return true; } @@ -4960,32 +5034,27 @@ // There may be guards which feed into the slow_region. // Any other control flow means that we might not get a chance // to finish initializing the allocated object. - if ((ctl->is_IfFalse() || ctl->is_IfTrue()) && ctl->in(0)->is_If()) { - IfNode* iff = ctl->in(0)->as_If(); - Node* not_ctl = iff->proj_out_or_null(1 - ctl->as_Proj()->_con); - assert(not_ctl != NULL && not_ctl != ctl, "found alternate"); - if (slow_region != NULL && slow_region->find_edge(not_ctl) >= 1) { - ctl = iff->in(0); // This test feeds the known slow_region. - continue; - } - // One more try: Various low-level checks bottom out in - // uncommon traps. If the debug-info of the trap omits - // any reference to the allocation, as we've already - // observed, then there can be no objection to the trap. - bool found_trap = false; - for (DUIterator_Fast jmax, j = not_ctl->fast_outs(jmax); j < jmax; j++) { - Node* obs = not_ctl->fast_out(j); - if (obs->in(0) == not_ctl && obs->is_Call() && - (obs->as_Call()->entry_point() == SharedRuntime::uncommon_trap_blob()->entry_point())) { - found_trap = true; break; + // This code is removed by "8263615: Cleanup tightly_coupled_allocation" + // I had to adapt it when backporting "8297730: C2: Arraycopy intrinsic throws incorrect exception" + if (slow_region != NULL) { + if ((ctl->is_IfFalse() || ctl->is_IfTrue()) && ctl->in(0)->is_If()) { + IfNode* iff = ctl->in(0)->as_If(); + Node* not_ctl = iff->proj_out_or_null(1 - ctl->as_Proj()->_con); + if (slow_region->find_edge(not_ctl) >= 1) { + ctl = iff->in(0); // This test feeds the known slow_region. + continue; } } - if (found_trap) { - ctl = iff->in(0); // This test feeds a harmless uncommon trap. - continue; - } } - return NULL; + // Various low-level checks bottom out in uncommon traps. These + // are considered safe since we've already checked above that + // there is no unexpected observer of this allocation. + if (get_uncommon_trap_from_success_proj(ctl) != NULL) { + assert(ctl->in(0)->is_If(), "must be If"); + ctl = ctl->in(0)->in(0); + } else { + return NULL; + } } // If we get this far, we have an allocation which immediately @@ -4996,6 +5065,20 @@ return alloc; } +CallStaticJavaNode* LibraryCallKit::get_uncommon_trap_from_success_proj(Node* node) { + if (node->is_IfProj()) { + Node* other_proj = node->as_IfProj()->other_if_proj(); + for (DUIterator_Fast jmax, j = other_proj->fast_outs(jmax); j < jmax; j++) { + Node* obs = other_proj->fast_out(j); + if (obs->in(0) == other_proj && obs->is_CallStaticJava() && + (obs->as_CallStaticJava()->entry_point() == SharedRuntime::uncommon_trap_blob()->entry_point())) { + return obs->as_CallStaticJava(); + } + } + } + return NULL; +} + //-------------inline_encodeISOArray----------------------------------- // encode char[] to byte[] in ISO_8859_1 bool LibraryCallKit::inline_encodeISOArray() { diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/opto/loopTransform.cpp openjdk-11-11.0.21+9/src/hotspot/share/opto/loopTransform.cpp --- openjdk-11-11.0.20+8/src/hotspot/share/opto/loopTransform.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/opto/loopTransform.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -3240,7 +3240,12 @@ // counted loop has limit check predicate. Node* phi = cl->phi(); Node* exact_limit = phase->exact_limit(this); - Node* final_iv = new SubINode(exact_limit, cl->stride()); + + // We need to pin the exact limit to prevent it from floating above the zero trip guard. + Node * cast_ii = ConstraintCastNode::make_cast(Op_CastII, cl->in(LoopNode::EntryControl), exact_limit, phase->_igvn.type(exact_limit), true); + phase->register_new_node(cast_ii, cl->in(LoopNode::EntryControl)); + + Node* final_iv = new SubINode(cast_ii, cl->stride()); phase->register_new_node(final_iv, cl->in(LoopNode::EntryControl)); phase->_igvn.replace_node(phi, final_iv); diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/opto/loopopts.cpp openjdk-11-11.0.21+9/src/hotspot/share/opto/loopopts.cpp --- openjdk-11-11.0.20+8/src/hotspot/share/opto/loopopts.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/opto/loopopts.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -504,7 +504,7 @@ n23_loop == n_loop ) { Node *add1 = new AddPNode( n->in(1), n->in(2)->in(2), n->in(3) ); // Stuff new AddP in the loop preheader - register_new_node( add1, n_loop->_head->in(LoopNode::EntryControl) ); + register_new_node( add1, n_loop->_head->as_Loop()->skip_strip_mined(1)->in(LoopNode::EntryControl) ); Node *add2 = new AddPNode( n->in(1), add1, n->in(2)->in(3) ); register_new_node( add2, n_ctrl ); _igvn.replace_node( n, add2 ); @@ -525,7 +525,7 @@ if (!is_member(n_loop,get_ctrl(I))) { Node *add1 = new AddPNode(n->in(1), n->in(2), I); // Stuff new AddP in the loop preheader - register_new_node(add1, n_loop->_head->in(LoopNode::EntryControl)); + register_new_node(add1, n_loop->_head->as_Loop()->skip_strip_mined(1)->in(LoopNode::EntryControl)); Node *add2 = new AddPNode(n->in(1), add1, V); register_new_node(add2, n_ctrl); _igvn.replace_node(n, add2); diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/opto/parse1.cpp openjdk-11-11.0.21+9/src/hotspot/share/opto/parse1.cpp --- openjdk-11-11.0.20+8/src/hotspot/share/opto/parse1.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/opto/parse1.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -610,8 +610,6 @@ // Parse all the basic blocks. do_all_blocks(); - C->set_default_node_notes(caller_nn); - // Check for bailouts during conversion to graph if (failing()) { if (log) log->done("parse"); @@ -622,6 +620,10 @@ set_map(entry_map); do_exits(); + // Only reset this now, to make sure that debug information emitted + // for exiting control flow still refers to the inlined method. + C->set_default_node_notes(caller_nn); + if (log) log->done("parse nodes='%d' live='%d' memory='" SIZE_FORMAT "'", C->unique(), C->live_nodes(), C->node_arena()->used()); } diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/opto/phaseX.cpp openjdk-11-11.0.21+9/src/hotspot/share/opto/phaseX.cpp --- openjdk-11-11.0.20+8/src/hotspot/share/opto/phaseX.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/opto/phaseX.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -482,6 +482,14 @@ uint worklist_size = worklist->size(); + GrowableArray* old_node_note_array = C->node_note_array(); + if (old_node_note_array != NULL) { + int new_size = (_useful.size() >> 8) + 1; // The node note array uses blocks, see C->_log2_node_notes_block_size + new_size = MAX2(8, new_size); + C->set_node_note_array(new (C->comp_arena()) GrowableArray (C->comp_arena(), new_size, 0, NULL)); + C->grow_node_notes(C->node_note_array(), new_size); + } + // Iterate over the set of live nodes. for (uint current_idx = 0; current_idx < _useful.size(); current_idx++) { Node* n = _useful.at(current_idx); @@ -497,6 +505,11 @@ assert(_old2new_map.at(n->_idx) == -1, "already seen"); _old2new_map.at_put(n->_idx, current_idx); + if (old_node_note_array != NULL) { + Node_Notes* nn = C->locate_node_notes(old_node_note_array, n->_idx); + C->set_node_notes_at(current_idx, nn); + } + n->set_idx(current_idx); // Update node ID. if (in_worklist) { diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/prims/jvmtiThreadState.hpp openjdk-11-11.0.21+9/src/hotspot/share/prims/jvmtiThreadState.hpp --- openjdk-11-11.0.20+8/src/hotspot/share/prims/jvmtiThreadState.hpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/prims/jvmtiThreadState.hpp 2023-10-06 05:33:33.000000000 +0000 @@ -411,14 +411,14 @@ JvmtiThreadState *state) : _state(state), _scratch_class(scratch_class) { _state->set_class_versions_map(the_class, scratch_class); - _scratch_mirror = _scratch_class->java_mirror_handle(); - _scratch_class->set_java_mirror_handle(the_class->java_mirror_handle()); + _scratch_mirror = the_class->java_mirror_handle(); // this is a copy that is swapped + _scratch_class->swap_java_mirror_handle(_scratch_mirror); } ~RedefineVerifyMark() { // Restore the scratch class's mirror, so when scratch_class is removed // the correct mirror pointing to it can be cleared. - _scratch_class->set_java_mirror_handle(_scratch_mirror); + _scratch_class->swap_java_mirror_handle(_scratch_mirror); _state->clear_class_versions_map(); } }; diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/prims/whitebox.cpp openjdk-11-11.0.21+9/src/hotspot/share/prims/whitebox.cpp --- openjdk-11-11.0.20+8/src/hotspot/share/prims/whitebox.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/prims/whitebox.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012, 2021, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2012, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -94,6 +94,7 @@ #endif // INCLUDE_AOT #ifdef LINUX +#include "os_linux.hpp" #include "osContainer_linux.hpp" #include "cgroupSubsystem_linux.hpp" #endif @@ -1832,7 +1833,7 @@ return MetaspaceShared::open_archive_heap_region_mapped(); WB_END -WB_ENTRY(jboolean, WB_IsCDSIncludedInVmBuild(JNIEnv* env)) +WB_ENTRY(jboolean, WB_IsCDSIncluded(JNIEnv* env)) #if INCLUDE_CDS # ifdef _LP64 if (!UseCompressedOops || !UseCompressedClassPointers) { @@ -1851,7 +1852,7 @@ WB_END -WB_ENTRY(jboolean, WB_IsJFRIncludedInVmBuild(JNIEnv* env)) +WB_ENTRY(jboolean, WB_IsJFRIncluded(JNIEnv* env)) #if INCLUDE_JFR return true; #else @@ -2026,6 +2027,18 @@ return false; WB_END +// Physical memory of the host machine (including containers) +WB_ENTRY(jlong, WB_HostPhysicalMemory(JNIEnv* env, jobject o)) + LINUX_ONLY(return os::Linux::physical_memory();) + return os::physical_memory(); +WB_END + +// Physical swap of the host machine (including containers), Linux only. +WB_ENTRY(jlong, WB_HostPhysicalSwap(JNIEnv* env, jobject o)) + LINUX_ONLY(return (jlong)os::Linux::host_swap();) + return -1; // Not used/implemented on other platforms +WB_END + WB_ENTRY(jint, WB_ValidateCgroup(JNIEnv* env, jobject o, jstring proc_cgroups, @@ -2282,8 +2295,8 @@ {CC"areSharedStringsIgnored", CC"()Z", (void*)&WB_AreSharedStringsIgnored }, {CC"getResolvedReferences", CC"(Ljava/lang/Class;)Ljava/lang/Object;", (void*)&WB_GetResolvedReferences}, {CC"areOpenArchiveHeapObjectsMapped", CC"()Z", (void*)&WB_AreOpenArchiveHeapObjectsMapped}, - {CC"isCDSIncludedInVmBuild", CC"()Z", (void*)&WB_IsCDSIncludedInVmBuild }, - {CC"isJFRIncludedInVmBuild", CC"()Z", (void*)&WB_IsJFRIncludedInVmBuild }, + {CC"isCDSIncluded", CC"()Z", (void*)&WB_IsCDSIncluded }, + {CC"isJFRIncluded", CC"()Z", (void*)&WB_IsJFRIncluded }, {CC"isJavaHeapArchiveSupported", CC"()Z", (void*)&WB_IsJavaHeapArchiveSupported }, {CC"clearInlineCaches0", CC"(Z)V", (void*)&WB_ClearInlineCaches }, @@ -2305,6 +2318,8 @@ {CC"validateCgroup", CC"(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)I", (void*)&WB_ValidateCgroup }, + {CC"hostPhysicalMemory", CC"()J", (void*)&WB_HostPhysicalMemory }, + {CC"hostPhysicalSwap", CC"()J", (void*)&WB_HostPhysicalSwap }, {CC"printOsInfo", CC"()V", (void*)&WB_PrintOsInfo }, {CC"disableElfSectionCache", CC"()V", (void*)&WB_DisableElfSectionCache }, {CC"aotLibrariesCount", CC"()I", (void*)&WB_AotLibrariesCount }, diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/runtime/frame.cpp openjdk-11-11.0.21+9/src/hotspot/share/runtime/frame.cpp --- openjdk-11-11.0.20+8/src/hotspot/share/runtime/frame.cpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/runtime/frame.cpp 2023-10-06 05:33:33.000000000 +0000 @@ -44,6 +44,7 @@ #include "runtime/monitorChunk.hpp" #include "runtime/os.hpp" #include "runtime/sharedRuntime.hpp" +#include "runtime/safefetch.inline.hpp" #include "runtime/signature.hpp" #include "runtime/stubCodeGenerator.hpp" #include "runtime/stubRoutines.hpp" @@ -240,6 +241,14 @@ return (jfa->last_Java_sp() > sp()); } +Method* frame::safe_interpreter_frame_method() const { + Method** m_addr = interpreter_frame_method_addr(); + if (m_addr == NULL) { + return NULL; + } + return (Method*) SafeFetchN((intptr_t*) m_addr, 0); +} + bool frame::should_be_deoptimized() const { if (_deopt_state == is_deoptimized || !is_compiled_frame() ) return false; diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/runtime/frame.hpp openjdk-11-11.0.21+9/src/hotspot/share/runtime/frame.hpp --- openjdk-11-11.0.20+8/src/hotspot/share/runtime/frame.hpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/runtime/frame.hpp 2023-10-06 05:33:33.000000000 +0000 @@ -168,6 +168,8 @@ bool is_entry_frame_valid(JavaThread* thread) const; + Method* safe_interpreter_frame_method() const; + // All frames: // A low-level interface for vframes: diff -Nru openjdk-11-11.0.20+8/src/hotspot/share/runtime/globals.hpp openjdk-11-11.0.21+9/src/hotspot/share/runtime/globals.hpp --- openjdk-11-11.0.20+8/src/hotspot/share/runtime/globals.hpp 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/hotspot/share/runtime/globals.hpp 2023-10-06 05:33:33.000000000 +0000 @@ -133,8 +133,8 @@ // notproduct flags are settable / visible only during development and are not declared in the PRODUCT version // A flag must be declared with one of the following types: -// bool, int, uint, intx, uintx, size_t, ccstr, double, or uint64_t. -// The type "ccstr" is an alias for "const char*" and is used +// bool, int, uint, intx, uintx, size_t, ccstr, ccstrlist, double, or uint64_t. +// The type "ccstr" and "ccstrlist" are an alias for "const char*" and is used // only in this file, because the macrology requires single-token type names. // Note: Diagnostic options not meant for VM tuning or for product modes. diff -Nru openjdk-11-11.0.20+8/src/java.base/macosx/classes/apple/security/KeychainStore.java openjdk-11-11.0.21+9/src/java.base/macosx/classes/apple/security/KeychainStore.java --- openjdk-11-11.0.20+8/src/java.base/macosx/classes/apple/security/KeychainStore.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/macosx/classes/apple/security/KeychainStore.java 2023-10-06 05:33:33.000000000 +0000 @@ -108,12 +108,13 @@ private Hashtable entries = new Hashtable<>(); /** - * Algorithm identifiers and corresponding OIDs for the contents of the PKCS12 bag we get from the Keychain. + * Algorithm identifiers and corresponding OIDs for the contents of the + * PKCS12 bag we get from the Keychain. */ - private static final int keyBag[] = {1, 2, 840, 113549, 1, 12, 10, 1, 2}; - private static final int pbeWithSHAAnd3KeyTripleDESCBC[] = {1, 2, 840, 113549, 1, 12, 1, 3}; - private static ObjectIdentifier PKCS8ShroudedKeyBag_OID; - private static ObjectIdentifier pbeWithSHAAnd3KeyTripleDESCBC_OID; + private static ObjectIdentifier PKCS8ShroudedKeyBag_OID = + ObjectIdentifier.of(KnownOIDs.PKCS8ShroudedKeyBag); + private static ObjectIdentifier pbeWithSHAAnd3KeyTripleDESCBC_OID = + ObjectIdentifier.of(KnownOIDs.PBEWithSHA1AndDESede); /** * Constnats used in PBE decryption. @@ -131,12 +132,6 @@ return null; } }); - try { - PKCS8ShroudedKeyBag_OID = new ObjectIdentifier(keyBag); - pbeWithSHAAnd3KeyTripleDESCBC_OID = new ObjectIdentifier(pbeWithSHAAnd3KeyTripleDESCBC); - } catch (IOException ioe) { - // should not happen - } } private static void permissionCheck() { diff -Nru openjdk-11-11.0.20+8/src/java.base/macosx/native/libjava/ProcessHandleImpl_macosx.c openjdk-11-11.0.21+9/src/java.base/macosx/native/libjava/ProcessHandleImpl_macosx.c --- openjdk-11-11.0.20+8/src/java.base/macosx/native/libjava/ProcessHandleImpl_macosx.c 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/macosx/native/libjava/ProcessHandleImpl_macosx.c 2023-10-06 05:33:33.000000000 +0000 @@ -272,7 +272,8 @@ mib[2] = pid; size = (size_t) maxargs; if (sysctl(mib, 3, args, &size, NULL, 0) == -1) { - if (errno != EINVAL) { + if (errno != EINVAL && errno != EIO) { + // If the pid is invalid, the information returned is empty and no exception JNU_ThrowByNameWithLastError(env, "java/lang/RuntimeException", "sysctl failed"); } @@ -300,4 +301,3 @@ // Free the arg buffer free(args); } - diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/DESKey.java openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/DESKey.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/DESKey.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/DESKey.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1997, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -25,6 +25,8 @@ package com.sun.crypto.provider; +import java.io.IOException; +import java.io.InvalidObjectException; import java.lang.ref.Reference; import java.security.MessageDigest; import java.security.KeyRep; @@ -43,7 +45,7 @@ final class DESKey implements SecretKey { - static final long serialVersionUID = 7724971015953279128L; + private static final long serialVersionUID = 7724971015953279128L; private byte[] key; @@ -112,7 +114,7 @@ for (int i = 1; i < this.key.length; i++) { retval += this.key[i] * i; } - return(retval ^= "des".hashCode()); + return(retval ^ "des".hashCode()); } public boolean equals(Object obj) { @@ -133,14 +135,27 @@ } /** - * readObject is called to restore the state of this key from - * a stream. + * Restores the state of this object from the stream. + * + * @param s the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded */ private void readObject(java.io.ObjectInputStream s) - throws java.io.IOException, ClassNotFoundException + throws IOException, ClassNotFoundException { s.defaultReadObject(); + if ((key == null) || (key.length != DESKeySpec.DES_KEY_LEN)) { + throw new InvalidObjectException("Wrong key size"); + } key = key.clone(); + + DESKeyGenerator.setParityBit(key, 0); + + // Use the cleaner to zero the key when no longer referenced + final byte[] k = key; + CleanerFactory.cleaner().register(this, + () -> java.util.Arrays.fill(k, (byte)0x00)); } /** diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/DESedeKey.java openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/DESedeKey.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/DESedeKey.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/DESedeKey.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1997, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -25,6 +25,8 @@ package com.sun.crypto.provider; +import java.io.IOException; +import java.io.InvalidObjectException; import java.lang.ref.Reference; import java.security.MessageDigest; import java.security.KeyRep; @@ -43,7 +45,7 @@ final class DESedeKey implements SecretKey { - static final long serialVersionUID = 2463986565756745178L; + private static final long serialVersionUID = 2463986565756745178L; private byte[] key; @@ -111,7 +113,7 @@ for (int i = 1; i < this.key.length; i++) { retval += this.key[i] * i; } - return(retval ^= "desede".hashCode()); + return(retval ^ "desede".hashCode()); } public boolean equals(Object obj) { @@ -133,14 +135,29 @@ } /** - * readObject is called to restore the state of this key from - * a stream. + * Restores the state of this object from the stream. + * + * @param s the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded */ private void readObject(java.io.ObjectInputStream s) - throws java.io.IOException, ClassNotFoundException + throws IOException, ClassNotFoundException { s.defaultReadObject(); + if ((key == null) || (key.length != DESedeKeySpec.DES_EDE_KEY_LEN)) { + throw new InvalidObjectException("Wrong key size"); + } key = key.clone(); + + DESKeyGenerator.setParityBit(key, 0); + DESKeyGenerator.setParityBit(key, 8); + DESKeyGenerator.setParityBit(key, 16); + + // Use the cleaner to zero the key when no longer referenced + final byte[] k = key; + CleanerFactory.cleaner().register(this, + () -> java.util.Arrays.fill(k, (byte)0x00)); } /** diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/DHPrivateKey.java openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/DHPrivateKey.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/DHPrivateKey.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/DHPrivateKey.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1997, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -40,15 +40,13 @@ * algorithm. * * @author Jan Luehe - * - * * @see DHPublicKey * @see java.security.KeyAgreement */ final class DHPrivateKey implements PrivateKey, javax.crypto.interfaces.DHPrivateKey, Serializable { - static final long serialVersionUID = 7565477590005668886L; + private static final long serialVersionUID = 7565477590005668886L; // only supported version of PKCS#8 PrivateKeyInfo private static final BigInteger PKCS8_VERSION = BigInteger.ZERO; @@ -63,16 +61,14 @@ private byte[] encodedKey; // the prime modulus - private BigInteger p; + private final BigInteger p; // the base generator - private BigInteger g; + private final BigInteger g; // the private-value length (optional) private int l; - private int DH_data[] = { 1, 2, 840, 113549, 1, 3, 1 }; - /** * Make a DH private key out of a private value x, a prime * modulus p, and a base generator g. @@ -219,7 +215,7 @@ DerOutputStream algid = new DerOutputStream(); // store OID - algid.putOID(new ObjectIdentifier(DH_data)); + algid.putOID(DHPublicKey.DH_OID); // encode parameters DerOutputStream params = new DerOutputStream(); params.putInteger(this.p); @@ -319,4 +315,27 @@ getFormat(), getEncoded()); } + + /** + * Restores the state of this object from the stream. + *

+ * JDK 1.5+ objects use KeyReps instead. + * + * @param stream the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded + */ + private void readObject(ObjectInputStream stream) + throws IOException, ClassNotFoundException { + stream.defaultReadObject(); + if ((key == null) || (key.length == 0)) { + throw new InvalidObjectException("key not deserializable"); + } + this.key = key.clone(); + if ((encodedKey == null) || (encodedKey.length == 0)) { + throw new InvalidObjectException( + "encoded key not deserializable"); + } + this.encodedKey = encodedKey.clone(); + } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/DHPublicKey.java openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/DHPublicKey.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/DHPublicKey.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/DHPublicKey.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 2018, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1997, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -40,15 +40,13 @@ * A public key in X.509 format for the Diffie-Hellman key agreement algorithm. * * @author Jan Luehe - * - * * @see DHPrivateKey * @see javax.crypto.KeyAgreement */ final class DHPublicKey implements PublicKey, javax.crypto.interfaces.DHPublicKey, Serializable { - static final long serialVersionUID = 7647557958927458271L; + private static final long serialVersionUID = 7647557958927458271L; // the public key private BigInteger y; @@ -60,15 +58,17 @@ private byte[] encodedKey; // the prime modulus - private BigInteger p; + private final BigInteger p; // the base generator - private BigInteger g; + private final BigInteger g; // the private-value length (optional) private int l; - private int DH_data[] = { 1, 2, 840, 113549, 1, 3, 1 }; + // Note: this OID is used by DHPrivateKey as well. + static ObjectIdentifier DH_OID = + ObjectIdentifier.of(KnownOIDs.DiffieHellman); /** * Make a DH public key out of a public value y, a prime @@ -202,7 +202,7 @@ DerOutputStream algid = new DerOutputStream(); // store oid in algid - algid.putOID(new ObjectIdentifier(DH_data)); + algid.putOID(DH_OID); // encode parameters DerOutputStream params = new DerOutputStream(); @@ -320,4 +320,27 @@ getFormat(), getEncoded()); } + + /** + * Restores the state of this object from the stream. + *

+ * JDK 1.5+ objects use KeyReps instead. + * + * @param stream the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded + */ + private void readObject(ObjectInputStream stream) + throws IOException, ClassNotFoundException { + stream.defaultReadObject(); + if ((key == null) || (key.length == 0)) { + throw new InvalidObjectException("key not deserializable"); + } + this.key = key.clone(); + if ((encodedKey == null) || (encodedKey.length == 0)) { + throw new InvalidObjectException( + "encoded key not deserializable"); + } + this.encodedKey = encodedKey.clone(); + } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/KeyProtector.java openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/KeyProtector.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/KeyProtector.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/KeyProtector.java 2023-10-06 05:33:33.000000000 +0000 @@ -48,6 +48,7 @@ import sun.security.x509.AlgorithmId; import sun.security.util.ObjectIdentifier; +import sun.security.util.KnownOIDs; import sun.security.util.SecurityProperties; /** @@ -67,14 +68,6 @@ final class KeyProtector { - // defined by SunSoft (SKI project) - private static final String PBE_WITH_MD5_AND_DES3_CBC_OID - = "1.3.6.1.4.1.42.2.19.1"; - - // JavaSoft proprietary key-protection algorithm (used to protect private - // keys in the keystore implementation that comes with JDK 1.2) - private static final String KEY_PROTECTOR_OID = "1.3.6.1.4.1.42.2.17.1.1"; - private static final int MAX_ITERATION_COUNT = 5000000; private static final int MIN_ITERATION_COUNT = 10000; private static final int DEFAULT_ITERATION_COUNT = 200000; @@ -154,7 +147,8 @@ pbeParams.init(pbeSpec); AlgorithmId encrAlg = new AlgorithmId - (new ObjectIdentifier(PBE_WITH_MD5_AND_DES3_CBC_OID), pbeParams); + (ObjectIdentifier.of(KnownOIDs.JAVASOFT_JCEKeyProtector), + pbeParams); return new EncryptedPrivateKeyInfo(encrAlg,encrKey).getEncoded(); } @@ -169,13 +163,13 @@ SecretKey sKey = null; try { String encrAlg = encrInfo.getAlgorithm().getOID().toString(); - if (!encrAlg.equals(PBE_WITH_MD5_AND_DES3_CBC_OID) - && !encrAlg.equals(KEY_PROTECTOR_OID)) { + if (!encrAlg.equals(KnownOIDs.JAVASOFT_JCEKeyProtector.value()) + && !encrAlg.equals(KnownOIDs.JAVASOFT_JDKKeyProtector.value())) { throw new UnrecoverableKeyException("Unsupported encryption " + "algorithm"); } - if (encrAlg.equals(KEY_PROTECTOR_OID)) { + if (encrAlg.equals(KnownOIDs.JAVASOFT_JDKKeyProtector.value())) { // JDK 1.2 style recovery plain = recover(encrInfo.getEncryptedData()); } else { diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/OAEPParameters.java openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/OAEPParameters.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/OAEPParameters.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/OAEPParameters.java 2023-10-06 05:33:33.000000000 +0000 @@ -55,24 +55,10 @@ private String mdName; private MGF1ParameterSpec mgfSpec; private byte[] p; - private static ObjectIdentifier OID_MGF1; - private static ObjectIdentifier OID_PSpecified; - - static { - try { - OID_MGF1 = new ObjectIdentifier(new int[] {1,2,840,113549,1,1,8}); - } catch (IOException ioe) { - // should not happen - OID_MGF1 = null; - } - try { - OID_PSpecified = - new ObjectIdentifier(new int[] {1,2,840,113549,1,1,9}); - } catch (IOException ioe) { - // should not happen - OID_PSpecified = null; - } - } + private static ObjectIdentifier OID_MGF1 = + ObjectIdentifier.of(KnownOIDs.MGF1); + private static ObjectIdentifier OID_PSpecified = + ObjectIdentifier.of(KnownOIDs.PSpecified); public OAEPParameters() { } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/PBEKey.java openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/PBEKey.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/PBEKey.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/PBEKey.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 2018, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1997, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -25,6 +25,8 @@ package com.sun.crypto.provider; +import java.io.IOException; +import java.io.InvalidObjectException; import java.lang.ref.Reference; import java.security.MessageDigest; import java.security.KeyRep; @@ -44,11 +46,11 @@ */ final class PBEKey implements SecretKey { - static final long serialVersionUID = -2234768909660948176L; + private static final long serialVersionUID = -2234768909660948176L; private byte[] key; - private String type; + private final String type; /** * Creates a PBE key from a given PBE key specification. @@ -109,7 +111,7 @@ for (int i = 1; i < this.key.length; i++) { retval += this.key[i] * i; } - return(retval ^= getAlgorithm().toLowerCase(Locale.ENGLISH).hashCode()); + return(retval ^ getAlgorithm().toLowerCase(Locale.ENGLISH).hashCode()); } public boolean equals(Object obj) { @@ -143,14 +145,37 @@ } /** - * readObject is called to restore the state of this key from - * a stream. + * Restores the state of this object from the stream. + * + * @param s the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded */ private void readObject(java.io.ObjectInputStream s) - throws java.io.IOException, ClassNotFoundException + throws IOException, ClassNotFoundException { s.defaultReadObject(); + if (key == null) { + throw new InvalidObjectException( + "PBEKey couldn't be deserialized"); + } key = key.clone(); + + // Accept "\0" to signify "zero-length password with no terminator". + if (!(key.length == 1 && key[0] == 0)) { + for (int i = 0; i < key.length; i++) { + if ((key[i] < '\u0020') || (key[i] > '\u007E')) { + throw new InvalidObjectException( + "PBEKey had non-ASCII chars"); + } + } + } + + // Use the cleaner to zero the key when no longer referenced + final byte[] k = this.key; + CleanerFactory.cleaner().register(this, + () -> Arrays.fill(k, (byte) 0x00)); + } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/PBES2Parameters.java openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/PBES2Parameters.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/PBES2Parameters.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/PBES2Parameters.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2012, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -90,57 +90,18 @@ * * */ - abstract class PBES2Parameters extends AlgorithmParametersSpi { - private static final int pkcs5PBKDF2[] = - {1, 2, 840, 113549, 1, 5, 12}; - private static final int pkcs5PBES2[] = - {1, 2, 840, 113549, 1, 5, 13}; - private static final int hmacWithSHA1[] = - {1, 2, 840, 113549, 2, 7}; - private static final int hmacWithSHA224[] = - {1, 2, 840, 113549, 2, 8}; - private static final int hmacWithSHA256[] = - {1, 2, 840, 113549, 2, 9}; - private static final int hmacWithSHA384[] = - {1, 2, 840, 113549, 2, 10}; - private static final int hmacWithSHA512[] = - {1, 2, 840, 113549, 2, 11}; - private static final int aes128CBC[] = - {2, 16, 840, 1, 101, 3, 4, 1, 2}; - private static final int aes192CBC[] = - {2, 16, 840, 1, 101, 3, 4, 1, 22}; - private static final int aes256CBC[] = - {2, 16, 840, 1, 101, 3, 4, 1, 42}; - - private static ObjectIdentifier pkcs5PBKDF2_OID; - private static ObjectIdentifier pkcs5PBES2_OID; - private static ObjectIdentifier hmacWithSHA1_OID; - private static ObjectIdentifier hmacWithSHA224_OID; - private static ObjectIdentifier hmacWithSHA256_OID; - private static ObjectIdentifier hmacWithSHA384_OID; - private static ObjectIdentifier hmacWithSHA512_OID; - private static ObjectIdentifier aes128CBC_OID; - private static ObjectIdentifier aes192CBC_OID; - private static ObjectIdentifier aes256CBC_OID; - - static { - try { - pkcs5PBKDF2_OID = new ObjectIdentifier(pkcs5PBKDF2); - pkcs5PBES2_OID = new ObjectIdentifier(pkcs5PBES2); - hmacWithSHA1_OID = new ObjectIdentifier(hmacWithSHA1); - hmacWithSHA224_OID = new ObjectIdentifier(hmacWithSHA224); - hmacWithSHA256_OID = new ObjectIdentifier(hmacWithSHA256); - hmacWithSHA384_OID = new ObjectIdentifier(hmacWithSHA384); - hmacWithSHA512_OID = new ObjectIdentifier(hmacWithSHA512); - aes128CBC_OID = new ObjectIdentifier(aes128CBC); - aes192CBC_OID = new ObjectIdentifier(aes192CBC); - aes256CBC_OID = new ObjectIdentifier(aes256CBC); - } catch (IOException ioe) { - // should not happen - } - } + private static ObjectIdentifier pkcs5PBKDF2_OID = + ObjectIdentifier.of(KnownOIDs.PBKDF2WithHmacSHA1); + private static ObjectIdentifier pkcs5PBES2_OID = + ObjectIdentifier.of(KnownOIDs.PBES2); + private static ObjectIdentifier aes128CBC_OID = + ObjectIdentifier.of(KnownOIDs.AES_128$CBC$NoPadding); + private static ObjectIdentifier aes192CBC_OID = + ObjectIdentifier.of(KnownOIDs.AES_192$CBC$NoPadding); + private static ObjectIdentifier aes256CBC_OID = + ObjectIdentifier.of(KnownOIDs.AES_256$CBC$NoPadding); // the PBES2 algorithm name private String pbes2AlgorithmName = null; @@ -155,7 +116,8 @@ private AlgorithmParameterSpec cipherParam = null; // the key derivation function (default is HmacSHA1) - private ObjectIdentifier kdfAlgo_OID = hmacWithSHA1_OID; + private ObjectIdentifier kdfAlgo_OID = + ObjectIdentifier.of(KnownOIDs.HmacSHA1); // the encryption function private ObjectIdentifier cipherAlgo_OID = null; @@ -200,19 +162,11 @@ switch (kdfAlgo) { case "HmacSHA1": - kdfAlgo_OID = hmacWithSHA1_OID; - break; case "HmacSHA224": - kdfAlgo_OID = hmacWithSHA224_OID; - break; case "HmacSHA256": - kdfAlgo_OID = hmacWithSHA256_OID; - break; case "HmacSHA384": - kdfAlgo_OID = hmacWithSHA384_OID; - break; case "HmacSHA512": - kdfAlgo_OID = hmacWithSHA512_OID; + kdfAlgo_OID = ObjectIdentifier.of(KnownOIDs.findMatch(kdfAlgo)); break; default: throw new NoSuchAlgorithmException( @@ -284,7 +238,7 @@ } cipherAlgo = parseES(pBES2_params.data.getDerValue()); - pbes2AlgorithmName = new StringBuilder().append("PBEWith") + this.pbes2AlgorithmName = new StringBuilder().append("PBEWith") .append(kdfAlgo).append("And").append(cipherAlgo).toString(); } @@ -335,21 +289,18 @@ } if (prf != null) { kdfAlgo_OID = prf.data.getOID(); - if (hmacWithSHA1_OID.equals(kdfAlgo_OID)) { - kdfAlgo = "HmacSHA1"; - } else if (hmacWithSHA224_OID.equals(kdfAlgo_OID)) { - kdfAlgo = "HmacSHA224"; - } else if (hmacWithSHA256_OID.equals(kdfAlgo_OID)) { - kdfAlgo = "HmacSHA256"; - } else if (hmacWithSHA384_OID.equals(kdfAlgo_OID)) { - kdfAlgo = "HmacSHA384"; - } else if (hmacWithSHA512_OID.equals(kdfAlgo_OID)) { - kdfAlgo = "HmacSHA512"; - } else { + KnownOIDs o = KnownOIDs.findMatch(kdfAlgo_OID.toString()); + if (o == null || (!o.stdName().equals("HmacSHA1") && + !o.stdName().equals("HmacSHA224") && + !o.stdName().equals("HmacSHA256") && + !o.stdName().equals("HmacSHA384") && + !o.stdName().equals("HmacSHA512"))) { throw new IOException("PBE parameter parsing error: " + "expecting the object identifier for a HmacSHA key " + "derivation function"); } + kdfAlgo = o.stdName(); + if (prf.data.available() != 0) { // parameter is 'NULL' for all HmacSHA KDFs DerValue parameter = prf.data.getDerValue(); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/PBKDF2KeyImpl.java openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/PBKDF2KeyImpl.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/PBKDF2KeyImpl.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/PBKDF2KeyImpl.java 2023-10-06 05:33:33.000000000 +0000 @@ -25,7 +25,7 @@ package com.sun.crypto.provider; -import java.io.ObjectStreamException; +import java.io.*; import java.lang.ref.Reference; import java.nio.ByteBuffer; import java.nio.CharBuffer; @@ -55,14 +55,14 @@ */ final class PBKDF2KeyImpl implements javax.crypto.interfaces.PBEKey { - static final long serialVersionUID = -2234868909660948157L; + private static final long serialVersionUID = -2234868909660948157L; - private char[] passwd; - private byte[] salt; - private int iterCount; + private final char[] passwd; + private final byte[] salt; + private final int iterCount; private byte[] key; - private Mac prf; + private final Mac prf; private static byte[] getPasswordBytes(char[] passwd) { Charset utf8 = Charset.forName("UTF-8"); @@ -144,12 +144,13 @@ int intR = keyLength - (intL - 1)*hlen; // residue byte[] ui = new byte[hlen]; byte[] ti = new byte[hlen]; + String algName = prf.getAlgorithm(); // SecretKeySpec cannot be used, since password can be empty here. SecretKey macKey = new SecretKey() { private static final long serialVersionUID = 7874493593505141603L; @Override public String getAlgorithm() { - return prf.getAlgorithm(); + return algName; } @Override public String getFormat() { @@ -162,18 +163,26 @@ @Override public int hashCode() { return Arrays.hashCode(password) * 41 + - prf.getAlgorithm().toLowerCase(Locale.ENGLISH).hashCode(); + algName.toLowerCase(Locale.ENGLISH).hashCode(); } @Override public boolean equals(Object obj) { if (this == obj) return true; if (this.getClass() != obj.getClass()) return false; SecretKey sk = (SecretKey)obj; - return prf.getAlgorithm().equalsIgnoreCase( + return algName.equalsIgnoreCase( sk.getAlgorithm()) && MessageDigest.isEqual(password, sk.getEncoded()); } + // This derived key can't be deserialized. + private void readObject(ObjectInputStream stream) + throws IOException, ClassNotFoundException { + throw new InvalidObjectException( + "PBKDF2KeyImpl SecretKeys are not " + + "directly deserializable"); + } }; + prf.init(macKey); byte[] ibytes = new byte[4]; @@ -282,4 +291,19 @@ return new KeyRep(KeyRep.Type.SECRET, getAlgorithm(), getFormat(), getEncoded()); } + + /** + * Restores the state of this object from the stream. + *

+ * Deserialization of this class is not supported. + * + * @param stream the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded + */ + private void readObject(ObjectInputStream stream) + throws IOException, ClassNotFoundException { + throw new InvalidObjectException( + "PBKDF2KeyImpl keys are not directly deserializable"); + } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java 2023-10-06 05:33:33.000000000 +0000 @@ -32,8 +32,7 @@ import java.util.HashMap; import java.util.List; import static sun.security.util.SecurityConstants.PROVIDER_VER; -import static sun.security.provider.SunEntries.createAliases; -import static sun.security.provider.SunEntries.createAliasesWithOid; +import static sun.security.util.SecurityProviderConstants.*; /** * The "SunJCE" Cryptographic Service Provider. @@ -99,9 +98,22 @@ } static SecureRandom getRandom() { return SecureRandomHolder.RANDOM; } - private void ps(String type, String algo, String cn, - List aliases, HashMap attrs) { - putService(new Provider.Service(this, type, algo, cn, aliases, attrs)); + // ps: putService + private void ps(String type, String algo, String cn) { + putService(new Provider.Service(this, type, algo, cn, null, null)); + } + + private void ps(String type, String algo, String cn, List als, + HashMap attrs) { + putService(new Provider.Service(this, type, algo, cn, als, + attrs)); + } + + // psA: putService with default aliases + private void psA(String type, String algo, String cn, + HashMap attrs) { + putService(new Provider.Service(this, type, algo, cn, getAliases(algo), + attrs)); } public SunJCE() { @@ -127,57 +139,6 @@ } void putEntries() { - // common aliases and oids - List aesAliases = createAliases("Rijndael"); - List desEdeAliases = createAliases("TripleDES"); - List arcFourAliases = createAliases("RC4"); - List sunTlsMSAliases = createAliases( - "SunTls12MasterSecret", "SunTlsExtendedMasterSecret" - ); - List sunTlsKMAliases = createAliases("SunTls12KeyMaterial"); - List sunTlsRsaPMSAliases = createAliases("SunTls12RsaPremasterSecret"); - - String aes128Oid = "2.16.840.1.101.3.4.1."; - String aes192Oid = "2.16.840.1.101.3.4.1.2"; - String aes256Oid = "2.16.840.1.101.3.4.1.4"; - - List pkcs12RC4_128Aliases = - createAliasesWithOid("1.2.840.113549.1.12.1.1"); - - List pkcs12RC4_40Aliases = - createAliasesWithOid("1.2.840.113549.1.12.1.2"); - - List pkcs12DESedeAliases = - createAliasesWithOid("1.2.840.113549.1.12.1.3"); - - List pkcs12RC2_128Aliases = - createAliasesWithOid("1.2.840.113549.1.12.1.5"); - - List pkcs12RC2_40Aliases = - createAliasesWithOid("1.2.840.113549.1.12.1.6"); - - List pkcs5MD5_DESAliases = - createAliasesWithOid("1.2.840.113549.1.5.3", "PBE"); - - List pkcs5PBKDF2Aliases = - createAliasesWithOid("1.2.840.113549.1.5.12"); - - List pkcs5PBES2Aliases = - createAliasesWithOid("1.2.840.113549.1.5.13"); - - List diffieHellmanAliases = - createAliasesWithOid("1.2.840.113549.1.3.1", "DH"); - - List chachaPolyAliases = - createAliasesWithOid("1.2.840.113549.1.9.16.3.18"); - - String macOidBase = "1.2.840.113549.2."; - List macSHA1Aliases = createAliasesWithOid(macOidBase + "7"); - List macSHA224Aliases = createAliasesWithOid(macOidBase + "8"); - List macSHA256Aliases = createAliasesWithOid(macOidBase + "9"); - List macSHA384Aliases = createAliasesWithOid(macOidBase + "10"); - List macSHA512Aliases = createAliasesWithOid(macOidBase + "11"); - // reuse attribute map and reset before each reuse HashMap attrs = new HashMap<>(3); attrs.put("SupportedModes", "ECB"); @@ -212,8 +173,8 @@ attrs.put("SupportedKeyFormats", "RAW"); ps("Cipher", "DES", "com.sun.crypto.provider.DESCipher", null, attrs); - ps("Cipher", "DESede", "com.sun.crypto.provider.DESedeCipher", - desEdeAliases, attrs); + psA("Cipher", "DESede", "com.sun.crypto.provider.DESedeCipher", + attrs); ps("Cipher", "Blowfish", "com.sun.crypto.provider.BlowfishCipher", null, attrs); @@ -224,58 +185,58 @@ attrs.put("SupportedModes", BLOCK_MODES128); attrs.put("SupportedPaddings", BLOCK_PADS); attrs.put("SupportedKeyFormats", "RAW"); - ps("Cipher", "AES", "com.sun.crypto.provider.AESCipher$General", - aesAliases, attrs); + psA("Cipher", "AES", + "com.sun.crypto.provider.AESCipher$General", attrs); attrs.clear(); attrs.put("SupportedKeyFormats", "RAW"); - ps("Cipher", "AES_128/ECB/NoPadding", + psA("Cipher", "AES_128/ECB/NoPadding", "com.sun.crypto.provider.AESCipher$AES128_ECB_NoPadding", - createAliasesWithOid(aes128Oid+"1"), attrs); - ps("Cipher", "AES_128/CBC/NoPadding", + attrs); + psA("Cipher", "AES_128/CBC/NoPadding", "com.sun.crypto.provider.AESCipher$AES128_CBC_NoPadding", - createAliasesWithOid(aes128Oid+"2"), attrs); - ps("Cipher", "AES_128/OFB/NoPadding", + attrs); + psA("Cipher", "AES_128/OFB/NoPadding", "com.sun.crypto.provider.AESCipher$AES128_OFB_NoPadding", - createAliasesWithOid(aes128Oid+"3"), attrs); - ps("Cipher", "AES_128/CFB/NoPadding", + attrs); + psA("Cipher", "AES_128/CFB/NoPadding", "com.sun.crypto.provider.AESCipher$AES128_CFB_NoPadding", - createAliasesWithOid(aes128Oid+"4"), attrs); - ps("Cipher", "AES_128/GCM/NoPadding", + attrs); + psA("Cipher", "AES_128/GCM/NoPadding", "com.sun.crypto.provider.AESCipher$AES128_GCM_NoPadding", - createAliasesWithOid(aes128Oid+"6"), attrs); + attrs); - ps("Cipher", "AES_192/ECB/NoPadding", + psA("Cipher", "AES_192/ECB/NoPadding", "com.sun.crypto.provider.AESCipher$AES192_ECB_NoPadding", - createAliasesWithOid(aes192Oid+"1"), attrs); - ps("Cipher", "AES_192/CBC/NoPadding", + attrs); + psA("Cipher", "AES_192/CBC/NoPadding", "com.sun.crypto.provider.AESCipher$AES192_CBC_NoPadding", - createAliasesWithOid(aes192Oid+"2"), attrs); - ps("Cipher", "AES_192/OFB/NoPadding", + attrs); + psA("Cipher", "AES_192/OFB/NoPadding", "com.sun.crypto.provider.AESCipher$AES192_OFB_NoPadding", - createAliasesWithOid(aes192Oid+"3"), attrs); - ps("Cipher", "AES_192/CFB/NoPadding", + attrs); + psA("Cipher", "AES_192/CFB/NoPadding", "com.sun.crypto.provider.AESCipher$AES192_CFB_NoPadding", - createAliasesWithOid(aes192Oid+"4"), attrs); - ps("Cipher", "AES_192/GCM/NoPadding", + attrs); + psA("Cipher", "AES_192/GCM/NoPadding", "com.sun.crypto.provider.AESCipher$AES192_GCM_NoPadding", - createAliasesWithOid(aes192Oid+"6"), attrs); + attrs); - ps("Cipher", "AES_256/ECB/NoPadding", + psA("Cipher", "AES_256/ECB/NoPadding", "com.sun.crypto.provider.AESCipher$AES256_ECB_NoPadding", - createAliasesWithOid(aes256Oid+"1"), attrs); - ps("Cipher", "AES_256/CBC/NoPadding", + attrs); + psA("Cipher", "AES_256/CBC/NoPadding", "com.sun.crypto.provider.AESCipher$AES256_CBC_NoPadding", - createAliasesWithOid(aes256Oid+"2"), attrs); - ps("Cipher", "AES_256/OFB/NoPadding", + attrs); + psA("Cipher", "AES_256/OFB/NoPadding", "com.sun.crypto.provider.AESCipher$AES256_OFB_NoPadding", - createAliasesWithOid(aes256Oid+"3"), attrs); - ps("Cipher", "AES_256/CFB/NoPadding", + attrs); + psA("Cipher", "AES_256/CFB/NoPadding", "com.sun.crypto.provider.AESCipher$AES256_CFB_NoPadding", - createAliasesWithOid(aes256Oid+"4"), attrs); - ps("Cipher", "AES_256/GCM/NoPadding", + attrs); + psA("Cipher", "AES_256/GCM/NoPadding", "com.sun.crypto.provider.AESCipher$AES256_GCM_NoPadding", - createAliasesWithOid(aes256Oid+"6"), attrs); + attrs); attrs.clear(); attrs.put("SupportedModes", "CBC"); @@ -288,148 +249,131 @@ attrs.put("SupportedModes", "ECB"); attrs.put("SupportedPaddings", "NOPADDING"); attrs.put("SupportedKeyFormats", "RAW"); - ps("Cipher", "ARCFOUR", "com.sun.crypto.provider.ARCFOURCipher", - arcFourAliases, attrs); + psA("Cipher", "ARCFOUR", + "com.sun.crypto.provider.ARCFOURCipher", attrs); ps("Cipher", "AESWrap", "com.sun.crypto.provider.AESWrapCipher$General", null, attrs); - ps("Cipher", "AESWrap_128", + psA("Cipher", "AESWrap_128", "com.sun.crypto.provider.AESWrapCipher$AES128", - createAliasesWithOid(aes128Oid+"5"), attrs); - ps("Cipher", "AESWrap_192", + attrs); + psA("Cipher", "AESWrap_192", "com.sun.crypto.provider.AESWrapCipher$AES192", - createAliasesWithOid(aes192Oid+"5"), attrs); - ps("Cipher", "AESWrap_256", + attrs); + psA("Cipher", "AESWrap_256", "com.sun.crypto.provider.AESWrapCipher$AES256", - createAliasesWithOid(aes256Oid+"5"), attrs); + attrs); attrs.clear(); attrs.put("SupportedKeyFormats", "RAW"); ps("Cipher", "ChaCha20", "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Only", null, attrs); - ps("Cipher", "ChaCha20-Poly1305", + psA("Cipher", "ChaCha20-Poly1305", "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Poly1305", - chachaPolyAliases, attrs); + attrs); // PBES1 - ps("Cipher", "PBEWithMD5AndDES", + psA("Cipher", "PBEWithMD5AndDES", "com.sun.crypto.provider.PBEWithMD5AndDESCipher", - pkcs5MD5_DESAliases, null); + null); ps("Cipher", "PBEWithMD5AndTripleDES", - "com.sun.crypto.provider.PBEWithMD5AndTripleDESCipher", - null, null); - ps("Cipher", "PBEWithSHA1AndDESede", + "com.sun.crypto.provider.PBEWithMD5AndTripleDESCipher"); + psA("Cipher", "PBEWithSHA1AndDESede", "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndDESede", - pkcs12DESedeAliases, null); - ps("Cipher", "PBEWithSHA1AndRC2_40", + null); + psA("Cipher", "PBEWithSHA1AndRC2_40", "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_40", - pkcs12RC2_40Aliases, null); - ps("Cipher", "PBEWithSHA1AndRC2_128", + null); + psA("Cipher", "PBEWithSHA1AndRC2_128", "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_128", - pkcs12RC2_128Aliases, null); - ps("Cipher", "PBEWithSHA1AndRC4_40", + null); + psA("Cipher", "PBEWithSHA1AndRC4_40", "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_40", - pkcs12RC4_40Aliases, null); + null); - ps("Cipher", "PBEWithSHA1AndRC4_128", + psA("Cipher", "PBEWithSHA1AndRC4_128", "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_128", - pkcs12RC4_128Aliases, null); + null); // PBES2 ps("Cipher", "PBEWithHmacSHA1AndAES_128", - "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_128", - null, null); + "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_128"); ps("Cipher", "PBEWithHmacSHA224AndAES_128", - "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_128", - null, null); + "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_128"); ps("Cipher", "PBEWithHmacSHA256AndAES_128", - "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_128", - null, null); + "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_128"); ps("Cipher", "PBEWithHmacSHA384AndAES_128", - "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_128", - null, null); + "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_128"); ps("Cipher", "PBEWithHmacSHA512AndAES_128", - "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_128", - null, null); + "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_128"); ps("Cipher", "PBEWithHmacSHA1AndAES_256", - "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_256", - null, null); + "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_256"); ps("Cipher", "PBEWithHmacSHA224AndAES_256", - "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_256", - null, null); + "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_256"); ps("Cipher", "PBEWithHmacSHA256AndAES_256", - "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_256", - null, null); + "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_256"); ps("Cipher", "PBEWithHmacSHA384AndAES_256", - "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_256", - null, null); + "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_256"); ps("Cipher", "PBEWithHmacSHA512AndAES_256", - "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_256", - null, null); + "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_256"); /* * Key(pair) Generator engines */ ps("KeyGenerator", "DES", - "com.sun.crypto.provider.DESKeyGenerator", - null, null); - ps("KeyGenerator", "DESede", + "com.sun.crypto.provider.DESKeyGenerator"); + psA("KeyGenerator", "DESede", "com.sun.crypto.provider.DESedeKeyGenerator", - desEdeAliases, null); + null); ps("KeyGenerator", "Blowfish", - "com.sun.crypto.provider.BlowfishKeyGenerator", - null, null); - ps("KeyGenerator", "AES", + "com.sun.crypto.provider.BlowfishKeyGenerator"); + psA("KeyGenerator", "AES", "com.sun.crypto.provider.AESKeyGenerator", - aesAliases, null); + null); ps("KeyGenerator", "RC2", - "com.sun.crypto.provider.KeyGeneratorCore$RC2KeyGenerator", - null, null); - ps("KeyGenerator", "ARCFOUR", + "com.sun.crypto.provider.KeyGeneratorCore$RC2KeyGenerator"); + psA("KeyGenerator", "ARCFOUR", "com.sun.crypto.provider.KeyGeneratorCore$ARCFOURKeyGenerator", - arcFourAliases, null); + null); ps("KeyGenerator", "ChaCha20", - "com.sun.crypto.provider.KeyGeneratorCore$ChaCha20KeyGenerator", - null, null); + "com.sun.crypto.provider.KeyGeneratorCore$ChaCha20KeyGenerator"); ps("KeyGenerator", "HmacMD5", - "com.sun.crypto.provider.HmacMD5KeyGenerator", - null, null); + "com.sun.crypto.provider.HmacMD5KeyGenerator"); - ps("KeyGenerator", "HmacSHA1", - "com.sun.crypto.provider.HmacSHA1KeyGenerator", - macSHA1Aliases, null); - ps("KeyGenerator", "HmacSHA224", + psA("KeyGenerator", "HmacSHA1", + "com.sun.crypto.provider.HmacSHA1KeyGenerator", null); + psA("KeyGenerator", "HmacSHA224", "com.sun.crypto.provider.KeyGeneratorCore$HmacSHA2KG$SHA224", - macSHA224Aliases, null); - ps("KeyGenerator", "HmacSHA256", + null); + psA("KeyGenerator", "HmacSHA256", "com.sun.crypto.provider.KeyGeneratorCore$HmacSHA2KG$SHA256", - macSHA256Aliases, null); - ps("KeyGenerator", "HmacSHA384", + null); + psA("KeyGenerator", "HmacSHA384", "com.sun.crypto.provider.KeyGeneratorCore$HmacSHA2KG$SHA384", - macSHA384Aliases, null); - ps("KeyGenerator", "HmacSHA512", + null); + psA("KeyGenerator", "HmacSHA512", "com.sun.crypto.provider.KeyGeneratorCore$HmacSHA2KG$SHA512", - macSHA512Aliases, null); + null); - ps("KeyPairGenerator", "DiffieHellman", + psA("KeyPairGenerator", "DiffieHellman", "com.sun.crypto.provider.DHKeyPairGenerator", - diffieHellmanAliases, null); + null); /* * Algorithm parameter generation engines */ - ps("AlgorithmParameterGenerator", + psA("AlgorithmParameterGenerator", "DiffieHellman", "com.sun.crypto.provider.DHParameterGenerator", - diffieHellmanAliases, null); + null); /* * Key Agreement engines @@ -437,142 +381,120 @@ attrs.clear(); attrs.put("SupportedKeyClasses", "javax.crypto.interfaces.DHPublicKey" + "|javax.crypto.interfaces.DHPrivateKey"); - ps("KeyAgreement", "DiffieHellman", + psA("KeyAgreement", "DiffieHellman", "com.sun.crypto.provider.DHKeyAgreement", - diffieHellmanAliases, attrs); + attrs); /* * Algorithm Parameter engines */ - ps("AlgorithmParameters", "DiffieHellman", - "com.sun.crypto.provider.DHParameters", - diffieHellmanAliases, null); + psA("AlgorithmParameters", "DiffieHellman", + "com.sun.crypto.provider.DHParameters", null); ps("AlgorithmParameters", "DES", - "com.sun.crypto.provider.DESParameters", - null, null); + "com.sun.crypto.provider.DESParameters"); - ps("AlgorithmParameters", "DESede", - "com.sun.crypto.provider.DESedeParameters", - desEdeAliases, null); + psA("AlgorithmParameters", "DESede", + "com.sun.crypto.provider.DESedeParameters", null); - ps("AlgorithmParameters", "PBEWithMD5AndDES", + psA("AlgorithmParameters", "PBEWithMD5AndDES", "com.sun.crypto.provider.PBEParameters", - pkcs5MD5_DESAliases, null); + null); ps("AlgorithmParameters", "PBEWithMD5AndTripleDES", - "com.sun.crypto.provider.PBEParameters", - null, null); + "com.sun.crypto.provider.PBEParameters"); - ps("AlgorithmParameters", "PBEWithSHA1AndDESede", + psA("AlgorithmParameters", "PBEWithSHA1AndDESede", "com.sun.crypto.provider.PBEParameters", - pkcs12DESedeAliases, null); + null); - ps("AlgorithmParameters", "PBEWithSHA1AndRC2_40", + psA("AlgorithmParameters", "PBEWithSHA1AndRC2_40", "com.sun.crypto.provider.PBEParameters", - pkcs12RC2_40Aliases, null); + null); - ps("AlgorithmParameters", "PBEWithSHA1AndRC2_128", + psA("AlgorithmParameters", "PBEWithSHA1AndRC2_128", "com.sun.crypto.provider.PBEParameters", - pkcs12RC2_128Aliases, null); + null); - ps("AlgorithmParameters", "PBEWithSHA1AndRC4_40", + psA("AlgorithmParameters", "PBEWithSHA1AndRC4_40", "com.sun.crypto.provider.PBEParameters", - pkcs12RC4_40Aliases, null); + null); - ps("AlgorithmParameters", "PBEWithSHA1AndRC4_128", + psA("AlgorithmParameters", "PBEWithSHA1AndRC4_128", "com.sun.crypto.provider.PBEParameters", - pkcs12RC4_128Aliases, null); + null); - ps("AlgorithmParameters", "PBES2", + psA("AlgorithmParameters", "PBES2", "com.sun.crypto.provider.PBES2Parameters$General", - pkcs5PBES2Aliases, null); + null); ps("AlgorithmParameters", "PBEWithHmacSHA1AndAES_128", - "com.sun.crypto.provider.PBES2Parameters$HmacSHA1AndAES_128", - null, null); + "com.sun.crypto.provider.PBES2Parameters$HmacSHA1AndAES_128"); ps("AlgorithmParameters", "PBEWithHmacSHA224AndAES_128", - "com.sun.crypto.provider.PBES2Parameters$HmacSHA224AndAES_128", - null, null); + "com.sun.crypto.provider.PBES2Parameters$HmacSHA224AndAES_128"); ps("AlgorithmParameters", "PBEWithHmacSHA256AndAES_128", - "com.sun.crypto.provider.PBES2Parameters$HmacSHA256AndAES_128", - null, null); + "com.sun.crypto.provider.PBES2Parameters$HmacSHA256AndAES_128"); ps("AlgorithmParameters", "PBEWithHmacSHA384AndAES_128", - "com.sun.crypto.provider.PBES2Parameters$HmacSHA384AndAES_128", - null, null); + "com.sun.crypto.provider.PBES2Parameters$HmacSHA384AndAES_128"); ps("AlgorithmParameters", "PBEWithHmacSHA512AndAES_128", - "com.sun.crypto.provider.PBES2Parameters$HmacSHA512AndAES_128", - null, null); + "com.sun.crypto.provider.PBES2Parameters$HmacSHA512AndAES_128"); ps("AlgorithmParameters", "PBEWithHmacSHA1AndAES_256", - "com.sun.crypto.provider.PBES2Parameters$HmacSHA1AndAES_256", - null, null); + "com.sun.crypto.provider.PBES2Parameters$HmacSHA1AndAES_256"); ps("AlgorithmParameters", "PBEWithHmacSHA224AndAES_256", - "com.sun.crypto.provider.PBES2Parameters$HmacSHA224AndAES_256", - null, null); + "com.sun.crypto.provider.PBES2Parameters$HmacSHA224AndAES_256"); ps("AlgorithmParameters", "PBEWithHmacSHA256AndAES_256", - "com.sun.crypto.provider.PBES2Parameters$HmacSHA256AndAES_256", - null, null); + "com.sun.crypto.provider.PBES2Parameters$HmacSHA256AndAES_256"); ps("AlgorithmParameters", "PBEWithHmacSHA384AndAES_256", - "com.sun.crypto.provider.PBES2Parameters$HmacSHA384AndAES_256", - null, null); + "com.sun.crypto.provider.PBES2Parameters$HmacSHA384AndAES_256"); ps("AlgorithmParameters", "PBEWithHmacSHA512AndAES_256", - "com.sun.crypto.provider.PBES2Parameters$HmacSHA512AndAES_256", - null, null); + "com.sun.crypto.provider.PBES2Parameters$HmacSHA512AndAES_256"); ps("AlgorithmParameters", "Blowfish", - "com.sun.crypto.provider.BlowfishParameters", - null, null); + "com.sun.crypto.provider.BlowfishParameters"); - ps("AlgorithmParameters", "AES", - "com.sun.crypto.provider.AESParameters", - aesAliases, null); + psA("AlgorithmParameters", "AES", + "com.sun.crypto.provider.AESParameters", null); ps("AlgorithmParameters", "GCM", - "com.sun.crypto.provider.GCMParameters", - null, null); + "com.sun.crypto.provider.GCMParameters"); ps("AlgorithmParameters", "RC2", - "com.sun.crypto.provider.RC2Parameters", - null, null); + "com.sun.crypto.provider.RC2Parameters"); ps("AlgorithmParameters", "OAEP", - "com.sun.crypto.provider.OAEPParameters", - null, null); + "com.sun.crypto.provider.OAEPParameters"); - ps("AlgorithmParameters", "ChaCha20-Poly1305", - "com.sun.crypto.provider.ChaCha20Poly1305Parameters", - chachaPolyAliases, null); + psA("AlgorithmParameters", "ChaCha20-Poly1305", + "com.sun.crypto.provider.ChaCha20Poly1305Parameters", null); /* * Key factories */ - ps("KeyFactory", "DiffieHellman", + psA("KeyFactory", "DiffieHellman", "com.sun.crypto.provider.DHKeyFactory", - diffieHellmanAliases, null); + null); /* * Secret-key factories */ ps("SecretKeyFactory", "DES", - "com.sun.crypto.provider.DESKeyFactory", - null, null); + "com.sun.crypto.provider.DESKeyFactory"); - ps("SecretKeyFactory", "DESede", - "com.sun.crypto.provider.DESedeKeyFactory", - desEdeAliases, null); + psA("SecretKeyFactory", "DESede", + "com.sun.crypto.provider.DESedeKeyFactory", null); - ps("SecretKeyFactory", "PBEWithMD5AndDES", + psA("SecretKeyFactory", "PBEWithMD5AndDES", "com.sun.crypto.provider.PBEKeyFactory$PBEWithMD5AndDES", - pkcs5MD5_DESAliases, null); + null); /* * Internal in-house crypto algorithm used for @@ -581,85 +503,70 @@ * algorithm. */ ps("SecretKeyFactory", "PBEWithMD5AndTripleDES", - "com.sun.crypto.provider.PBEKeyFactory$PBEWithMD5AndTripleDES", - null, null); + "com.sun.crypto.provider.PBEKeyFactory$PBEWithMD5AndTripleDES"); - ps("SecretKeyFactory", "PBEWithSHA1AndDESede", + psA("SecretKeyFactory", "PBEWithSHA1AndDESede", "com.sun.crypto.provider.PBEKeyFactory$PBEWithSHA1AndDESede", - pkcs12DESedeAliases, null); + null); - ps("SecretKeyFactory", "PBEWithSHA1AndRC2_40", + psA("SecretKeyFactory", "PBEWithSHA1AndRC2_40", "com.sun.crypto.provider.PBEKeyFactory$PBEWithSHA1AndRC2_40", - pkcs12RC2_40Aliases, null); + null); - ps("SecretKeyFactory", "PBEWithSHA1AndRC2_128", + psA("SecretKeyFactory", "PBEWithSHA1AndRC2_128", "com.sun.crypto.provider.PBEKeyFactory$PBEWithSHA1AndRC2_128", - pkcs12RC2_128Aliases, null); + null); - ps("SecretKeyFactory", "PBEWithSHA1AndRC4_40", + psA("SecretKeyFactory", "PBEWithSHA1AndRC4_40", "com.sun.crypto.provider.PBEKeyFactory$PBEWithSHA1AndRC4_40", - pkcs12RC4_40Aliases,null); + null); - ps("SecretKeyFactory", "PBEWithSHA1AndRC4_128", + psA("SecretKeyFactory", "PBEWithSHA1AndRC4_128", "com.sun.crypto.provider.PBEKeyFactory$PBEWithSHA1AndRC4_128", - pkcs12RC4_128Aliases, null); + null); ps("SecretKeyFactory", "PBEWithHmacSHA1AndAES_128", - "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA1AndAES_128", - null, null); + "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA1AndAES_128"); ps("SecretKeyFactory", "PBEWithHmacSHA224AndAES_128", - "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA224AndAES_128", - null, null); + "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA224AndAES_128"); ps("SecretKeyFactory", "PBEWithHmacSHA256AndAES_128", - "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA256AndAES_128", - null, null); + "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA256AndAES_128"); ps("SecretKeyFactory", "PBEWithHmacSHA384AndAES_128", - "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA384AndAES_128", - null, null); + "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA384AndAES_128"); ps("SecretKeyFactory", "PBEWithHmacSHA512AndAES_128", - "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512AndAES_128", - null, null); + "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512AndAES_128"); ps("SecretKeyFactory", "PBEWithHmacSHA1AndAES_256", - "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA1AndAES_256", - null, null); + "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA1AndAES_256"); ps("SecretKeyFactory", "PBEWithHmacSHA224AndAES_256", - "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA224AndAES_256", - null, null); + "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA224AndAES_256"); ps("SecretKeyFactory", "PBEWithHmacSHA256AndAES_256", - "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA256AndAES_256", - null, null); + "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA256AndAES_256"); ps("SecretKeyFactory", "PBEWithHmacSHA384AndAES_256", - "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA384AndAES_256", - null, null); + "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA384AndAES_256"); ps("SecretKeyFactory", "PBEWithHmacSHA512AndAES_256", - "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512AndAES_256", - null, null); + "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512AndAES_256"); // PBKDF2 - ps("SecretKeyFactory", "PBKDF2WithHmacSHA1", + psA("SecretKeyFactory", "PBKDF2WithHmacSHA1", "com.sun.crypto.provider.PBKDF2Core$HmacSHA1", - pkcs5PBKDF2Aliases, null); + null); ps("SecretKeyFactory", "PBKDF2WithHmacSHA224", - "com.sun.crypto.provider.PBKDF2Core$HmacSHA224", - null, null); + "com.sun.crypto.provider.PBKDF2Core$HmacSHA224"); ps("SecretKeyFactory", "PBKDF2WithHmacSHA256", - "com.sun.crypto.provider.PBKDF2Core$HmacSHA256", - null, null); + "com.sun.crypto.provider.PBKDF2Core$HmacSHA256"); ps("SecretKeyFactory", "PBKDF2WithHmacSHA384", - "com.sun.crypto.provider.PBKDF2Core$HmacSHA384", - null, null); + "com.sun.crypto.provider.PBKDF2Core$HmacSHA384"); ps("SecretKeyFactory", "PBKDF2WithHmacSHA512", - "com.sun.crypto.provider.PBKDF2Core$HmacSHA512", - null, null); + "com.sun.crypto.provider.PBKDF2Core$HmacSHA512"); /* * MAC @@ -667,23 +574,20 @@ attrs.clear(); attrs.put("SupportedKeyFormats", "RAW"); ps("Mac", "HmacMD5", "com.sun.crypto.provider.HmacMD5", null, attrs); - ps("Mac", "HmacSHA1", "com.sun.crypto.provider.HmacSHA1", - macSHA1Aliases, attrs); - ps("Mac", "HmacSHA224", "com.sun.crypto.provider.HmacCore$HmacSHA224", - macSHA224Aliases, attrs); - ps("Mac", "HmacSHA256", "com.sun.crypto.provider.HmacCore$HmacSHA256", - macSHA256Aliases, attrs); - ps("Mac", "HmacSHA384", "com.sun.crypto.provider.HmacCore$HmacSHA384", - macSHA384Aliases, attrs); - ps("Mac", "HmacSHA512", "com.sun.crypto.provider.HmacCore$HmacSHA512", - macSHA512Aliases, attrs); - // TODO: aliases with OIDs - ps("Mac", "HmacSHA512/224", - "com.sun.crypto.provider.HmacCore$HmacSHA512_224", - null, attrs); - ps("Mac", "HmacSHA512/256", - "com.sun.crypto.provider.HmacCore$HmacSHA512_256", - null, attrs); + psA("Mac", "HmacSHA1", "com.sun.crypto.provider.HmacSHA1", + attrs); + psA("Mac", "HmacSHA224", + "com.sun.crypto.provider.HmacCore$HmacSHA224", attrs); + psA("Mac", "HmacSHA256", + "com.sun.crypto.provider.HmacCore$HmacSHA256", attrs); + psA("Mac", "HmacSHA384", + "com.sun.crypto.provider.HmacCore$HmacSHA384", attrs); + psA("Mac", "HmacSHA512", + "com.sun.crypto.provider.HmacCore$HmacSHA512", attrs); + psA("Mac", "HmacSHA512/224", + "com.sun.crypto.provider.HmacCore$HmacSHA512_224", attrs); + psA("Mac", "HmacSHA512/256", + "com.sun.crypto.provider.HmacCore$HmacSHA512_256", attrs); ps("Mac", "HmacPBESHA1", "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA1", null, attrs); @@ -727,8 +631,7 @@ * KeyStore */ ps("KeyStore", "JCEKS", - "com.sun.crypto.provider.JceKeyStore", - null, null); + "com.sun.crypto.provider.JceKeyStore"); /* * SSL/TLS mechanisms @@ -739,24 +642,22 @@ * mechanisms, and it will cause calls to come here. */ ps("KeyGenerator", "SunTlsPrf", - "com.sun.crypto.provider.TlsPrfGenerator$V10", - null, null); + "com.sun.crypto.provider.TlsPrfGenerator$V10"); ps("KeyGenerator", "SunTls12Prf", - "com.sun.crypto.provider.TlsPrfGenerator$V12", - null, null); + "com.sun.crypto.provider.TlsPrfGenerator$V12"); ps("KeyGenerator", "SunTlsMasterSecret", "com.sun.crypto.provider.TlsMasterSecretGenerator", - createAliases("SunTls12MasterSecret", - "SunTlsExtendedMasterSecret"), null); + List.of("SunTls12MasterSecret", "SunTlsExtendedMasterSecret"), + null); ps("KeyGenerator", "SunTlsKeyMaterial", "com.sun.crypto.provider.TlsKeyMaterialGenerator", - createAliases("SunTls12KeyMaterial"), null); + List.of("SunTls12KeyMaterial"), null); ps("KeyGenerator", "SunTlsRsaPremasterSecret", "com.sun.crypto.provider.TlsRsaPremasterSecretGenerator", - createAliases("SunTls12RsaPremasterSecret"), null); + List.of("SunTls12RsaPremasterSecret"), null); } // Return the instance of this class or create one if needed. diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/TlsMasterSecretGenerator.java openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/TlsMasterSecretGenerator.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/crypto/provider/TlsMasterSecretGenerator.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/crypto/provider/TlsMasterSecretGenerator.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2005, 2017, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2005, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -25,6 +25,9 @@ package com.sun.crypto.provider; +import java.io.IOException; +import java.io.InvalidObjectException; +import java.io.ObjectInputStream; import java.security.*; import java.security.spec.AlgorithmParameterSpec; @@ -61,11 +64,11 @@ @SuppressWarnings("deprecation") protected void engineInit(AlgorithmParameterSpec params, SecureRandom random) throws InvalidAlgorithmParameterException { - if (params instanceof TlsMasterSecretParameterSpec == false) { + if (!(params instanceof TlsMasterSecretParameterSpec)) { throw new InvalidAlgorithmParameterException(MSG); } this.spec = (TlsMasterSecretParameterSpec)params; - if ("RAW".equals(spec.getPremasterSecret().getFormat()) == false) { + if (!"RAW".equals(spec.getPremasterSecret().getFormat())) { throw new InvalidAlgorithmParameterException( "Key format must be RAW"); } @@ -185,6 +188,21 @@ return key.clone(); } - } + /** + * Restores the state of this object from the stream. + * + * @param stream the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded + */ + private void readObject(ObjectInputStream stream) + throws IOException, ClassNotFoundException { + stream.defaultReadObject(); + if ((key == null) || (key.length == 0)) { + throw new InvalidObjectException("TlsMasterSecretKey is null"); + } + key = key.clone(); + } + } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/java/util/jar/pack/NativeUnpack.java openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/java/util/jar/pack/NativeUnpack.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/java/util/jar/pack/NativeUnpack.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/java/util/jar/pack/NativeUnpack.java 2023-10-06 05:33:33.000000000 +0000 @@ -61,7 +61,7 @@ // Resets the engine and frees all resources. // Returns total number of bytes consumed by the engine. - private synchronized native long finish(); + synchronized native long finish(); // Setting state in the unpacker. protected synchronized native boolean setOption(String opt, String value); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/java/util/jar/pack/UnpackerImpl.java openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/java/util/jar/pack/UnpackerImpl.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/com/sun/java/util/jar/pack/UnpackerImpl.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/com/sun/java/util/jar/pack/UnpackerImpl.java 2023-10-06 05:33:33.000000000 +0000 @@ -116,6 +116,11 @@ } catch (UnsatisfiedLinkError | NoClassDefFoundError ex) { // failover to java implementation (new DoUnpack()).run(in0, out); + } finally { + if (_nunp != null) { + // Free up native memory and JNI handles to prevent leaks + ((NativeUnpack) _nunp).finish(); + } } in0.close(); Utils.markJarFile(out); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/java/net/URI.java openjdk-11-11.0.21+9/src/java.base/share/classes/java/net/URI.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/java/net/URI.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/java/net/URI.java 2023-10-06 05:33:33.000000000 +0000 @@ -3193,6 +3193,7 @@ boolean serverChars; boolean regChars; + boolean skipParseException; if (scan(p, n, "]") > p) { // contains a literal IPv6 address, therefore % is allowed @@ -3208,15 +3209,28 @@ return n; } + // When parsing a URI, skip creating exception objects if the server-based + // authority is not required and the registry parse is successful. + // + skipParseException = (!requireServerAuthority && regChars); if (serverChars) { // Might be (probably is) a server-based authority, so attempt // to parse it as such. If the attempt fails, try to treat it // as a registry-based authority. try { - q = parseServer(p, n); - if (q < n) - failExpecting("end of authority", q); - authority = input.substring(p, n); + q = parseServer(p, n, skipParseException); + if (q < n) { + if (skipParseException) { + userInfo = null; + host = null; + port = -1; + q = p; + } else { + failExpecting("end of authority", q); + } + } else { + authority = input.substring(p, n); + } } catch (URISyntaxException x) { // Undo results of failed parse userInfo = null; @@ -3254,7 +3268,7 @@ // [@][:] // - private int parseServer(int start, int n) + private int parseServer(int start, int n, boolean skipParseException) throws URISyntaxException { int p = start; @@ -3294,7 +3308,7 @@ } else { q = parseIPv4Address(p, n); if (q <= p) - q = parseHostname(p, n); + q = parseHostname(p, n, skipParseException); p = q; } @@ -3311,7 +3325,10 @@ } p = q; } + } else if (p < n && skipParseException) { + return p; } + if (p < n) failExpecting("port number", p); @@ -3416,7 +3433,7 @@ // domainlabel = alphanum | alphanum *( alphanum | "-" ) alphanum // toplabel = alpha | alpha *( alphanum | "-" ) alphanum // - private int parseHostname(int start, int n) + private int parseHostname(int start, int n, boolean skipParseException) throws URISyntaxException { int p = start; @@ -3444,9 +3461,12 @@ p = q; } while (p < n); - if ((p < n) && !at(p, n, ':')) + if ((p < n) && !at(p, n, ':')) { + if (skipParseException) { + return p; + } fail("Illegal character in hostname", p); - + } if (l < 0) failExpecting("hostname", start); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/java/security/AlgorithmParameterGenerator.java openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/AlgorithmParameterGenerator.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/java/security/AlgorithmParameterGenerator.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/AlgorithmParameterGenerator.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 2020, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1997, 2021, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -309,7 +309,7 @@ * @param size the size (number of bits). */ public final void init(int size) { - paramGenSpi.engineInit(size, JCAUtil.getSecureRandom()); + paramGenSpi.engineInit(size, JCAUtil.getDefSecureRandom()); } /** @@ -340,7 +340,7 @@ */ public final void init(AlgorithmParameterSpec genParamSpec) throws InvalidAlgorithmParameterException { - paramGenSpi.engineInit(genParamSpec, JCAUtil.getSecureRandom()); + paramGenSpi.engineInit(genParamSpec, JCAUtil.getDefSecureRandom()); } /** diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/java/security/CodeSigner.java openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/CodeSigner.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/java/security/CodeSigner.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/CodeSigner.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2003, 2013, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2003, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -156,9 +156,9 @@ public String toString() { StringBuilder sb = new StringBuilder(); sb.append("("); - sb.append("Signer: " + signerCertPath.getCertificates().get(0)); + sb.append("Signer: ").append(signerCertPath.getCertificates().get(0)); if (timestamp != null) { - sb.append("timestamp: " + timestamp); + sb.append("timestamp: ").append(timestamp); } sb.append(")"); return sb.toString(); @@ -166,8 +166,11 @@ // Explicitly reset hash code value to -1 private void readObject(ObjectInputStream ois) - throws IOException, ClassNotFoundException { - ois.defaultReadObject(); - myhash = -1; + throws IOException, ClassNotFoundException { + ois.defaultReadObject(); + if (signerCertPath == null) { + throw new InvalidObjectException("signerCertPath is null"); + } + myhash = -1; } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/java/security/KeyPairGenerator.java openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/KeyPairGenerator.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/java/security/KeyPairGenerator.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/KeyPairGenerator.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1997, 2021, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -373,7 +373,7 @@ * supported by this KeyPairGenerator object. */ public void initialize(int keysize) { - initialize(keysize, JCAUtil.getSecureRandom()); + initialize(keysize, JCAUtil.getDefSecureRandom()); } /** @@ -433,7 +433,7 @@ */ public void initialize(AlgorithmParameterSpec params) throws InvalidAlgorithmParameterException { - initialize(params, JCAUtil.getSecureRandom()); + initialize(params, JCAUtil.getDefSecureRandom()); } /** diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/java/security/PKCS12Attribute.java openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/PKCS12Attribute.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/java/security/PKCS12Attribute.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/PKCS12Attribute.java 2023-10-06 05:33:33.000000000 +0000 @@ -76,7 +76,7 @@ // Validate name ObjectIdentifier type; try { - type = new ObjectIdentifier(name); + type = ObjectIdentifier.of(name); } catch (IOException e) { throw new IllegalArgumentException("Incorrect format: name", e); } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/java/security/Security.java openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/Security.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/java/security/Security.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/Security.java 2023-10-06 05:33:33.000000000 +0000 @@ -47,6 +47,9 @@ * implementation-specific location, which is typically the properties file * {@code conf/security/java.security} in the Java installation directory. * + * @implNote If the properties file fails to load, the JDK implementation will + * throw an unspecified error when initializing the {@code Security} class. + * * @author Benjamin Renaud * @since 1.1 */ @@ -81,130 +84,83 @@ private static void initialize() { props = new Properties(); - boolean loadedProps = false; boolean overrideAll = false; // first load the system properties file // to determine the value of security.overridePropertiesFile File propFile = securityPropFile("java.security"); - if (propFile.exists()) { - InputStream is = null; - try { - FileInputStream fis = new FileInputStream(propFile); - is = new BufferedInputStream(fis); - props.load(is); - loadedProps = true; - - if (sdebug != null) { - sdebug.println("reading security properties file: " + - propFile); - } - } catch (IOException e) { - if (sdebug != null) { - sdebug.println("unable to load security properties from " + - propFile); - e.printStackTrace(); - } - } finally { - if (is != null) { - try { - is.close(); - } catch (IOException ioe) { - if (sdebug != null) { - sdebug.println("unable to close input stream"); - } - } - } - } + boolean success = loadProps(propFile, null, false); + if (!success) { + throw new InternalError("Error loading java.security file"); } if ("true".equalsIgnoreCase(props.getProperty ("security.overridePropertiesFile"))) { String extraPropFile = System.getProperty - ("java.security.properties"); + ("java.security.properties"); if (extraPropFile != null && extraPropFile.startsWith("=")) { overrideAll = true; extraPropFile = extraPropFile.substring(1); } + loadProps(null, extraPropFile, overrideAll); + } + } - if (overrideAll) { - props = new Properties(); - if (sdebug != null) { - sdebug.println - ("overriding other security properties files!"); + private static boolean loadProps(File masterFile, String extraPropFile, boolean overrideAll) { + InputStream is = null; + try { + if (masterFile != null && masterFile.exists()) { + is = new FileInputStream(masterFile); + } else if (extraPropFile != null) { + extraPropFile = PropertyExpander.expand(extraPropFile); + File propFile = new File(extraPropFile); + URL propURL; + if (propFile.exists()) { + propURL = new URL + ("file:" + propFile.getCanonicalPath()); + } else { + propURL = new URL(extraPropFile); } - } - - // now load the user-specified file so its values - // will win if they conflict with the earlier values - if (extraPropFile != null) { - BufferedInputStream bis = null; - try { - URL propURL; - - extraPropFile = PropertyExpander.expand(extraPropFile); - propFile = new File(extraPropFile); - if (propFile.exists()) { - propURL = new URL - ("file:" + propFile.getCanonicalPath()); - } else { - propURL = new URL(extraPropFile); - } - bis = new BufferedInputStream(propURL.openStream()); - props.load(bis); - loadedProps = true; - if (sdebug != null) { - sdebug.println("reading security properties file: " + - propURL); - if (overrideAll) { - sdebug.println - ("overriding other security properties files!"); - } - } - } catch (Exception e) { + is = propURL.openStream(); + if (overrideAll) { + props = new Properties(); if (sdebug != null) { sdebug.println - ("unable to load security properties from " + - extraPropFile); - e.printStackTrace(); - } - } finally { - if (bis != null) { - try { - bis.close(); - } catch (IOException ioe) { - if (sdebug != null) { - sdebug.println("unable to close input stream"); - } - } + ("overriding other security properties files!"); } } + } else { + // unexpected + return false; } - } - - if (!loadedProps) { - initializeStatic(); + props.load(is); + if (sdebug != null) { + // ExceptionInInitializerError if masterFile.getName() is + // called here (NPE!). Leave as is (and few lines down) + sdebug.println("reading security properties file: " + + masterFile == null ? extraPropFile : "java.security"); + } + return true; + } catch (IOException | PropertyExpander.ExpandException e) { if (sdebug != null) { - sdebug.println("unable to load security properties " + - "-- using defaults"); + sdebug.println("unable to load security properties from " + + masterFile == null ? extraPropFile : "java.security"); + e.printStackTrace(); + } + return false; + } finally { + if (is != null) { + try { + is.close(); + } catch (IOException ioe) { + if (sdebug != null) { + sdebug.println("unable to close input stream"); + } + } } } - - } - - /* - * Initialize to default values, if /lib/java.security - * is not found. - */ - private static void initializeStatic() { - props.put("security.provider.1", "sun.security.provider.Sun"); - props.put("security.provider.2", "sun.security.rsa.SunRsaSign"); - props.put("security.provider.3", "com.sun.net.ssl.internal.ssl.Provider"); - props.put("security.provider.4", "com.sun.crypto.provider.SunJCE"); - props.put("security.provider.5", "sun.security.jgss.SunProvider"); - props.put("security.provider.6", "com.sun.security.sasl.Provider"); } /** diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/java/security/cert/CertPathHelperImpl.java openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/cert/CertPathHelperImpl.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/java/security/cert/CertPathHelperImpl.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/cert/CertPathHelperImpl.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2002, 2020, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2002, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -25,12 +25,10 @@ package java.security.cert; -import java.util.*; +import java.util.Date; import sun.security.provider.certpath.CertPathHelper; -import sun.security.x509.GeneralNameInterface; - /** * Helper class that allows the Sun CertPath provider to access * implementation dependent APIs in CertPath framework. @@ -55,11 +53,6 @@ } } - protected void implSetPathToNames(X509CertSelector sel, - Set names) { - sel.setPathToNamesInternal(names); - } - protected void implSetDateAndTime(X509CRLSelector sel, Date date, long skew) { sel.setDateAndTime(date, skew); } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/java/security/cert/CertificateFactory.java openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/cert/CertificateFactory.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/java/security/cert/CertificateFactory.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/cert/CertificateFactory.java 2023-10-06 05:33:33.000000000 +0000 @@ -26,14 +26,14 @@ package java.security.cert; import java.io.InputStream; -import java.util.Collection; -import java.util.Iterator; -import java.util.List; -import java.util.Objects; import java.security.Provider; import java.security.Security; import java.security.NoSuchAlgorithmException; import java.security.NoSuchProviderException; +import java.util.Collection; +import java.util.Iterator; +import java.util.List; +import java.util.Objects; import sun.security.jca.*; import sun.security.jca.GetInstance.Instance; @@ -352,7 +352,9 @@ public final Certificate generateCertificate(InputStream inStream) throws CertificateException { - return certFacSpi.engineGenerateCertificate(inStream); + Certificate c = certFacSpi.engineGenerateCertificate(inStream); + JCAUtil.tryCommitCertEvent(c); + return c; } /** diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/java/security/cert/CertificateRevokedException.java openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/cert/CertificateRevokedException.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/java/security/cert/CertificateRevokedException.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/cert/CertificateRevokedException.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2007, 2017, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2007, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -243,7 +243,7 @@ boolean critical = ois.readBoolean(); byte[] extVal = IOUtils.readExactlyNBytes(ois, ois.readInt()); Extension ext = sun.security.x509.Extension.newExtension - (new ObjectIdentifier(oid), critical, extVal); + (ObjectIdentifier.of(oid), critical, extVal); extensions.put(oid, ext); } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/java/security/cert/X509CertSelector.java openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/cert/X509CertSelector.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/java/security/cert/X509CertSelector.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/java/security/cert/X509CertSelector.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2000, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -31,11 +31,7 @@ import java.util.*; import javax.security.auth.x500.X500Principal; -import sun.security.util.HexDumpEncoder; -import sun.security.util.Debug; -import sun.security.util.DerInputStream; -import sun.security.util.DerValue; -import sun.security.util.ObjectIdentifier; +import sun.security.util.*; import sun.security.x509.*; /** @@ -88,11 +84,7 @@ private static final Debug debug = Debug.getInstance("certpath"); private static final ObjectIdentifier ANY_EXTENDED_KEY_USAGE = - ObjectIdentifier.newInternal(new int[] {2, 5, 29, 37, 0}); - - static { - CertPathHelperImpl.initialize(); - } + ObjectIdentifier.of(KnownOIDs.anyExtendedKeyUsage); private BigInteger serialNumber; private X500Principal issuer; @@ -506,7 +498,7 @@ if (oid == null) { subjectPublicKeyAlgID = null; } else { - subjectPublicKeyAlgID = new ObjectIdentifier(oid); + subjectPublicKeyAlgID = ObjectIdentifier.of(oid); } } @@ -622,7 +614,7 @@ Collections.unmodifiableSet(new HashSet<>(keyPurposeSet)); keyPurposeOIDSet = new HashSet<>(); for (String s : this.keyPurposeSet) { - keyPurposeOIDSet.add(new ObjectIdentifier(s)); + keyPurposeOIDSet.add(ObjectIdentifier.of(s)); } } } @@ -1105,8 +1097,8 @@ if (!(o instanceof String)) { throw new IOException("non String in certPolicySet"); } - polIdVector.add(new CertificatePolicyId(new ObjectIdentifier( - (String)o))); + polIdVector.add(new CertificatePolicyId + (ObjectIdentifier.of((String)o))); } // If everything went OK, make the changes policySet = tempSet; @@ -1177,14 +1169,6 @@ } } - // called from CertPathHelper - void setPathToNamesInternal(Set names) { - // set names to non-null dummy value - // this breaks getPathToNames() - pathToNames = Collections.>emptySet(); - pathToGeneralNames = names; - } - /** * Adds a name to the pathToNames criterion. The {@code X509Certificate} * must not include name constraints that would prohibit building a diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/java/util/concurrent/CompletableFuture.java openjdk-11-11.0.21+9/src/java.base/share/classes/java/util/concurrent/CompletableFuture.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/java/util/concurrent/CompletableFuture.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/java/util/concurrent/CompletableFuture.java 2023-10-06 05:33:33.000000000 +0000 @@ -1807,6 +1807,8 @@ * interrupted. */ private Object waitingGet(boolean interruptible) { + if (interruptible && Thread.interrupted()) + return null; Signaller q = null; boolean queued = false; Object r; @@ -1818,25 +1820,25 @@ } else if (!queued) queued = tryPushStack(q); + else if (interruptible && q.interrupted) { + q.thread = null; + cleanStack(); + return null; + } else { try { ForkJoinPool.managedBlock(q); } catch (InterruptedException ie) { // currently cannot happen q.interrupted = true; } - if (q.interrupted && interruptible) - break; } } - if (q != null && queued) { + if (q != null) { q.thread = null; - if (!interruptible && q.interrupted) + if (q.interrupted) Thread.currentThread().interrupt(); - if (r == null) - cleanStack(); } - if (r != null || (r = result) != null) - postComplete(); + postComplete(); return r; } @@ -1845,45 +1847,49 @@ * throws TimeoutException on timeout. */ private Object timedGet(long nanos) throws TimeoutException { - if (Thread.interrupted()) - return null; - if (nanos > 0L) { - long d = System.nanoTime() + nanos; - long deadline = (d == 0L) ? 1L : d; // avoid 0 - Signaller q = null; - boolean queued = false; - Object r; - while ((r = result) == null) { // similar to untimed - if (q == null) { - q = new Signaller(true, nanos, deadline); - if (Thread.currentThread() instanceof ForkJoinWorkerThread) - ForkJoinPool.helpAsyncBlocker(defaultExecutor(), q); - } - else if (!queued) - queued = tryPushStack(q); - else if (q.nanos <= 0L) - break; - else { - try { - ForkJoinPool.managedBlock(q); - } catch (InterruptedException ie) { - q.interrupted = true; - } - if (q.interrupted) - break; - } + long d = System.nanoTime() + nanos; + long deadline = (d == 0L) ? 1L : d; // avoid 0 + boolean interrupted = false, queued = false; + Signaller q = null; + Object r = null; + for (;;) { // order of checking interrupt, result, timeout matters + if (interrupted || (interrupted = Thread.interrupted())) + break; + else if ((r = result) != null) + break; + else if (nanos <= 0L) + break; + else if (q == null) { + q = new Signaller(true, nanos, deadline); + if (Thread.currentThread() instanceof ForkJoinWorkerThread) + ForkJoinPool.helpAsyncBlocker(defaultExecutor(), q); } - if (q != null && queued) { - q.thread = null; - if (r == null) - cleanStack(); + else if (!queued) + queued = tryPushStack(q); + else { + try { + ForkJoinPool.managedBlock(q); + interrupted = q.interrupted; + nanos = q.nanos; + } catch (InterruptedException ie) { + interrupted = true; + } } - if (r != null || (r = result) != null) - postComplete(); - if (r != null || (q != null && q.interrupted)) - return r; } - throw new TimeoutException(); + if (q != null) { + q.thread = null; + if (r == null) + cleanStack(); + } + if (r != null) { + if (interrupted) + Thread.currentThread().interrupt(); + postComplete(); + return r; + } else if (interrupted) + return null; + else + throw new TimeoutException(); } /* ------------- public methods -------------- */ diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/java/util/concurrent/ConcurrentHashMap.java openjdk-11-11.0.21+9/src/java.base/share/classes/java/util/concurrent/ConcurrentHashMap.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/java/util/concurrent/ConcurrentHashMap.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/java/util/concurrent/ConcurrentHashMap.java 2023-10-06 05:33:33.000000000 +0000 @@ -2852,22 +2852,20 @@ * Possibly blocks awaiting root lock. */ private final void contendedLock() { - boolean waiting = false; + Thread current = Thread.currentThread(), w; for (int s;;) { if (((s = lockState) & ~WAITER) == 0) { if (U.compareAndSetInt(this, LOCKSTATE, s, WRITER)) { - if (waiting) - waiter = null; + if (waiter == current) + U.compareAndSetObject(this, WAITERTHREAD, current, null); return; } } - else if ((s & WAITER) == 0) { - if (U.compareAndSetInt(this, LOCKSTATE, s, s | WAITER)) { - waiting = true; - waiter = Thread.currentThread(); - } - } - else if (waiting) + else if ((s & WAITER) == 0) + U.compareAndSetInt(this, LOCKSTATE, s, s | WAITER); + else if ((w = waiter) == null) + U.compareAndSetObject(this, WAITERTHREAD, null, current); + else if (w == current) LockSupport.park(this); } } @@ -3287,6 +3285,8 @@ private static final Unsafe U = Unsafe.getUnsafe(); private static final long LOCKSTATE = U.objectFieldOffset(TreeBin.class, "lockState"); + private static final long WAITERTHREAD + = U.objectFieldOffset(TreeBin.class, "waiter"); } /* ----------------Table Traversal -------------- */ diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/java/util/zip/ZipFile.java openjdk-11-11.0.21+9/src/java.base/share/classes/java/util/zip/ZipFile.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/java/util/zip/ZipFile.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/java/util/zip/ZipFile.java 2023-10-06 05:33:33.000000000 +0000 @@ -66,7 +66,7 @@ import jdk.internal.ref.CleanerFactory; import jdk.internal.vm.annotation.Stable; import sun.nio.cs.UTF_8; -import sun.security.action.GetBooleanAction; +import sun.security.action.GetPropertyAction; import java.security.AccessController; import static java.util.zip.ZipConstants64.*; @@ -120,12 +120,12 @@ public static final int OPEN_READ = 0x1; /** - * Flag which specifies whether the validation of the Zip64 extra - * fields should be disabled + * Flag to specify whether the Extra ZIP64 validation should be + * disabled. */ - private static final boolean disableZip64ExtraFieldValidation = - AccessController.doPrivileged - (new GetBooleanAction("jdk.util.zip.disableZip64ExtraFieldValidation")); + private static final boolean DISABLE_ZIP64_EXTRA_VALIDATION = + getDisableZip64ExtraFieldValidation(); + /** * Mode flag to open a zip file and mark it for deletion. The file will be * deleted some time between the moment that it is opened and the moment @@ -1131,6 +1131,22 @@ private static boolean isWindows; private static final JavaLangAccess JLA; + /** + * Returns the value of the System property which indicates whether the + * Extra ZIP64 validation should be disabled. + */ + static boolean getDisableZip64ExtraFieldValidation() { + boolean result; + String value = GetPropertyAction.privilegedGetProperty( + "jdk.util.zip.disableZip64ExtraFieldValidation"); + if (value == null) { + result = false; + } else { + result = value.isEmpty() || value.equalsIgnoreCase("true"); + } + return result; + } + static { SharedSecrets.setJavaUtilZipFileAccess( new JavaUtilZipFileAccess() { @@ -1241,25 +1257,32 @@ zerror("Invalid CEN header (extra data field size too long)"); } int currentOffset = startingOffset; - while (currentOffset < extraEndOffset) { + // Walk through each Extra Header. Each Extra Header Must consist of: + // Header ID - 2 bytes + // Data Size - 2 bytes: + while (currentOffset + Integer.BYTES <= extraEndOffset) { int tag = get16(cen, currentOffset); currentOffset += Short.BYTES; int tagBlockSize = get16(cen, currentOffset); + currentOffset += Short.BYTES; int tagBlockEndingOffset = currentOffset + tagBlockSize; // The ending offset for this tag block should not go past the // offset for the end of the extra field if (tagBlockEndingOffset > extraEndOffset) { - zerror("Invalid CEN header (invalid zip64 extra data field size)"); + zerror(String.format( + "Invalid CEN header (invalid extra data field size for " + + "tag: 0x%04x at %d)", + tag, cenPos)); } - currentOffset += Short.BYTES; if (tag == ZIP64_EXTID) { // Get the compressed size; long csize = CENSIZ(cen, cenPos); // Get the uncompressed size; long size = CENLEN(cen, cenPos); + checkZip64ExtraFieldValues(currentOffset, tagBlockSize, csize, size); } @@ -1283,6 +1306,16 @@ long size) throws ZipException { byte[] cen = this.cen; + // if ZIP64_EXTID blocksize == 0, which may occur with some older + // versions of Apache Ant and Commons Compress, validate csize and size + // to make sure neither field == ZIP64_MAGICVAL + if (blockSize == 0) { + if (csize == ZIP64_MAGICVAL || size == ZIP64_MAGICVAL) { + zerror("Invalid CEN header (invalid zip64 extra data field size)"); + } + // Only validate the ZIP64_EXTID data if the block size > 0 + return; + } // Validate the Zip64 Extended Information Extra Field (0x0001) // length. if (!isZip64ExtBlockSizeValid(blockSize)) { @@ -1693,7 +1726,7 @@ } else { checkEncoding(zc, cen, pos + CENHDR, nlen); } - if (elen > 0 && !disableZip64ExtraFieldValidation) { + if (elen > 0 && !DISABLE_ZIP64_EXTRA_VALIDATION) { long extraStartingOffset = pos + CENHDR + nlen; if ((int)extraStartingOffset != extraStartingOffset) { zerror("invalid CEN header (bad extra offset)"); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/javax/crypto/Cipher.java openjdk-11-11.0.21+9/src/java.base/share/classes/javax/crypto/Cipher.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/javax/crypto/Cipher.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/javax/crypto/Cipher.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 2018, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1997, 2021, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -1220,7 +1220,7 @@ * by the underlying {@code CipherSpi}. */ public final void init(int opmode, Key key) throws InvalidKeyException { - init(opmode, key, JCAUtil.getSecureRandom()); + init(opmode, key, JCAUtil.getDefSecureRandom()); } /** @@ -1361,7 +1361,7 @@ public final void init(int opmode, Key key, AlgorithmParameterSpec params) throws InvalidKeyException, InvalidAlgorithmParameterException { - init(opmode, key, params, JCAUtil.getSecureRandom()); + init(opmode, key, params, JCAUtil.getDefSecureRandom()); } /** @@ -1504,7 +1504,7 @@ public final void init(int opmode, Key key, AlgorithmParameters params) throws InvalidKeyException, InvalidAlgorithmParameterException { - init(opmode, key, params, JCAUtil.getSecureRandom()); + init(opmode, key, params, JCAUtil.getDefSecureRandom()); } /** @@ -1652,7 +1652,7 @@ public final void init(int opmode, Certificate certificate) throws InvalidKeyException { - init(opmode, certificate, JCAUtil.getSecureRandom()); + init(opmode, certificate, JCAUtil.getDefSecureRandom()); } /** diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/javax/crypto/KeyAgreement.java openjdk-11-11.0.21+9/src/java.base/share/classes/javax/crypto/KeyAgreement.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/javax/crypto/KeyAgreement.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/javax/crypto/KeyAgreement.java 2023-10-06 05:33:33.000000000 +0000 @@ -446,7 +446,7 @@ * has an incompatible algorithm type. */ public final void init(Key key) throws InvalidKeyException { - init(key, JCAUtil.getSecureRandom()); + init(key, JCAUtil.getDefSecureRandom()); } /** @@ -514,7 +514,7 @@ public final void init(Key key, AlgorithmParameterSpec params) throws InvalidKeyException, InvalidAlgorithmParameterException { - init(key, params, JCAUtil.getSecureRandom()); + init(key, params, JCAUtil.getDefSecureRandom()); } private String getProviderName() { diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/javax/crypto/KeyGenerator.java openjdk-11-11.0.21+9/src/java.base/share/classes/javax/crypto/KeyGenerator.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/javax/crypto/KeyGenerator.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/javax/crypto/KeyGenerator.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 2020, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1997, 2021, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -450,7 +450,7 @@ public final void init(AlgorithmParameterSpec params) throws InvalidAlgorithmParameterException { - init(params, JCAUtil.getSecureRandom()); + init(params, JCAUtil.getDefSecureRandom()); } /** @@ -514,7 +514,7 @@ * supported. */ public final void init(int keysize) { - init(keysize, JCAUtil.getSecureRandom()); + init(keysize, JCAUtil.getDefSecureRandom()); } /** diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/javax/crypto/spec/SecretKeySpec.java openjdk-11-11.0.21+9/src/java.base/share/classes/javax/crypto/spec/SecretKeySpec.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/javax/crypto/spec/SecretKeySpec.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/javax/crypto/spec/SecretKeySpec.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1998, 2017, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1998, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -25,6 +25,9 @@ package javax.crypto.spec; +import java.io.IOException; +import java.io.InvalidObjectException; +import java.io.ObjectInputStream; import java.security.MessageDigest; import java.security.spec.KeySpec; import java.util.Locale; @@ -232,4 +235,25 @@ return MessageDigest.isEqual(this.key, thatKey); } + + /** + * Restores the state of this object from the stream. + * + * @param stream the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded + */ + private void readObject(ObjectInputStream stream) + throws IOException, ClassNotFoundException { + stream.defaultReadObject(); + + if (key == null || algorithm == null) { + throw new InvalidObjectException("Missing argument"); + } + + this.key = key.clone(); + if (key.length == 0) { + throw new InvalidObjectException("Invalid key length"); + } + } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/javax/net/ssl/SSLContextSpi.java openjdk-11-11.0.21+9/src/java.base/share/classes/javax/net/ssl/SSLContextSpi.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/javax/net/ssl/SSLContextSpi.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/javax/net/ssl/SSLContextSpi.java 2023-10-06 05:33:33.000000000 +0000 @@ -210,10 +210,9 @@ */ protected SSLParameters engineGetSupportedSSLParameters() { SSLSocket socket = getDefaultSocket(); - SSLParameters params = new SSLParameters(); + SSLParameters params = socket.getSSLParameters(); params.setCipherSuites(socket.getSupportedCipherSuites()); params.setProtocols(socket.getSupportedProtocols()); return params; } - } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/javax/security/auth/callback/ChoiceCallback.java openjdk-11-11.0.21+9/src/java.base/share/classes/javax/security/auth/callback/ChoiceCallback.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/javax/security/auth/callback/ChoiceCallback.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/javax/security/auth/callback/ChoiceCallback.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1999, 2015, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1999, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -25,6 +25,10 @@ package javax.security.auth.callback; +import java.io.IOException; +import java.io.InvalidObjectException; +import java.io.ObjectInputStream; + /** *

Underlying security services instantiate and pass a * {@code ChoiceCallback} to the {@code handle} @@ -42,7 +46,7 @@ * @serial * @since 1.4 */ - private String prompt; + private final String prompt; /** * @serial the list of choices * @since 1.4 @@ -52,13 +56,13 @@ * @serial the choice to be used as the default choice * @since 1.4 */ - private int defaultChoice; + private final int defaultChoice; /** * @serial whether multiple selections are allowed from the list of * choices * @since 1.4 */ - private boolean multipleSelectionsAllowed; + private final boolean multipleSelectionsAllowed; /** * @serial the selected choices, represented as indexes into the * {@code choices} list. @@ -71,7 +75,6 @@ * a list of choices, a default choice, and a boolean specifying * whether or not multiple selections from the list of choices are allowed. * - * * @param prompt the prompt used to describe the list of choices. * * @param choices the list of choices. @@ -103,15 +106,15 @@ defaultChoice < 0 || defaultChoice >= choices.length) throw new IllegalArgumentException(); + this.prompt = prompt; + this.defaultChoice = defaultChoice; + this.multipleSelectionsAllowed = multipleSelectionsAllowed; + + this.choices = choices.clone(); for (int i = 0; i < choices.length; i++) { if (choices[i] == null || choices[i].isEmpty()) throw new IllegalArgumentException(); } - - this.prompt = prompt; - this.choices = choices; - this.defaultChoice = defaultChoice; - this.multipleSelectionsAllowed = multipleSelectionsAllowed; } /** @@ -129,7 +132,7 @@ * @return the list of choices. */ public String[] getChoices() { - return choices; + return choices.clone(); } /** @@ -180,7 +183,7 @@ public void setSelectedIndexes(int[] selections) { if (!multipleSelectionsAllowed) throw new UnsupportedOperationException(); - this.selections = selections; + this.selections = selections == null ? null : selections.clone(); } /** @@ -192,6 +195,39 @@ * @see #setSelectedIndexes */ public int[] getSelectedIndexes() { - return selections; + return selections == null ? null : selections.clone(); + } + + /** + * Restores the state of this object from the stream. + * + * @param stream the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded + */ + private void readObject(ObjectInputStream stream) + throws IOException, ClassNotFoundException { + stream.defaultReadObject(); + + if ((prompt == null) || prompt.isEmpty() || + (choices == null) || (choices.length == 0) || + (defaultChoice < 0) || (defaultChoice >= choices.length)) { + throw new InvalidObjectException( + "Missing/invalid prompt/choices"); + } + + choices = choices.clone(); + for (int i = 0; i < choices.length; i++) { + if ((choices[i] == null) || choices[i].isEmpty()) + throw new InvalidObjectException("Null/empty choices"); + } + + if (selections != null) { + selections = selections.clone(); + if (!multipleSelectionsAllowed && (selections.length != 1)) { + throw new InvalidObjectException( + "Multiple selections not allowed"); + } + } } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/javax/security/auth/callback/ConfirmationCallback.java openjdk-11-11.0.21+9/src/java.base/share/classes/javax/security/auth/callback/ConfirmationCallback.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/javax/security/auth/callback/ConfirmationCallback.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/javax/security/auth/callback/ConfirmationCallback.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1999, 2015, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1999, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -25,6 +25,9 @@ package javax.security.auth.callback; +import java.io.IOException; +import java.io.ObjectInputStream; + /** *

Underlying security services instantiate and pass a * {@code ConfirmationCallback} to the {@code handle} @@ -121,26 +124,27 @@ /** ERROR message type. */ public static final int ERROR = 2; + /** * @serial * @since 1.4 */ - private String prompt; + private final String prompt; /** * @serial * @since 1.4 */ - private int messageType; + private final int messageType; /** * @serial * @since 1.4 */ - private int optionType = UNSPECIFIED_OPTION; + private final int optionType; /** * @serial * @since 1.4 */ - private int defaultOption; + private final int defaultOption; /** * @serial * @since 1.4 @@ -205,8 +209,10 @@ break; } + this.prompt = null; this.messageType = messageType; this.optionType = optionType; + this.options = null; this.defaultOption = defaultOption; } @@ -247,14 +253,16 @@ defaultOption < 0 || defaultOption >= options.length) throw new IllegalArgumentException(); + this.prompt = null; + this.messageType = messageType; + this.optionType = UNSPECIFIED_OPTION; + this.defaultOption = defaultOption; + + this.options = options.clone(); for (int i = 0; i < options.length; i++) { if (options[i] == null || options[i].isEmpty()) throw new IllegalArgumentException(); } - - this.messageType = messageType; - this.options = options; - this.defaultOption = defaultOption; } /** @@ -318,6 +326,7 @@ this.prompt = prompt; this.messageType = messageType; this.optionType = optionType; + this.options = null; this.defaultOption = defaultOption; } @@ -363,15 +372,16 @@ defaultOption < 0 || defaultOption >= options.length) throw new IllegalArgumentException(); + this.prompt = prompt; + this.messageType = messageType; + this.optionType = UNSPECIFIED_OPTION; + this.defaultOption = defaultOption; + + this.options = options.clone(); for (int i = 0; i < options.length; i++) { if (options[i] == null || options[i].isEmpty()) throw new IllegalArgumentException(); } - - this.prompt = prompt; - this.messageType = messageType; - this.options = options; - this.defaultOption = defaultOption; } /** @@ -422,7 +432,7 @@ * an {@code optionType} instead of {@code options}. */ public String[] getOptions() { - return options; + return options == null ? null : options.clone(); } /** @@ -477,4 +487,19 @@ public int getSelectedIndex() { return selection; } + + /** + * Restores the state of this object from the stream. + * + * @param stream the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded + */ + private void readObject(ObjectInputStream stream) + throws IOException, ClassNotFoundException { + stream.defaultReadObject(); + if (options != null) { + options = options.clone(); + } + } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/javax/security/auth/callback/PasswordCallback.java openjdk-11-11.0.21+9/src/java.base/share/classes/javax/security/auth/callback/PasswordCallback.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/javax/security/auth/callback/PasswordCallback.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/javax/security/auth/callback/PasswordCallback.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1999, 2015, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1999, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -25,6 +25,15 @@ package javax.security.auth.callback; +import java.lang.ref.Cleaner; +import java.util.Arrays; + +import jdk.internal.ref.CleanerFactory; + +import java.io.IOException; +import java.io.InvalidObjectException; +import java.io.ObjectInputStream; + /** *

Underlying security services instantiate and pass a * {@code PasswordCallback} to the {@code handle} @@ -37,16 +46,20 @@ private static final long serialVersionUID = 2267422647454909926L; + private transient Cleaner.Cleanable cleanable; + /** * @serial * @since 1.4 */ - private String prompt; + private final String prompt; + /** * @serial * @since 1.4 */ - private boolean echoOn; + private final boolean echoOn; + /** * @serial * @since 1.4 @@ -105,7 +118,19 @@ * @see #getPassword */ public void setPassword(char[] password) { + // Cleanup the last buffered password copy. + if (cleanable != null) { + cleanable.clean(); + cleanable = null; + } + + // Set the retrieved password. this.inputPassword = (password == null ? null : password.clone()); + + if (this.inputPassword != null) { + cleanable = CleanerFactory.cleaner().register( + this, cleanerFor(inputPassword)); + } } /** @@ -125,9 +150,38 @@ * Clear the retrieved password. */ public void clearPassword() { + // Cleanup the last retrieved password copy. + if (cleanable != null) { + cleanable.clean(); + cleanable = null; + } + } + + private static Runnable cleanerFor(char[] password) { + return () -> { + Arrays.fill(password, ' '); + }; + } + + /** + * Restores the state of this object from the stream. + * + * @param stream the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded + */ + private void readObject(ObjectInputStream stream) + throws IOException, ClassNotFoundException { + stream.defaultReadObject(); + + if (prompt == null || prompt.isEmpty()) { + throw new InvalidObjectException("Missing prompt"); + } + if (inputPassword != null) { - for (int i = 0; i < inputPassword.length; i++) - inputPassword[i] = ' '; + inputPassword = inputPassword.clone(); + cleanable = CleanerFactory.cleaner().register( + this, cleanerFor(inputPassword)); } } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/jdk/internal/event/X509CertificateEvent.java openjdk-11-11.0.21+9/src/java.base/share/classes/jdk/internal/event/X509CertificateEvent.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/jdk/internal/event/X509CertificateEvent.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/jdk/internal/event/X509CertificateEvent.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -31,6 +31,15 @@ */ public final class X509CertificateEvent extends Event { + private static final X509CertificateEvent EVENT = new X509CertificateEvent(); + + /** + * Returns {@code true} if event is enabled, {@code false} otherwise. + */ + public static boolean isTurnedOn() { + return EVENT.isEnabled(); + } + public String algorithm; public String serialNumber; public String subject; diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/launcher/LauncherHelper.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/launcher/LauncherHelper.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/launcher/LauncherHelper.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/launcher/LauncherHelper.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2007, 2021, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2007, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -87,6 +87,7 @@ import jdk.internal.module.Modules; import jdk.internal.platform.Container; import jdk.internal.platform.Metrics; +import sun.util.calendar.ZoneInfoFile; public final class LauncherHelper { @@ -280,6 +281,8 @@ Locale.getDefault(Category.DISPLAY).getDisplayName()); ostream.println(INDENT + "default format locale = " + Locale.getDefault(Category.FORMAT).getDisplayName()); + ostream.println(INDENT + "tzdata version = " + + ZoneInfoFile.getVersion()); printLocales(); ostream.println(); } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/net/www/http/KeepAliveCache.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/net/www/http/KeepAliveCache.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/net/www/http/KeepAliveCache.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/net/www/http/KeepAliveCache.java 2023-10-06 05:33:33.000000000 +0000 @@ -113,38 +113,45 @@ * @param url The URL contains info about the host and port * @param http The HttpClient to be cached */ - public synchronized void put(final URL url, Object obj, HttpClient http) { - boolean startThread = (keepAliveTimer == null); - if (!startThread) { - if (!keepAliveTimer.isAlive()) { - startThread = true; - } - } - if (startThread) { - clear(); - /* Unfortunately, we can't always believe the keep-alive timeout we got - * back from the server. If I'm connected through a Netscape proxy - * to a server that sent me a keep-alive - * time of 15 sec, the proxy unilaterally terminates my connection - * The robustness to get around this is in HttpClient.parseHTTP() - */ - final KeepAliveCache cache = this; - AccessController.doPrivileged(new PrivilegedAction<>() { - public Void run() { - keepAliveTimer = InnocuousThread.newSystemThread("Keep-Alive-Timer", cache); - keepAliveTimer.setDaemon(true); - keepAliveTimer.setPriority(Thread.MAX_PRIORITY - 2); - keepAliveTimer.start(); - return null; + public void put(final URL url, Object obj, HttpClient http) { + // this method may need to close an HttpClient, either because + // it is not cacheable, or because the cache is at its capacity. + // In the latter case, we close the least recently used client. + // The client to close is stored in oldClient, and is closed + // after cacheLock is released. + HttpClient oldClient = null; + synchronized (this) { + boolean startThread = (keepAliveTimer == null); + if (!startThread) { + if (!keepAliveTimer.isAlive()) { + startThread = true; } - }); - } + } + if (startThread) { + clear(); + /* Unfortunately, we can't always believe the keep-alive timeout we got + * back from the server. If I'm connected through a Netscape proxy + * to a server that sent me a keep-alive + * time of 15 sec, the proxy unilaterally terminates my connection + * The robustness to get around this is in HttpClient.parseHTTP() + */ + final KeepAliveCache cache = this; + AccessController.doPrivileged(new PrivilegedAction<>() { + public Void run() { + keepAliveTimer = InnocuousThread.newSystemThread("Keep-Alive-Timer", cache); + keepAliveTimer.setDaemon(true); + keepAliveTimer.setPriority(Thread.MAX_PRIORITY - 2); + keepAliveTimer.start(); + return null; + } + }); + } - KeepAliveKey key = new KeepAliveKey(url, obj); - ClientVector v = super.get(key); + KeepAliveKey key = new KeepAliveKey(url, obj); + ClientVector v = super.get(key); - if (v == null) { - int keepAliveTimeout = http.getKeepAliveTimeout(); + if (v == null) { + int keepAliveTimeout = http.getKeepAliveTimeout(); if (keepAliveTimeout == 0) { keepAliveTimeout = getUserKeepAlive(http.getUsingProxy()); if (keepAliveTimeout == -1) { @@ -164,14 +171,19 @@ // alive, which could be 0, if the user specified 0 for the property assert keepAliveTimeout >= 0; if (keepAliveTimeout == 0) { - http.closeServer(); + oldClient = http; } else { v = new ClientVector(keepAliveTimeout * 1000); v.put(http); super.put(key, v); } - } else { - v.put(http); + } else { + oldClient = v.put(http); + } + } + // close after releasing locks + if (oldClient != null) { + oldClient.closeServer(); } } @@ -221,6 +233,7 @@ try { Thread.sleep(LIFETIME); } catch (InterruptedException e) {} + List closeList = null; // Remove all outdated HttpClients. synchronized (this) { @@ -230,15 +243,18 @@ for (KeepAliveKey key : keySet()) { ClientVector v = get(key); synchronized (v) { - KeepAliveEntry e = v.peek(); + KeepAliveEntry e = v.peekLast(); while (e != null) { if ((currentTime - e.idleStartTime) > v.nap) { - v.poll(); - e.hc.closeServer(); + v.pollLast(); + if (closeList == null) { + closeList = new ArrayList<>(); + } + closeList.add(e.hc); } else { break; } - e = v.peek(); + e = v.peekLast(); } if (v.isEmpty()) { @@ -251,6 +267,12 @@ removeVector(key); } } + // close connections outside cacheLock + if (closeList != null) { + for (HttpClient hc : closeList) { + hc.closeServer(); + } + } } while (!isEmpty()); } @@ -268,8 +290,8 @@ } } -/* FILO order for recycling HttpClients, should run in a thread - * to time them out. If > maxConns are in use, block. +/* LIFO order for reusing HttpClients. Most recent entries at the front. + * If > maxConns are in use, discard oldest. */ class ClientVector extends ArrayDeque { private static final long serialVersionUID = -8680532108106489459L; @@ -282,36 +304,37 @@ } synchronized HttpClient get() { - if (isEmpty()) { + // check the most recent connection, use if still valid + KeepAliveEntry e = peekFirst(); + if (e == null) { return null; } - // Loop until we find a connection that has not timed out - HttpClient hc = null; long currentTime = System.currentTimeMillis(); - do { - KeepAliveEntry e = pop(); - if ((currentTime - e.idleStartTime) > nap) { - e.hc.closeServer(); - } else { - hc = e.hc; - if (KeepAliveCache.logger.isLoggable(PlatformLogger.Level.FINEST)) { - String msg = "cached HttpClient was idle for " + if ((currentTime - e.idleStartTime) > nap) { + return null; // all connections stale - will be cleaned up later + } else { + pollFirst(); + if (KeepAliveCache.logger.isLoggable(PlatformLogger.Level.FINEST)) { + String msg = "cached HttpClient was idle for " + Long.toString(currentTime - e.idleStartTime); - KeepAliveCache.logger.finest(msg); - } + KeepAliveCache.logger.finest(msg); } - } while ((hc == null) && (!isEmpty())); - return hc; + return e.hc; + } } /* return a still valid, unused HttpClient */ - synchronized void put(HttpClient h) { + synchronized HttpClient put(HttpClient h) { + HttpClient staleClient = null; + assert KeepAliveCache.getMaxConnections() > 0; if (size() >= KeepAliveCache.getMaxConnections()) { - h.closeServer(); // otherwise the connection remains in limbo - } else { - push(new KeepAliveEntry(h, System.currentTimeMillis())); + // remove oldest connection + staleClient = removeLast().hc; } + addFirst(new KeepAliveEntry(h, System.currentTimeMillis())); + // close after releasing the locks + return staleClient; } /* remove an HttpClient */ @@ -339,10 +362,10 @@ } class KeepAliveKey { - private String protocol = null; - private String host = null; - private int port = 0; - private Object obj = null; // additional key, such as socketfactory + private final String protocol; + private final String host; + private final int port; + private final Object obj; // additional key, such as socketfactory /** * Constructor @@ -383,8 +406,8 @@ } class KeepAliveEntry { - HttpClient hc; - long idleStartTime; + final HttpClient hc; + final long idleStartTime; KeepAliveEntry(HttpClient hc, long idleStartTime) { this.hc = hc; diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/net/www/protocol/http/AuthenticationInfo.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/net/www/protocol/http/AuthenticationInfo.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/net/www/protocol/http/AuthenticationInfo.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/net/www/protocol/http/AuthenticationInfo.java 2023-10-06 05:33:33.000000000 +0000 @@ -517,4 +517,13 @@ s2 = new String (pw.getPassword()); s.defaultWriteObject (); } + + /** + * Releases any system or cryptographic resources. + * It is up to implementors to override disposeContext() + * to take necessary action. + */ + public void disposeContext() { + // do nothing + } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/net/www/protocol/http/HttpURLConnection.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/net/www/protocol/http/HttpURLConnection.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/net/www/protocol/http/HttpURLConnection.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/net/www/protocol/http/HttpURLConnection.java 2023-10-06 05:33:33.000000000 +0000 @@ -1953,6 +1953,12 @@ if (serverAuthKey != null) { AuthenticationInfo.endAuthRequest(serverAuthKey); } + if (proxyAuthentication != null) { + proxyAuthentication.disposeContext(); + } + if (serverAuthentication != null) { + serverAuthentication.disposeContext(); + } } } @@ -2182,6 +2188,9 @@ if (proxyAuthKey != null) { AuthenticationInfo.endAuthRequest(proxyAuthKey); } + if (proxyAuthentication != null) { + proxyAuthentication.disposeContext(); + } } // restore original request headers @@ -2428,6 +2437,7 @@ } if (ret != null) { if (!ret.setHeaders(this, p, raw)) { + ret.disposeContext(); ret = null; } } @@ -2596,6 +2606,7 @@ if (ret != null ) { if (!ret.setHeaders(this, p, raw)) { + ret.disposeContext(); ret = null; } } @@ -2622,6 +2633,7 @@ DigestAuthentication da = (DigestAuthentication) currentProxyCredentials; da.checkResponse (raw, method, getRequestURI()); + currentProxyCredentials.disposeContext(); currentProxyCredentials = null; } } @@ -2632,6 +2644,7 @@ DigestAuthentication da = (DigestAuthentication) currentServerCredentials; da.checkResponse (raw, method, url); + currentServerCredentials.disposeContext(); currentServerCredentials = null; } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/net/www/protocol/http/NegotiateAuthentication.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/net/www/protocol/http/NegotiateAuthentication.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/net/www/protocol/http/NegotiateAuthentication.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/net/www/protocol/http/NegotiateAuthentication.java 2023-10-06 05:33:33.000000000 +0000 @@ -225,6 +225,22 @@ return negotiator.nextToken(token); } + /** + * Releases any system resources and cryptographic information stored in + * the context object and invalidates the context. + */ + @Override + public void disposeContext() { + if (negotiator != null) { + try { + negotiator.disposeContext(); + } catch (IOException ioEx) { + //do not rethrow IOException + } + negotiator = null; + } + } + // MS will send a final WWW-Authenticate even if the status is already // 200 OK. The token can be fed into initSecContext() again to determine // if the server can be trusted. This is not the same concept as Digest's diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/net/www/protocol/http/Negotiator.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/net/www/protocol/http/Negotiator.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/net/www/protocol/http/Negotiator.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/net/www/protocol/http/Negotiator.java 2023-10-06 05:33:33.000000000 +0000 @@ -82,5 +82,7 @@ logger.finest("NegotiateAuthentication: " + e); } } + + public void disposeContext() throws IOException { }; } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/net/www/protocol/https/HttpsClient.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/net/www/protocol/https/HttpsClient.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/net/www/protocol/https/HttpsClient.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/net/www/protocol/https/HttpsClient.java 2023-10-06 05:33:33.000000000 +0000 @@ -428,6 +428,14 @@ } } + @Override + public void closeServer() { + try { + // SSLSocket.close may block up to timeout. Make sure it's short. + serverSocket.setSoTimeout(1); + } catch (Exception e) {} + super.closeServer(); + } @Override public boolean needsTunneling() { diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/jca/JCAUtil.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/jca/JCAUtil.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/jca/JCAUtil.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/jca/JCAUtil.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2003, 2015, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2003, 2021, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -26,8 +26,14 @@ package sun.security.jca; import java.lang.ref.*; - import java.security.*; +import java.security.PublicKey; +import java.security.cert.Certificate; +import java.security.cert.X509Certificate; + +import jdk.internal.event.EventHelper; +import jdk.internal.event.X509CertificateEvent; +import sun.security.util.KeyUtil; /** * Collection of static utility methods used by the security framework. @@ -59,6 +65,8 @@ public static SecureRandom instance = new SecureRandom(); } + private static volatile SecureRandom def = null; + /** * Get a SecureRandom instance. This method should be used by JDK * internal code in favor of calling "new SecureRandom()". That needs to @@ -69,4 +77,69 @@ return CachedSecureRandomHolder.instance; } + // called by sun.security.jca.Providers class when provider list is changed + static void clearDefSecureRandom() { + def = null; + } + + /** + * Get the default SecureRandom instance. This method is the + * optimized version of "new SecureRandom()" which re-uses the default + * SecureRandom impl if the provider table is the same. + */ + public static SecureRandom getDefSecureRandom() { + SecureRandom result = def; + if (result == null) { + synchronized (JCAUtil.class) { + result = def; + if (result == null) { + def = result = new SecureRandom(); + } + } + } + return result; + + } + + public static void tryCommitCertEvent(Certificate cert) { + if ((X509CertificateEvent.isTurnedOn() || EventHelper.isLoggingSecurity())) { + if (cert instanceof X509Certificate) { + X509Certificate x509 = (X509Certificate) cert; + PublicKey pKey = x509.getPublicKey(); + String algId = x509.getSigAlgName(); + String serNum = x509.getSerialNumber().toString(16); + String subject = x509.getSubjectX500Principal().toString(); + String issuer = x509.getIssuerX500Principal().toString(); + String keyType = pKey.getAlgorithm(); + int length = KeyUtil.getKeySize(pKey); + int hashCode = x509.hashCode(); + long beginDate = x509.getNotBefore().getTime(); + long endDate = x509.getNotAfter().getTime(); + if (X509CertificateEvent.isTurnedOn()) { + X509CertificateEvent xce = new X509CertificateEvent(); + xce.algorithm = algId; + xce.serialNumber = serNum; + xce.subject = subject; + xce.issuer = issuer; + xce.keyType = keyType; + xce.keyLength = length; + xce.certificateId = hashCode; + xce.validFrom = beginDate; + xce.validUntil = endDate; + xce.commit(); + } + if (EventHelper.isLoggingSecurity()) { + EventHelper.logX509CertificateEvent(algId, + serNum, + subject, + issuer, + keyType, + length, + hashCode, + beginDate, + endDate); + } + } + } + } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/jca/Providers.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/jca/Providers.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/jca/Providers.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/jca/Providers.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2003, 2021, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -150,6 +150,7 @@ } else { changeThreadProviderList(newList); } + JCAUtil.clearDefSecureRandom(); } /** diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/pkcs/ContentInfo.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/pkcs/ContentInfo.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/pkcs/ContentInfo.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/pkcs/ContentInfo.java 2023-10-06 05:33:33.000000000 +0000 @@ -38,50 +38,36 @@ public class ContentInfo { // pkcs7 pre-defined content types - private static int[] pkcs7 = {1, 2, 840, 113549, 1, 7}; - private static int[] data = {1, 2, 840, 113549, 1, 7, 1}; - private static int[] sdata = {1, 2, 840, 113549, 1, 7, 2}; - private static int[] edata = {1, 2, 840, 113549, 1, 7, 3}; - private static int[] sedata = {1, 2, 840, 113549, 1, 7, 4}; - private static int[] ddata = {1, 2, 840, 113549, 1, 7, 5}; - private static int[] crdata = {1, 2, 840, 113549, 1, 7, 6}; - private static int[] nsdata = {2, 16, 840, 1, 113730, 2, 5}; - // timestamp token (id-ct-TSTInfo) from RFC 3161 - private static int[] tstInfo = {1, 2, 840, 113549, 1, 9, 16, 1, 4}; + public static ObjectIdentifier PKCS7_OID = + ObjectIdentifier.of(KnownOIDs.PKCS7); + public static ObjectIdentifier DATA_OID = + ObjectIdentifier.of(KnownOIDs.Data); + public static ObjectIdentifier SIGNED_DATA_OID = + ObjectIdentifier.of(KnownOIDs.SignedData); + public static ObjectIdentifier ENVELOPED_DATA_OID = + ObjectIdentifier.of(KnownOIDs.EnvelopedData); + public static ObjectIdentifier SIGNED_AND_ENVELOPED_DATA_OID = + ObjectIdentifier.of(KnownOIDs.SignedAndEnvelopedData); + public static ObjectIdentifier DIGESTED_DATA_OID = + ObjectIdentifier.of(KnownOIDs.DigestedData); + public static ObjectIdentifier ENCRYPTED_DATA_OID = + ObjectIdentifier.of(KnownOIDs.EncryptedData); + // this is for backwards-compatibility with JDK 1.1.x - private static final int[] OLD_SDATA = {1, 2, 840, 1113549, 1, 7, 2}; - private static final int[] OLD_DATA = {1, 2, 840, 1113549, 1, 7, 1}; - public static ObjectIdentifier PKCS7_OID; - public static ObjectIdentifier DATA_OID; - public static ObjectIdentifier SIGNED_DATA_OID; - public static ObjectIdentifier ENVELOPED_DATA_OID; - public static ObjectIdentifier SIGNED_AND_ENVELOPED_DATA_OID; - public static ObjectIdentifier DIGESTED_DATA_OID; - public static ObjectIdentifier ENCRYPTED_DATA_OID; - public static ObjectIdentifier OLD_SIGNED_DATA_OID; - public static ObjectIdentifier OLD_DATA_OID; - public static ObjectIdentifier NETSCAPE_CERT_SEQUENCE_OID; - public static ObjectIdentifier TIMESTAMP_TOKEN_INFO_OID; + public static ObjectIdentifier OLD_SIGNED_DATA_OID = + ObjectIdentifier.of(KnownOIDs.JDK_OLD_SignedData); + public static ObjectIdentifier OLD_DATA_OID = + ObjectIdentifier.of(KnownOIDs.JDK_OLD_Data); - static { - PKCS7_OID = ObjectIdentifier.newInternal(pkcs7); - DATA_OID = ObjectIdentifier.newInternal(data); - SIGNED_DATA_OID = ObjectIdentifier.newInternal(sdata); - ENVELOPED_DATA_OID = ObjectIdentifier.newInternal(edata); - SIGNED_AND_ENVELOPED_DATA_OID = ObjectIdentifier.newInternal(sedata); - DIGESTED_DATA_OID = ObjectIdentifier.newInternal(ddata); - ENCRYPTED_DATA_OID = ObjectIdentifier.newInternal(crdata); - OLD_SIGNED_DATA_OID = ObjectIdentifier.newInternal(OLD_SDATA); - OLD_DATA_OID = ObjectIdentifier.newInternal(OLD_DATA); - /** - * The ASN.1 systax for the Netscape Certificate Sequence - * data type is defined - * - * here. - */ - NETSCAPE_CERT_SEQUENCE_OID = ObjectIdentifier.newInternal(nsdata); - TIMESTAMP_TOKEN_INFO_OID = ObjectIdentifier.newInternal(tstInfo); - } + // The ASN.1 systax for the Netscape Certificate Sequence data type is + // defined at: + // http://wp.netscape.com/eng/security/comm4-cert-download.html + public static ObjectIdentifier NETSCAPE_CERT_SEQUENCE_OID = + ObjectIdentifier.of(KnownOIDs.NETSCAPE_CertSequence); + + // timestamp token (id-ct-TSTInfo) from RFC 3161 + public static ObjectIdentifier TIMESTAMP_TOKEN_INFO_OID = + ObjectIdentifier.of(KnownOIDs.TimeStampTokenInfo); ObjectIdentifier contentType; DerValue content; // OPTIONAL diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/pkcs/PKCS7.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/pkcs/PKCS7.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/pkcs/PKCS7.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/pkcs/PKCS7.java 2023-10-06 05:33:33.000000000 +0000 @@ -36,6 +36,7 @@ import java.security.cert.CertificateFactory; import java.security.*; +import sun.security.jca.JCAUtil; import sun.security.timestamp.*; import sun.security.util.*; import sun.security.x509.AlgorithmId; @@ -70,23 +71,6 @@ private Principal[] certIssuerNames; /* - * Random number generator for creating nonce values - * (Lazy initialization) - */ - private static class SecureRandomHolder { - static final SecureRandom RANDOM; - static { - SecureRandom tmp = null; - try { - tmp = SecureRandom.getInstance("SHA1PRNG"); - } catch (NoSuchAlgorithmException e) { - // should not happen - } - RANDOM = tmp; - } - } - - /* * Object identifier for the timestamping key purpose. */ private static final String KP_TIMESTAMPING_OID = "1.3.6.1.5.5.7.3.8"; @@ -885,11 +869,9 @@ } // Generate a nonce - BigInteger nonce = null; - if (SecureRandomHolder.RANDOM != null) { - nonce = new BigInteger(64, SecureRandomHolder.RANDOM); - tsQuery.setNonce(nonce); - } + BigInteger nonce = new BigInteger(64, JCAUtil.getDefSecureRandom()); + tsQuery.setNonce(nonce); + tsQuery.requestCertificate(true); TSResponse tsReply = tsa.generateTimestamp(tsQuery); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/pkcs/PKCS9Attribute.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/pkcs/PKCS9Attribute.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/pkcs/PKCS9Attribute.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/pkcs/PKCS9Attribute.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1997, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -28,9 +28,7 @@ import java.io.IOException; import java.io.OutputStream; import java.security.cert.CertificateException; -import java.util.Locale; import java.util.Date; -import java.util.Hashtable; import sun.security.x509.CertificateExtensions; import sun.security.util.*; diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/pkcs12/PKCS12KeyStore.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/pkcs12/PKCS12KeyStore.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/pkcs12/PKCS12KeyStore.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/pkcs12/PKCS12KeyStore.java 2023-10-06 05:33:33.000000000 +0000 @@ -64,17 +64,11 @@ import javax.security.auth.x500.X500Principal; import sun.security.action.GetPropertyAction; -import sun.security.util.Debug; -import sun.security.util.DerInputStream; -import sun.security.util.DerOutputStream; -import sun.security.util.DerValue; -import sun.security.util.ObjectIdentifier; +import sun.security.util.*; import sun.security.pkcs.ContentInfo; -import sun.security.util.SecurityProperties; import sun.security.x509.AlgorithmId; import sun.security.pkcs.EncryptedPrivateKeyInfo; import sun.security.provider.JavaKeyStore.JKS; -import sun.security.util.KeyStoreDelegator; /** @@ -133,43 +127,42 @@ private static final int MAX_ITERATION_COUNT = 5000000; private static final int SALT_LEN = 20; - // friendlyName, localKeyId, trustedKeyUsage - private static final String[] CORE_ATTRIBUTES = { - "1.2.840.113549.1.9.20", - "1.2.840.113549.1.9.21", - "2.16.840.1.113894.746875.1.1" + private static final KnownOIDs[] CORE_ATTRIBUTES = { + KnownOIDs.FriendlyName, + KnownOIDs.LocalKeyID, + KnownOIDs.ORACLE_TrustedKeyUsage }; private static final Debug debug = Debug.getInstance("pkcs12"); - private static final int[] keyBag = {1, 2, 840, 113549, 1, 12, 10, 1, 2}; - private static final int[] certBag = {1, 2, 840, 113549, 1, 12, 10, 1, 3}; - private static final int[] secretBag = {1, 2, 840, 113549, 1, 12, 10, 1, 5}; + private static final ObjectIdentifier PKCS8ShroudedKeyBag_OID = + ObjectIdentifier.of(KnownOIDs.PKCS8ShroudedKeyBag); + private static final ObjectIdentifier CertBag_OID = + ObjectIdentifier.of(KnownOIDs.CertBag); + private static final ObjectIdentifier SecretBag_OID = + ObjectIdentifier.of(KnownOIDs.SecretBag); + + private static final ObjectIdentifier PKCS9FriendlyName_OID = + ObjectIdentifier.of(KnownOIDs.FriendlyName); + private static final ObjectIdentifier PKCS9LocalKeyId_OID = + ObjectIdentifier.of(KnownOIDs.LocalKeyID); + private static final ObjectIdentifier PKCS9CertType_OID = + ObjectIdentifier.of(KnownOIDs.CertTypeX509); + private static final ObjectIdentifier pbes2_OID = + ObjectIdentifier.of(KnownOIDs.PBES2); - private static final int[] pkcs9Name = {1, 2, 840, 113549, 1, 9, 20}; - private static final int[] pkcs9KeyId = {1, 2, 840, 113549, 1, 9, 21}; - - private static final int[] pkcs9certType = {1, 2, 840, 113549, 1, 9, 22, 1}; - - private static final int[] pbes2 = {1, 2, 840, 113549, 1, 5, 13}; - // TODO: temporary Oracle OID /* - * { joint-iso-itu-t(2) country(16) us(840) organization(1) oracle(113894) - * jdk(746875) crypto(1) id-at-trustedKeyUsage(1) } + * Temporary Oracle OID + * + * {joint-iso-itu-t(2) country(16) us(840) organization(1) + * oracle(113894) jdk(746875) crypto(1) id-at-trustedKeyUsage(1)} */ - private static final int[] TrustedKeyUsage = - {2, 16, 840, 1, 113894, 746875, 1, 1}; - private static final int[] AnyExtendedKeyUsage = {2, 5, 29, 37, 0}; - - private static final ObjectIdentifier PKCS8ShroudedKeyBag_OID; - private static final ObjectIdentifier CertBag_OID; - private static final ObjectIdentifier SecretBag_OID; - private static final ObjectIdentifier PKCS9FriendlyName_OID; - private static final ObjectIdentifier PKCS9LocalKeyId_OID; - private static final ObjectIdentifier PKCS9CertType_OID; - private static final ObjectIdentifier pbes2_OID; - private static final ObjectIdentifier TrustedKeyUsage_OID; - private static final ObjectIdentifier[] AnyUsage; + private static final ObjectIdentifier TrustedKeyUsage_OID = + ObjectIdentifier.of(KnownOIDs.ORACLE_TrustedKeyUsage); + + private static final ObjectIdentifier[] AnyUsage = new ObjectIdentifier[] { + ObjectIdentifier.of(KnownOIDs.anyExtendedKeyUsage) + }; private int counter = 0; @@ -198,23 +191,6 @@ // the source of randomness private SecureRandom random; - static { - try { - PKCS8ShroudedKeyBag_OID = new ObjectIdentifier(keyBag); - CertBag_OID = new ObjectIdentifier(certBag); - SecretBag_OID = new ObjectIdentifier(secretBag); - PKCS9FriendlyName_OID = new ObjectIdentifier(pkcs9Name); - PKCS9LocalKeyId_OID = new ObjectIdentifier(pkcs9KeyId); - PKCS9CertType_OID = new ObjectIdentifier(pkcs9certType); - pbes2_OID = new ObjectIdentifier(pbes2); - TrustedKeyUsage_OID = new ObjectIdentifier(TrustedKeyUsage); - AnyUsage = new ObjectIdentifier[]{ - new ObjectIdentifier(AnyExtendedKeyUsage)}; - } catch (IOException ioe) { - throw new AssertionError("OID not initialized", ioe); - } - } - // A keystore entry and associated attributes private static class Entry { Date date; // the creation date of this entry @@ -1655,9 +1631,9 @@ for (KeyStore.Entry.Attribute attribute : attributes) { String attributeName = attribute.getName(); // skip friendlyName, localKeyId and trustedKeyUsage - if (CORE_ATTRIBUTES[0].equals(attributeName) || - CORE_ATTRIBUTES[1].equals(attributeName) || - CORE_ATTRIBUTES[2].equals(attributeName)) { + if (CORE_ATTRIBUTES[0].value().equals(attributeName) || + CORE_ATTRIBUTES[1].value().equals(attributeName) || + CORE_ATTRIBUTES[2].value().equals(attributeName)) { continue; } attrs.write(((PKCS12Attribute) attribute).getEncoded()); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/DSAPublicKeyImpl.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/DSAPublicKeyImpl.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/DSAPublicKeyImpl.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/DSAPublicKeyImpl.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2005, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2005, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -25,17 +25,20 @@ package sun.security.provider; +import java.io.IOException; +import java.io.InvalidObjectException; +import java.io.ObjectInputStream; import java.math.BigInteger; import java.security.KeyRep; import java.security.InvalidKeyException; /** * An X.509 public key for the Digital Signature Algorithm. - * + *

* The difference between DSAPublicKeyImpl and DSAPublicKey is that * DSAPublicKeyImpl calls writeReplace with KeyRep, and DSAPublicKey * calls writeObject. - * + *

* See the comments in DSAKeyFactory, 4532506, and 6232513. * */ @@ -70,10 +73,25 @@ super(encoded); } - protected Object writeReplace() throws java.io.ObjectStreamException { + private Object writeReplace() throws java.io.ObjectStreamException { return new KeyRep(KeyRep.Type.PUBLIC, getAlgorithm(), getFormat(), getEncoded()); } + + /** + * Restores the state of this object from the stream. + *

+ * Deserialization of this object is not supported. + * + * @param stream the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded + */ + private void readObject(ObjectInputStream stream) + throws IOException, ClassNotFoundException { + throw new InvalidObjectException( + "DSAPublicKeyImpl keys are not directly deserializable"); + } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/KeyProtector.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/KeyProtector.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/KeyProtector.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/KeyProtector.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 2018, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1997, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -39,6 +39,7 @@ import sun.security.pkcs.EncryptedPrivateKeyInfo; import sun.security.x509.AlgorithmId; import sun.security.util.ObjectIdentifier; +import sun.security.util.KnownOIDs; import sun.security.util.DerValue; /** @@ -106,9 +107,6 @@ private static final String DIGEST_ALG = "SHA"; private static final int DIGEST_LEN = 20; - // defined by JavaSoft - private static final String KEY_PROTECTOR_OID = "1.3.6.1.4.1.42.2.17.1.1"; - // The password used for protecting/recovering keys passed through this // key protector. We store it as a byte array, so that we can digest it. private byte[] passwdBytes; @@ -214,7 +212,8 @@ // EncryptedPrivateKeyInfo, and returns its encoding AlgorithmId encrAlg; try { - encrAlg = new AlgorithmId(new ObjectIdentifier(KEY_PROTECTOR_OID)); + encrAlg = new AlgorithmId(ObjectIdentifier.of + (KnownOIDs.JAVASOFT_JDKKeyProtector)); return new EncryptedPrivateKeyInfo(encrAlg,encrKey).getEncoded(); } catch (IOException ioe) { throw new KeyStoreException(ioe.getMessage()); @@ -236,7 +235,8 @@ // do we support the algorithm? AlgorithmId encrAlg = encrInfo.getAlgorithm(); - if (!(encrAlg.getOID().toString().equals(KEY_PROTECTOR_OID))) { + if (!(encrAlg.getOID().toString().equals + (KnownOIDs.JAVASOFT_JDKKeyProtector.value()))) { throw new UnrecoverableKeyException("Unsupported key protection " + "algorithm"); } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/PolicyFile.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/PolicyFile.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/PolicyFile.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/PolicyFile.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 2022, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1997, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -2090,8 +2090,17 @@ this.actions.equals(that.actions))) return false; - if (this.certs.length != that.certs.length) + if ((this.certs == null) && (that.certs == null)) { + return true; + } + + if ((this.certs == null) || (that.certs == null)) { + return false; + } + + if (this.certs.length != that.certs.length) { return false; + } int i,j; boolean match; @@ -2161,7 +2170,7 @@ } public Certificate[] getCerts() { - return certs; + return (certs == null ? null : certs.clone()); } /** @@ -2174,6 +2183,21 @@ @Override public String toString() { return "(SelfPermission " + type + " " + name + " " + actions + ")"; } + + /** + * Restores the state of this object from the stream. + * + * @param stream the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded + */ + private void readObject(ObjectInputStream stream) + throws IOException, ClassNotFoundException { + stream.defaultReadObject(); + if (certs != null) { + this.certs = certs.clone(); + } + } } /** diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/SecureRandom.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/SecureRandom.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/SecureRandom.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/SecureRandom.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1998, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1998, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -26,6 +26,7 @@ package sun.security.provider; import java.io.IOException; +import java.io.InvalidObjectException; import java.security.MessageDigest; import java.security.SecureRandomSpi; import java.security.NoSuchAlgorithmException; @@ -187,7 +188,7 @@ /** * This static object will be seeded by SeedGenerator, and used * to seed future instances of SHA1PRNG SecureRandoms. - * + *

* Bloch, Effective Java Second Edition: Item 71 */ private static class SeederHolder { @@ -262,17 +263,23 @@ } /* - * readObject is called to restore the state of the random object from - * a stream. We have to create a new instance of MessageDigest, because + * This method is called to restore the state of the random object from + * a stream. + *

+ * We have to create a new instance of {@code MessageDigest}, because * it is not included in the stream (it is marked "transient"). - * - * Note that the engineNextBytes() method invoked on the restored random - * object will yield the exact same (random) bytes as the original. + *

+ * Note that the {@code engineNextBytes()} method invoked on the restored + * random object will yield the exact same (random) bytes as the original. * If you do not want this behaviour, you should re-seed the restored - * random object, using engineSetSeed(). + * random object, using {@code engineSetSeed()}. + * + * @param s the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded */ private void readObject(java.io.ObjectInputStream s) - throws IOException, ClassNotFoundException { + throws IOException, ClassNotFoundException { s.defaultReadObject (); @@ -291,5 +298,34 @@ "internal error: SHA-1 not available.", exc); } } + + // Various consistency checks + if ((remainder == null) && (remCount > 0)) { + throw new InvalidObjectException( + "Remainder indicated, but no data available"); + } + + // Not yet allocated state + if (state == null) { + if (remainder == null) { + return; + } else { + throw new InvalidObjectException( + "Inconsistent buffer allocations"); + } + } + + // Sanity check on sizes/pointer + if ((state.length != DIGEST_SIZE) || + ((remainder != null) && (remainder.length != DIGEST_SIZE)) || + (remCount < 0 ) || (remCount >= DIGEST_SIZE)) { + throw new InvalidObjectException( + "Inconsistent buffer sizes/state"); + } + + state = state.clone(); + if (remainder != null) { + remainder = remainder.clone(); + } } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/SunEntries.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/SunEntries.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/SunEntries.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/SunEntries.java 2023-10-06 05:33:33.000000000 +0000 @@ -32,6 +32,8 @@ import jdk.internal.util.StaticProperty; import sun.security.action.GetPropertyAction; +import sun.security.util.SecurityProviderConstants; +import static sun.security.util.SecurityProviderConstants.getAliases; /** * Defines the entries of the SUN provider. @@ -80,18 +82,6 @@ // the default algo used by SecureRandom class for new SecureRandom() calls public static final String DEF_SECURE_RANDOM_ALGO; - // create an aliases List from the specified aliases - public static List createAliases(String ... aliases) { - return Arrays.asList(aliases); - } - - // create an aliases List from the specified oid followed by other aliases - public static List createAliasesWithOid(String ... oids) { - String[] result = Arrays.copyOf(oids, oids.length + 1); - result[result.length - 1] = "OID." + oids[0]; - return Arrays.asList(result); - } - SunEntries(Provider p) { services = new LinkedHashSet<>(50, 0.9f); @@ -106,22 +96,20 @@ attrs.put("ThreadSafe", "true"); if (NativePRNG.isAvailable()) { add(p, "SecureRandom", "NativePRNG", - "sun.security.provider.NativePRNG", - null, attrs); + "sun.security.provider.NativePRNG", attrs); } if (NativePRNG.Blocking.isAvailable()) { add(p, "SecureRandom", "NativePRNGBlocking", - "sun.security.provider.NativePRNG$Blocking", null, attrs); + "sun.security.provider.NativePRNG$Blocking", attrs); } if (NativePRNG.NonBlocking.isAvailable()) { add(p, "SecureRandom", "NativePRNGNonBlocking", - "sun.security.provider.NativePRNG$NonBlocking", null, attrs); + "sun.security.provider.NativePRNG$NonBlocking", attrs); } attrs.put("ImplementedIn", "Software"); - add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", - null, attrs); + add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", attrs); add(p, "SecureRandom", "SHA1PRNG", - "sun.security.provider.SecureRandom", null, attrs); + "sun.security.provider.SecureRandom", attrs); /* * Signature engines @@ -134,37 +122,28 @@ attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA signatures - add(p, "Signature", "SHA1withDSA", - "sun.security.provider.DSA$SHA1withDSA", - createAliasesWithOid("1.2.840.10040.4.3", "DSA", "DSS", - "SHA/DSA", "SHA-1/DSA", "SHA1/DSA", "SHAwithDSA", - "DSAWithSHA1", "1.3.14.3.2.13", "1.3.14.3.2.27"), attrs); - add(p, "Signature", "NONEwithDSA", "sun.security.provider.DSA$RawDSA", - createAliases("RawDSA"), attrs); + addWithAlias(p, "Signature", "SHA1withDSA", + "sun.security.provider.DSA$SHA1withDSA", attrs); + addWithAlias(p, "Signature", "NONEwithDSA", + "sun.security.provider.DSA$RawDSA", attrs); attrs.put("KeySize", "2048"); // for SHA224 and SHA256 DSA signatures - add(p, "Signature", "SHA224withDSA", - "sun.security.provider.DSA$SHA224withDSA", - createAliasesWithOid("2.16.840.1.101.3.4.3.1"), attrs); - add(p, "Signature", "SHA256withDSA", - "sun.security.provider.DSA$SHA256withDSA", - createAliasesWithOid("2.16.840.1.101.3.4.3.2"), attrs); + addWithAlias(p, "Signature", "SHA224withDSA", + "sun.security.provider.DSA$SHA224withDSA", attrs); + addWithAlias(p, "Signature", "SHA256withDSA", + "sun.security.provider.DSA$SHA256withDSA", attrs); attrs.remove("KeySize"); add(p, "Signature", "SHA1withDSAinP1363Format", - "sun.security.provider.DSA$SHA1withDSAinP1363Format", - null, null); + "sun.security.provider.DSA$SHA1withDSAinP1363Format"); add(p, "Signature", "NONEwithDSAinP1363Format", - "sun.security.provider.DSA$RawDSAinP1363Format", - null, null); + "sun.security.provider.DSA$RawDSAinP1363Format"); add(p, "Signature", "SHA224withDSAinP1363Format", - "sun.security.provider.DSA$SHA224withDSAinP1363Format", - null, null); + "sun.security.provider.DSA$SHA224withDSAinP1363Format"); add(p, "Signature", "SHA256withDSAinP1363Format", - "sun.security.provider.DSA$SHA256withDSAinP1363Format", - null, null); + "sun.security.provider.DSA$SHA256withDSAinP1363Format"); /* * Key Pair Generator engines @@ -173,85 +152,75 @@ attrs.put("ImplementedIn", "Software"); attrs.put("KeySize", "2048"); // for DSA KPG and APG only - String dsaOid = "1.2.840.10040.4.1"; - List dsaAliases = createAliasesWithOid(dsaOid, "1.3.14.3.2.12"); String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$"; dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current"); - add(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, dsaAliases, attrs); + addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs); /* * Algorithm Parameter Generator engines */ - add(p, "AlgorithmParameterGenerator", "DSA", - "sun.security.provider.DSAParameterGenerator", dsaAliases, - attrs); + addWithAlias(p, "AlgorithmParameterGenerator", "DSA", + "sun.security.provider.DSAParameterGenerator", attrs); attrs.remove("KeySize"); /* * Algorithm Parameter engines */ - add(p, "AlgorithmParameters", "DSA", - "sun.security.provider.DSAParameters", dsaAliases, attrs); + addWithAlias(p, "AlgorithmParameters", "DSA", + "sun.security.provider.DSAParameters", attrs); /* * Key factories */ - add(p, "KeyFactory", "DSA", "sun.security.provider.DSAKeyFactory", - dsaAliases, attrs); + addWithAlias(p, "KeyFactory", "DSA", + "sun.security.provider.DSAKeyFactory", attrs); /* * Digest engines */ - add(p, "MessageDigest", "MD2", "sun.security.provider.MD2", null, attrs); - add(p, "MessageDigest", "MD5", "sun.security.provider.MD5", null, attrs); - add(p, "MessageDigest", "SHA", "sun.security.provider.SHA", - createAliasesWithOid("1.3.14.3.2.26", "SHA-1", "SHA1"), attrs); - - String sha2BaseOid = "2.16.840.1.101.3.4.2"; - add(p, "MessageDigest", "SHA-224", "sun.security.provider.SHA2$SHA224", - createAliasesWithOid(sha2BaseOid + ".4"), attrs); - add(p, "MessageDigest", "SHA-256", "sun.security.provider.SHA2$SHA256", - createAliasesWithOid(sha2BaseOid + ".1"), attrs); - add(p, "MessageDigest", "SHA-384", "sun.security.provider.SHA5$SHA384", - createAliasesWithOid(sha2BaseOid + ".2"), attrs); - add(p, "MessageDigest", "SHA-512", "sun.security.provider.SHA5$SHA512", - createAliasesWithOid(sha2BaseOid + ".3"), attrs); - add(p, "MessageDigest", "SHA-512/224", - "sun.security.provider.SHA5$SHA512_224", - createAliasesWithOid(sha2BaseOid + ".5"), attrs); - add(p, "MessageDigest", "SHA-512/256", - "sun.security.provider.SHA5$SHA512_256", - createAliasesWithOid(sha2BaseOid + ".6"), attrs); - add(p, "MessageDigest", "SHA3-224", "sun.security.provider.SHA3$SHA224", - createAliasesWithOid(sha2BaseOid + ".7"), attrs); - add(p, "MessageDigest", "SHA3-256", "sun.security.provider.SHA3$SHA256", - createAliasesWithOid(sha2BaseOid + ".8"), attrs); - add(p, "MessageDigest", "SHA3-384", "sun.security.provider.SHA3$SHA384", - createAliasesWithOid(sha2BaseOid + ".9"), attrs); - add(p, "MessageDigest", "SHA3-512", "sun.security.provider.SHA3$SHA512", - createAliasesWithOid(sha2BaseOid + ".10"), attrs); + add(p, "MessageDigest", "MD2", "sun.security.provider.MD2", attrs); + add(p, "MessageDigest", "MD5", "sun.security.provider.MD5", attrs); + addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA", + attrs); + + addWithAlias(p, "MessageDigest", "SHA-224", + "sun.security.provider.SHA2$SHA224", attrs); + addWithAlias(p, "MessageDigest", "SHA-256", + "sun.security.provider.SHA2$SHA256", attrs); + addWithAlias(p, "MessageDigest", "SHA-384", + "sun.security.provider.SHA5$SHA384", attrs); + addWithAlias(p, "MessageDigest", "SHA-512", + "sun.security.provider.SHA5$SHA512", attrs); + addWithAlias(p, "MessageDigest", "SHA-512/224", + "sun.security.provider.SHA5$SHA512_224", attrs); + addWithAlias(p, "MessageDigest", "SHA-512/256", + "sun.security.provider.SHA5$SHA512_256", attrs); + addWithAlias(p, "MessageDigest", "SHA3-224", + "sun.security.provider.SHA3$SHA224", attrs); + addWithAlias(p, "MessageDigest", "SHA3-256", + "sun.security.provider.SHA3$SHA256", attrs); + addWithAlias(p, "MessageDigest", "SHA3-384", + "sun.security.provider.SHA3$SHA384", attrs); + addWithAlias(p, "MessageDigest", "SHA3-512", + "sun.security.provider.SHA3$SHA512", attrs); /* * Certificates */ - add(p, "CertificateFactory", "X.509", - "sun.security.provider.X509Factory", - createAliases("X509"), attrs); + addWithAlias(p, "CertificateFactory", "X.509", + "sun.security.provider.X509Factory", attrs); /* * KeyStore */ add(p, "KeyStore", "PKCS12", - "sun.security.pkcs12.PKCS12KeyStore$DualFormatPKCS12", - null, null); + "sun.security.pkcs12.PKCS12KeyStore$DualFormatPKCS12"); add(p, "KeyStore", "JKS", - "sun.security.provider.JavaKeyStore$DualFormatJKS", - null, attrs); + "sun.security.provider.JavaKeyStore$DualFormatJKS", attrs); add(p, "KeyStore", "CaseExactJKS", - "sun.security.provider.JavaKeyStore$CaseExactJKS", - null, attrs); + "sun.security.provider.JavaKeyStore$CaseExactJKS", attrs); add(p, "KeyStore", "DKS", "sun.security.provider.DomainKeyStore$DKS", - null, attrs); + attrs); /* @@ -259,22 +228,21 @@ */ add(p, "CertStore", "Collection", "sun.security.provider.certpath.CollectionCertStore", - null, attrs); + attrs); add(p, "CertStore", "com.sun.security.IndexedCollection", "sun.security.provider.certpath.IndexedCollectionCertStore", - null, attrs); + attrs); /* * Policy */ - add(p, "Policy", "JavaPolicy", "sun.security.provider.PolicySpiFile", - null, null); + add(p, "Policy", "JavaPolicy", "sun.security.provider.PolicySpiFile"); /* * Configuration */ add(p, "Configuration", "JavaLoginConfig", - "sun.security.provider.ConfigFile$Spi", null, null); + "sun.security.provider.ConfigFile$Spi"); /* * CertPathBuilder and CertPathValidator @@ -285,19 +253,29 @@ add(p, "CertPathBuilder", "PKIX", "sun.security.provider.certpath.SunCertPathBuilder", - null, attrs); + attrs); add(p, "CertPathValidator", "PKIX", "sun.security.provider.certpath.PKIXCertPathValidator", - null, attrs); + attrs); } Iterator iterator() { return services.iterator(); } + private void add(Provider p, String type, String algo, String cn) { + services.add(new Provider.Service(p, type, algo, cn, null, null)); + } + private void add(Provider p, String type, String algo, String cn, - List aliases, HashMap attrs) { - services.add(new Provider.Service(p, type, algo, cn, aliases, attrs)); + HashMap attrs) { + services.add(new Provider.Service(p, type, algo, cn, null, attrs)); + } + + private void addWithAlias(Provider p, String type, String algo, String cn, + HashMap attrs) { + services.add(new Provider.Service(p, type, algo, cn, + getAliases(algo), attrs)); } private LinkedHashSet services; diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/X509Factory.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/X509Factory.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/X509Factory.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/X509Factory.java 2023-10-06 05:33:33.000000000 +0000 @@ -26,12 +26,9 @@ package sun.security.provider; import java.io.*; -import java.security.PublicKey; import java.util.*; import java.security.cert.*; -import jdk.internal.event.EventHelper; -import jdk.internal.event.X509CertificateEvent; import sun.security.util.KeyUtil; import sun.security.util.Pem; import sun.security.x509.*; @@ -104,8 +101,6 @@ } cert = new X509CertImpl(encoding); addToCache(certCache, cert.getEncodedInternal(), cert); - // record cert details if necessary - commitEvent(cert); return cert; } else { throw new IOException("Empty input"); @@ -473,7 +468,7 @@ } } catch (ParsingException e) { while (data != null) { - coll.add(new X509CertImpl(data)); + coll.add(X509CertImpl.newX509CertImpl(data)); data = readOneBlock(pbis); } } @@ -766,43 +761,4 @@ } return tag; } - - private void commitEvent(X509CertImpl info) { - X509CertificateEvent xce = new X509CertificateEvent(); - if (xce.shouldCommit() || EventHelper.isLoggingSecurity()) { - PublicKey pKey = info.getPublicKey(); - String algId = info.getSigAlgName(); - String serNum = info.getSerialNumber().toString(16); - String subject = info.getSubjectDN().getName(); - String issuer = info.getIssuerDN().getName(); - String keyType = pKey.getAlgorithm(); - int length = KeyUtil.getKeySize(pKey); - int hashCode = info.hashCode(); - long beginDate = info.getNotBefore().getTime(); - long endDate = info.getNotAfter().getTime(); - if (xce.shouldCommit()) { - xce.algorithm = algId; - xce.serialNumber = serNum; - xce.subject = subject; - xce.issuer = issuer; - xce.keyType = keyType; - xce.keyLength = length; - xce.certificateId = hashCode; - xce.validFrom = beginDate; - xce.validUntil = endDate; - xce.commit(); - } - if (EventHelper.isLoggingSecurity()) { - EventHelper.logX509CertificateEvent(algId, - serNum, - subject, - issuer, - keyType, - length, - hashCode, - beginDate, - endDate); - } - } - } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/certpath/CertPathHelper.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/CertPathHelper.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/certpath/CertPathHelper.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/CertPathHelper.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2002, 2020, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2002, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -26,14 +26,10 @@ package sun.security.provider.certpath; import java.util.Date; -import java.util.Set; import java.security.cert.TrustAnchor; -import java.security.cert.X509CertSelector; import java.security.cert.X509CRLSelector; -import sun.security.x509.GeneralNameInterface; - /** * Helper class that allows access to JDK specific known-public methods in the * java.security.cert package. It relies on a subclass in the @@ -55,18 +51,10 @@ // empty } - protected abstract void implSetPathToNames(X509CertSelector sel, - Set names); - protected abstract void implSetDateAndTime(X509CRLSelector sel, Date date, long skew); protected abstract boolean implIsJdkCA(TrustAnchor anchor); - static void setPathToNames(X509CertSelector sel, - Set names) { - instance.implSetPathToNames(sel, names); - } - public static void setDateAndTime(X509CRLSelector sel, Date date, long skew) { instance.implSetDateAndTime(sel, date, skew); } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/certpath/ForwardBuilder.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/ForwardBuilder.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/certpath/ForwardBuilder.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/ForwardBuilder.java 2023-10-06 05:33:33.000000000 +0000 @@ -48,7 +48,6 @@ import sun.security.x509.AuthorityInfoAccessExtension; import sun.security.x509.AuthorityKeyIdentifierExtension; import static sun.security.x509.PKIXExtensions.*; -import sun.security.x509.SubjectAlternativeNameExtension; import sun.security.x509.X500Name; import sun.security.x509.X509CertImpl; @@ -259,14 +258,6 @@ caSelector.setSubject(currentState.issuerDN); /* - * Match on subjectNamesTraversed (both DNs and AltNames) - * (checks that current cert's name constraints permit it - * to certify all the DNs and AltNames that have been traversed) - */ - CertPathHelper.setPathToNames - (caSelector, currentState.subjectNamesTraversed); - - /* * check the validity period */ caSelector.setValidityPeriod(currentState.cert.getNotBefore(), @@ -704,19 +695,6 @@ // Don't bother to verify untrusted certificate more. currState.untrustedChecker.check(cert, Collections.emptySet()); - /* - * Abort if we encounter the same certificate or a certificate with - * the same public key, subject DN, and subjectAltNames as a cert - * that is already in path. - */ - for (X509Certificate cpListCert : certPathList) { - if (repeated(cpListCert, cert)) { - throw new CertPathValidatorException( - "cert with repeated subject, public key, and " + - "subjectAltNames detected"); - } - } - /* check if trusted cert */ boolean isTrustedCert = trustedCerts.contains(cert); @@ -794,49 +772,6 @@ } } - /** - * Return true if two certificates are equal or have the same subject, - * public key, and subject alternative names. - */ - private static boolean repeated( - X509Certificate currCert, X509Certificate nextCert) { - if (currCert.equals(nextCert)) { - return true; - } - return (currCert.getSubjectX500Principal().equals( - nextCert.getSubjectX500Principal()) && - currCert.getPublicKey().equals(nextCert.getPublicKey()) && - altNamesEqual(currCert, nextCert)); - } - - /** - * Return true if two certificates have the same subject alternative names. - */ - private static boolean altNamesEqual( - X509Certificate currCert, X509Certificate nextCert) { - X509CertImpl curr, next; - try { - curr = X509CertImpl.toImpl(currCert); - next = X509CertImpl.toImpl(nextCert); - } catch (CertificateException ce) { - return false; - } - - SubjectAlternativeNameExtension currAltNameExt = - curr.getSubjectAlternativeNameExtension(); - SubjectAlternativeNameExtension nextAltNameExt = - next.getSubjectAlternativeNameExtension(); - if (currAltNameExt != null) { - if (nextAltNameExt == null) { - return false; - } - return Arrays.equals(currAltNameExt.getExtensionValue(), - nextAltNameExt.getExtensionValue()); - } else { - return (nextAltNameExt == null); - } - } - /** * Verifies whether the input certificate completes the path. * First checks the cert against each trust anchor that was specified, diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/certpath/ForwardState.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/ForwardState.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/certpath/ForwardState.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/ForwardState.java 2023-10-06 05:33:33.000000000 +0000 @@ -31,17 +31,11 @@ import java.security.cert.PKIXCertPathChecker; import java.security.cert.X509Certificate; import java.util.ArrayList; -import java.util.HashSet; import java.util.List; import java.util.ListIterator; import javax.security.auth.x500.X500Principal; import sun.security.util.Debug; -import sun.security.x509.SubjectAlternativeNameExtension; -import sun.security.x509.GeneralNames; -import sun.security.x509.GeneralName; -import sun.security.x509.GeneralNameInterface; -import sun.security.x509.X500Name; import sun.security.x509.X509CertImpl; /** @@ -61,9 +55,6 @@ /* The last cert in the path */ X509CertImpl cert; - /* The set of subjectDNs and subjectAltNames of all certs in the path */ - HashSet subjectNamesTraversed; - /* * The number of intermediate CA certs which have been traversed so * far in the path @@ -73,7 +64,6 @@ /* Flag indicating if state is initial (path is just starting) */ private boolean init = true; - /* the untrusted certificates checker */ UntrustedChecker untrustedChecker; @@ -104,8 +94,6 @@ sb.append("\n issuerDN of last cert: ").append(issuerDN); sb.append("\n traversedCACerts: ").append(traversedCACerts); sb.append("\n init: ").append(String.valueOf(init)); - sb.append("\n subjectNamesTraversed: \n").append - (subjectNamesTraversed); sb.append("\n selfIssued: ").append (String.valueOf(selfIssued)); sb.append("]\n"); @@ -120,7 +108,6 @@ public void initState(List certPathCheckers) throws CertPathValidatorException { - subjectNamesTraversed = new HashSet(); traversedCACerts = 0; /* @@ -170,32 +157,6 @@ } } - /* update subjectNamesTraversed only if this is the EE cert or if - this cert is not self-issued */ - if (init || !selfIssued) { - X500Principal subjName = cert.getSubjectX500Principal(); - subjectNamesTraversed.add(X500Name.asX500Name(subjName)); - - try { - SubjectAlternativeNameExtension subjAltNameExt - = icert.getSubjectAlternativeNameExtension(); - if (subjAltNameExt != null) { - GeneralNames gNames = subjAltNameExt.get( - SubjectAlternativeNameExtension.SUBJECT_NAME); - for (GeneralName gName : gNames.names()) { - subjectNamesTraversed.add(gName.getName()); - } - } - } catch (IOException e) { - if (debug != null) { - debug.println("ForwardState.updateState() unexpected " - + "exception"); - e.printStackTrace(); - } - throw new CertPathValidatorException(e); - } - } - init = false; } @@ -203,10 +164,6 @@ * Clone current state. The state is cloned as each cert is * added to the path. This is necessary if backtracking occurs, * and a prior state needs to be restored. - * - * Note that this is a SMART clone. Not all fields are fully copied, - * because some of them will - * not have their contents modified by subsequent calls to updateState. */ @Override @SuppressWarnings("unchecked") // Safe casts assuming clone() works correctly @@ -226,13 +183,6 @@ } } - /* - * Shallow copy traversed names. There is no need to - * deep copy contents, since the elements of the Set - * are never modified by subsequent calls to updateState(). - */ - clonedState.subjectNamesTraversed - = (HashSet)subjectNamesTraversed.clone(); return clonedState; } catch (CloneNotSupportedException e) { throw new InternalError(e.toString(), e); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/certpath/OCSPResponse.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/OCSPResponse.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/certpath/OCSPResponse.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/OCSPResponse.java 2023-10-06 05:33:33.000000000 +0000 @@ -135,7 +135,7 @@ private static final Debug debug = Debug.getInstance("certpath"); private static final boolean dump = debug != null && Debug.isOn("ocsp"); private static final ObjectIdentifier OCSP_BASIC_RESPONSE_OID = - ObjectIdentifier.newInternal(new int[] { 1, 3, 6, 1, 5, 5, 7, 48, 1, 1}); + ObjectIdentifier.of(KnownOIDs.OCSPBasicResponse); private static final int CERT_STATUS_GOOD = 0; private static final int CERT_STATUS_REVOKED = 1; private static final int CERT_STATUS_UNKNOWN = 2; @@ -144,9 +144,6 @@ private static final int NAME_TAG = 1; private static final int KEY_TAG = 2; - // Object identifier for the OCSPSigning key purpose - private static final String KP_OCSP_SIGNING_OID = "1.3.6.1.5.5.7.3.9"; - // Default maximum clock skew in milliseconds (15 minutes) // allowed when checking validity of OCSP responses private static final int DEFAULT_MAX_CLOCK_SKEW = 900000; @@ -357,7 +354,7 @@ try { for (int i = 0; i < derCerts.length; i++) { X509CertImpl cert = - new X509CertImpl(derCerts[i].toByteArray()); + X509CertImpl.newX509CertImpl(derCerts[i].toByteArray()); certs.add(cert); if (debug != null) { @@ -495,7 +492,7 @@ try { List keyPurposes = signerCert.getExtendedKeyUsage(); if (keyPurposes == null || - !keyPurposes.contains(KP_OCSP_SIGNING_OID)) { + !keyPurposes.contains(KnownOIDs.OCSPSigning.value())) { throw new CertPathValidatorException( "Responder's certificate not valid for signing " + "OCSP responses"); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/certpath/PKIXCertPathValidator.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/PKIXCertPathValidator.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/certpath/PKIXCertPathValidator.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/PKIXCertPathValidator.java 2023-10-06 05:33:33.000000000 +0000 @@ -228,13 +228,13 @@ X509ValidationEvent xve = new X509ValidationEvent(); if (xve.shouldCommit() || EventHelper.isLoggingSecurity()) { int[] certIds = params.certificates().stream() - .mapToInt(x -> x.hashCode()) + .mapToInt(Certificate::hashCode) .toArray(); - int anchorCertId = - anchor.getTrustedCert().hashCode(); + int anchorCertId = (anchorCert != null) ? + anchorCert.hashCode() : anchor.getCAPublicKey().hashCode(); if (xve.shouldCommit()) { xve.certificateId = anchorCertId; - int certificatePos = 1; //anchor cert + int certificatePos = 1; // most trusted CA xve.certificatePosition = certificatePos; xve.validationCounter = validationCounter.incrementAndGet(); xve.commit(); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/certpath/RevocationChecker.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/RevocationChecker.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/certpath/RevocationChecker.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/RevocationChecker.java 2023-10-06 05:33:33.000000000 +0000 @@ -46,6 +46,7 @@ import sun.security.x509.*; import static sun.security.x509.PKIXExtensions.*; import sun.security.util.Debug; +import sun.security.util.KnownOIDs; class RevocationChecker extends PKIXRevocationChecker { @@ -723,7 +724,7 @@ // verify the response byte[] nonce = null; for (Extension ext : ocspExtensions) { - if (ext.getId().equals("1.3.6.1.5.5.7.48.1.2")) { + if (ext.getId().equals(KnownOIDs.OCSPNonceExt.value())) { nonce = ext.getValue(); } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/certpath/SunCertPathBuilder.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/SunCertPathBuilder.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/certpath/SunCertPathBuilder.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/SunCertPathBuilder.java 2023-10-06 05:33:33.000000000 +0000 @@ -33,6 +33,7 @@ import java.security.cert.CertPathValidatorException.BasicReason; import java.security.cert.PKIXReason; import java.util.ArrayList; +import java.util.Arrays; import java.util.Collection; import java.util.Collections; import java.util.List; @@ -42,6 +43,7 @@ import sun.security.provider.certpath.PKIX.BuilderParams; import static sun.security.x509.PKIXExtensions.*; +import sun.security.x509.SubjectAlternativeNameExtension; import sun.security.x509.X509CertImpl; import sun.security.util.Debug; @@ -265,7 +267,7 @@ */ Collection certs = builder.getMatchingCerts(currentState, buildParams.certStores()); - List vertices = addVertices(certs, adjList); + List vertices = addVertices(certs, adjList, cpList); if (debug != null) { debug.println("SunCertPathBuilder.depthFirstSearchForward(): " + "certs.size=" + vertices.size()); @@ -325,17 +327,32 @@ * cert (which is signed by the trusted public key), but * don't add it yet to the cpList */ + PublicKey rootKey = cert.getPublicKey(); if (builder.trustAnchor.getTrustedCert() == null) { appendedCerts.add(0, cert); + rootKey = builder.trustAnchor.getCAPublicKey(); + if (debug != null) + debug.println( + "SunCertPathBuilder.depthFirstSearchForward " + + "using buildParams public key: " + + rootKey.toString()); } + TrustAnchor anchor = new TrustAnchor + (cert.getSubjectX500Principal(), rootKey, null); + // add the basic checker + List checkers = new ArrayList<>(); + BasicChecker basicChecker = new BasicChecker(anchor, + buildParams.date(), + buildParams.sigProvider(), + true); + checkers.add(basicChecker); Set initExpPolSet = Collections.singleton(PolicyChecker.ANY_POLICY); PolicyNodeImpl rootNode = new PolicyNodeImpl(null, PolicyChecker.ANY_POLICY, null, false, initExpPolSet, false); - List checkers = new ArrayList<>(); PolicyChecker policyChecker = new PolicyChecker(buildParams.initialPolicies(), appendedCerts.size(), @@ -346,28 +363,13 @@ rootNode); checkers.add(policyChecker); + // add the constraints checker + checkers.add(new ConstraintsChecker(appendedCerts.size())); + // add the algorithm checker checkers.add(new AlgorithmChecker(builder.trustAnchor, buildParams.timestamp(), buildParams.variant())); - PublicKey rootKey = cert.getPublicKey(); - if (builder.trustAnchor.getTrustedCert() == null) { - rootKey = builder.trustAnchor.getCAPublicKey(); - if (debug != null) - debug.println( - "SunCertPathBuilder.depthFirstSearchForward " + - "using buildParams public key: " + - rootKey.toString()); - } - TrustAnchor anchor = new TrustAnchor - (cert.getSubjectX500Principal(), rootKey, null); - - // add the basic checker - BasicChecker basicChecker = new BasicChecker(anchor, - buildParams.date(), - buildParams.sigProvider(), - true); - checkers.add(basicChecker); buildParams.setCertPath(cf.generateCertPath(appendedCerts)); @@ -563,19 +565,80 @@ * adjacency list. */ private static List addVertices(Collection certs, - List> adjList) + List> adjList, + List cpList) { List l = adjList.get(adjList.size() - 1); for (X509Certificate cert : certs) { - Vertex v = new Vertex(cert); - l.add(v); + boolean repeated = false; + for (X509Certificate cpListCert : cpList) { + /* + * Ignore if we encounter the same certificate or a + * certificate with the same public key, subject DN, and + * subjectAltNames as a cert that is already in path. + */ + if (repeated(cpListCert, cert)) { + if (debug != null) { + debug.println("cert with repeated subject, " + + "public key, and subjectAltNames detected"); + } + repeated = true; + break; + } + } + if (!repeated) { + l.add(new Vertex(cert)); + } } return l; } /** + * Return true if two certificates are equal or have the same subject, + * public key, and subject alternative names. + */ + private static boolean repeated( + X509Certificate currCert, X509Certificate nextCert) { + if (currCert.equals(nextCert)) { + return true; + } + return (currCert.getSubjectX500Principal().equals( + nextCert.getSubjectX500Principal()) && + currCert.getPublicKey().equals(nextCert.getPublicKey()) && + altNamesEqual(currCert, nextCert)); + } + + /** + * Return true if two certificates have the same subject alternative names. + */ + private static boolean altNamesEqual( + X509Certificate currCert, X509Certificate nextCert) { + X509CertImpl curr, next; + try { + curr = X509CertImpl.toImpl(currCert); + next = X509CertImpl.toImpl(nextCert); + } catch (CertificateException ce) { + return false; + } + + SubjectAlternativeNameExtension currAltNameExt = + curr.getSubjectAlternativeNameExtension(); + SubjectAlternativeNameExtension nextAltNameExt = + next.getSubjectAlternativeNameExtension(); + if (currAltNameExt != null) { + if (nextAltNameExt == null) { + return false; + } + return Arrays.equals(currAltNameExt.getExtensionValue(), + nextAltNameExt.getExtensionValue()); + } else { + return (nextAltNameExt == null); + } + } + + /** * Returns true if trust anchor certificate matches specified * certificate constraints. */ diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/certpath/X509CertPath.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/X509CertPath.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/certpath/X509CertPath.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/X509CertPath.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2000, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -25,10 +25,7 @@ package sun.security.provider.certpath; -import java.io.ByteArrayInputStream; -import java.io.ByteArrayOutputStream; -import java.io.IOException; -import java.io.InputStream; +import java.io.*; import java.security.cert.CertificateEncodingException; import java.security.cert.Certificate; import java.security.cert.CertificateException; @@ -394,4 +391,19 @@ public List getCertificates() { return certs; } + + /** + * Restores the state of this object from the stream. + *

+ * Deserialization of this object is not supported. + * + * @param stream the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded + */ + private void readObject(ObjectInputStream stream) + throws IOException, ClassNotFoundException { + throw new InvalidObjectException( + "X509CertPaths are not directly deserializable"); + } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/certpath/X509CertificatePair.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/X509CertificatePair.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/provider/certpath/X509CertificatePair.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/provider/certpath/X509CertificatePair.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -240,7 +240,7 @@ } opt = opt.data.getDerValue(); forward = X509Factory.intern - (new X509CertImpl(opt.toByteArray())); + (X509CertImpl.newX509CertImpl(opt.toByteArray())); } break; case TAG_REVERSE: @@ -251,7 +251,7 @@ } opt = opt.data.getDerValue(); reverse = X509Factory.intern - (new X509CertImpl(opt.toByteArray())); + (X509CertImpl.newX509CertImpl(opt.toByteArray())); } break; default: diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/rsa/PSSParameters.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/PSSParameters.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/rsa/PSSParameters.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/PSSParameters.java 2023-10-06 05:33:33.000000000 +0000 @@ -99,7 +99,7 @@ } else if (d.isContextSpecific((byte) 0x01)) { // mgf algid AlgorithmId val = AlgorithmId.parse(d.data.getDerValue()); - if (!val.getOID().equals(AlgorithmId.mgf1_oid)) { + if (!val.getOID().equals(AlgorithmId.MGF1_oid)) { throw new IOException("Only MGF1 mgf is supported"); } @@ -247,7 +247,7 @@ if (!mgfDigestId.getOID().equals(AlgorithmId.SHA_oid)) { tmp2 = new DerOutputStream(); - tmp2.putOID(AlgorithmId.mgf1_oid); + tmp2.putOID(AlgorithmId.MGF1_oid); mgfDigestId.encode(tmp2); tmp3 = new DerOutputStream(); tmp3.write(DerValue.tag_Sequence, tmp2); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/rsa/RSAKeyFactory.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/RSAKeyFactory.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/rsa/RSAKeyFactory.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/RSAKeyFactory.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2003, 2018, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2003, 2021, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -32,8 +32,7 @@ import java.security.spec.*; import sun.security.action.GetPropertyAction; -import sun.security.x509.AlgorithmId; -import static sun.security.rsa.RSAUtil.KeyType; +import sun.security.rsa.RSAUtil.KeyType; /** * KeyFactory for RSA keys, e.g. "RSA", "RSASSA-PSS". @@ -44,13 +43,15 @@ * between the following: * * For public keys: - * . PublicKey with an X.509 encoding + * . RSA PublicKey with an X.509 encoding + * . RSA PublicKey with an PKCS#1 encoding * . RSAPublicKey * . RSAPublicKeySpec * . X509EncodedKeySpec * * For private keys: - * . PrivateKey with a PKCS#8 encoding + * . RSA PrivateKey with a PKCS#8 encoding + * . RSA PrivateKey with a PKCS#1 encoding * . RSAPrivateKey * . RSAPrivateCrtKey * . RSAPrivateKeySpec @@ -96,8 +97,8 @@ return new RSAKeyFactory(type); } - // Internal utility method for checking key algorithm - private static void checkKeyAlgo(Key key, String expectedAlg) + // pkg-private utility method for checking key algorithm + static void checkKeyAlgo(Key key, String expectedAlg) throws InvalidKeyException { String keyAlg = key.getAlgorithm(); if (keyAlg == null || !(keyAlg.equalsIgnoreCase(expectedAlg))) { @@ -211,7 +212,7 @@ throw new InvalidKeyException("Key must not be null"); } // ensure the key algorithm matches the current KeyFactory instance - checkKeyAlgo(key, type.keyAlgo()); + checkKeyAlgo(key, type.keyAlgo); // no translation needed if the key is already our own impl if ((key instanceof RSAPrivateKeyImpl) || @@ -259,21 +260,17 @@ RSAPublicKey rsaKey = (RSAPublicKey)key; try { return new RSAPublicKeyImpl( - RSAUtil.createAlgorithmId(type, rsaKey.getParams()), + type, rsaKey.getParams(), rsaKey.getModulus(), rsaKey.getPublicExponent()); } catch (ProviderException e) { // catch providers that incorrectly implement RSAPublicKey throw new InvalidKeyException("Invalid key", e); } - } else if ("X.509".equals(key.getFormat())) { - RSAPublicKey translated = new RSAPublicKeyImpl(key.getEncoded()); - // ensure the key algorithm matches the current KeyFactory instance - checkKeyAlgo(translated, type.keyAlgo()); - return translated; } else { - throw new InvalidKeyException("Public keys must be instance " - + "of RSAPublicKey or have X.509 encoding"); + // create new key based on the format and encoding of current 'key' + return RSAPublicKeyImpl.newKey(type, key.getFormat(), + key.getEncoded()); } } @@ -284,7 +281,7 @@ RSAPrivateCrtKey rsaKey = (RSAPrivateCrtKey)key; try { return new RSAPrivateCrtKeyImpl( - RSAUtil.createAlgorithmId(type, rsaKey.getParams()), + type, rsaKey.getParams(), rsaKey.getModulus(), rsaKey.getPublicExponent(), rsaKey.getPrivateExponent(), @@ -302,7 +299,7 @@ RSAPrivateKey rsaKey = (RSAPrivateKey)key; try { return new RSAPrivateKeyImpl( - RSAUtil.createAlgorithmId(type, rsaKey.getParams()), + type, rsaKey.getParams(), rsaKey.getModulus(), rsaKey.getPrivateExponent() ); @@ -310,15 +307,9 @@ // catch providers that incorrectly implement RSAPrivateKey throw new InvalidKeyException("Invalid key", e); } - } else if ("PKCS#8".equals(key.getFormat())) { - RSAPrivateKey translated = - RSAPrivateCrtKeyImpl.newKey(key.getEncoded()); - // ensure the key algorithm matches the current KeyFactory instance - checkKeyAlgo(translated, type.keyAlgo()); - return translated; } else { - throw new InvalidKeyException("Private keys must be instance " - + "of RSAPrivate(Crt)Key or have PKCS#8 encoding"); + return RSAPrivateCrtKeyImpl.newKey(type, key.getFormat(), + key.getEncoded()); } } @@ -326,16 +317,13 @@ private PublicKey generatePublic(KeySpec keySpec) throws GeneralSecurityException { if (keySpec instanceof X509EncodedKeySpec) { - X509EncodedKeySpec x509Spec = (X509EncodedKeySpec)keySpec; - RSAPublicKey generated = new RSAPublicKeyImpl(x509Spec.getEncoded()); - // ensure the key algorithm matches the current KeyFactory instance - checkKeyAlgo(generated, type.keyAlgo()); - return generated; + return RSAPublicKeyImpl.newKey(type, "X.509", + ((X509EncodedKeySpec)keySpec).getEncoded()); } else if (keySpec instanceof RSAPublicKeySpec) { RSAPublicKeySpec rsaSpec = (RSAPublicKeySpec)keySpec; try { return new RSAPublicKeyImpl( - RSAUtil.createAlgorithmId(type, rsaSpec.getParams()), + type, rsaSpec.getParams(), rsaSpec.getModulus(), rsaSpec.getPublicExponent() ); @@ -352,16 +340,13 @@ private PrivateKey generatePrivate(KeySpec keySpec) throws GeneralSecurityException { if (keySpec instanceof PKCS8EncodedKeySpec) { - PKCS8EncodedKeySpec pkcsSpec = (PKCS8EncodedKeySpec)keySpec; - RSAPrivateKey generated = RSAPrivateCrtKeyImpl.newKey(pkcsSpec.getEncoded()); - // ensure the key algorithm matches the current KeyFactory instance - checkKeyAlgo(generated, type.keyAlgo()); - return generated; + return RSAPrivateCrtKeyImpl.newKey(type, "PKCS#8", + ((PKCS8EncodedKeySpec)keySpec).getEncoded()); } else if (keySpec instanceof RSAPrivateCrtKeySpec) { RSAPrivateCrtKeySpec rsaSpec = (RSAPrivateCrtKeySpec)keySpec; try { return new RSAPrivateCrtKeyImpl( - RSAUtil.createAlgorithmId(type, rsaSpec.getParams()), + type, rsaSpec.getParams(), rsaSpec.getModulus(), rsaSpec.getPublicExponent(), rsaSpec.getPrivateExponent(), @@ -378,7 +363,7 @@ RSAPrivateKeySpec rsaSpec = (RSAPrivateKeySpec)keySpec; try { return new RSAPrivateKeyImpl( - RSAUtil.createAlgorithmId(type, rsaSpec.getParams()), + type, rsaSpec.getParams(), rsaSpec.getModulus(), rsaSpec.getPrivateExponent() ); @@ -396,7 +381,8 @@ try { // convert key to one of our keys // this also verifies that the key is a valid RSA key and ensures - // that the encoding is X.509/PKCS#8 for public/private keys + // that the encoding is X.509/PKCS#8 or PKCS#1 for public/private + // keys key = engineTranslateKey(key); } catch (InvalidKeyException e) { throw new InvalidKeySpecException(e); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/rsa/RSAKeyPairGenerator.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/RSAKeyPairGenerator.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/rsa/RSAKeyPairGenerator.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/RSAKeyPairGenerator.java 2023-10-06 05:33:33.000000000 +0000 @@ -32,10 +32,10 @@ import java.security.spec.RSAKeyGenParameterSpec; import sun.security.jca.JCAUtil; +import sun.security.rsa.RSAUtil.KeyType; + import static sun.security.util.SecurityProviderConstants.DEF_RSA_KEY_SIZE; import static sun.security.util.SecurityProviderConstants.DEF_RSASSA_PSS_KEY_SIZE; -import sun.security.x509.AlgorithmId; -import static sun.security.rsa.RSAUtil.KeyType; /** * RSA keypair generation. Standard algorithm, minimum key length 512 bit. @@ -55,7 +55,7 @@ private int keySize; private final KeyType type; - private AlgorithmId rsaId; + private AlgorithmParameterSpec keyParams; // PRNG to use private SecureRandom random; @@ -116,7 +116,7 @@ } try { - this.rsaId = RSAUtil.createAlgorithmId(type, tmpParams); + this.keyParams = RSAUtil.checkParamsAgainstType(type, tmpParams); } catch (ProviderException e) { throw new InvalidAlgorithmParameterException( "Invalid key parameters", e); @@ -177,9 +177,10 @@ BigInteger coeff = q.modInverse(p); try { - PublicKey publicKey = new RSAPublicKeyImpl(rsaId, n, e); - PrivateKey privateKey = new RSAPrivateCrtKeyImpl( - rsaId, n, e, d, p, q, pe, qe, coeff); + PublicKey publicKey = new RSAPublicKeyImpl(type, keyParams, + n, e); + PrivateKey privateKey = new RSAPrivateCrtKeyImpl(type, + keyParams, n, e, d, p, q, pe, qe, coeff); return new KeyPair(publicKey, privateKey); } catch (InvalidKeyException exc) { // invalid key exception only thrown for keys < 512 bit, diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/rsa/RSAPrivateCrtKeyImpl.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/RSAPrivateCrtKeyImpl.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/rsa/RSAPrivateCrtKeyImpl.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/RSAPrivateCrtKeyImpl.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2003, 2018, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2003, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -26,6 +26,8 @@ package sun.security.rsa; import java.io.IOException; +import java.io.InvalidObjectException; +import java.io.ObjectInputStream; import java.math.BigInteger; import java.security.*; @@ -34,16 +36,15 @@ import sun.security.util.*; -import sun.security.x509.AlgorithmId; import sun.security.pkcs.PKCS8Key; -import static sun.security.rsa.RSAUtil.KeyType; +import sun.security.rsa.RSAUtil.KeyType; /** * RSA private key implementation for "RSA", "RSASSA-PSS" algorithms in CRT form. * For non-CRT private keys, see RSAPrivateKeyImpl. We need separate classes * to ensure correct behavior in instanceof checks, etc. - * + *

* Note: RSA keys must be at least 512 bits long * * @see RSAPrivateKeyImpl @@ -66,27 +67,52 @@ private BigInteger qe; // prime exponent q private BigInteger coeff; // CRT coeffcient + private transient KeyType type; + // Optional parameters associated with this RSA key // specified in the encoding of its AlgorithmId. // Must be null for "RSA" keys. - private AlgorithmParameterSpec keyParams; + private transient AlgorithmParameterSpec keyParams; /** - * Generate a new key from its encoding. Returns a CRT key if possible - * and a non-CRT key otherwise. Used by RSAKeyFactory. + * Generate a new RSAPrivate(Crt)Key from the specified type, + * format and encoding. Returns a CRT key if possible and a non-CRT + * key otherwise. + * Also used by SunPKCS11 provider. */ - public static RSAPrivateKey newKey(byte[] encoded) - throws InvalidKeyException { - RSAPrivateCrtKeyImpl key = new RSAPrivateCrtKeyImpl(encoded); - // check all CRT-specific components are available, if any one - // missing, return a non-CRT key instead - if (checkComponents(key)) { - return key; - } else { - return new RSAPrivateKeyImpl( - key.algid, - key.getModulus(), - key.getPrivateExponent()); + public static RSAPrivateKey newKey(KeyType type, String format, + byte[] encoded) throws InvalidKeyException { + switch (format) { + case "PKCS#8": + RSAPrivateCrtKeyImpl key = new RSAPrivateCrtKeyImpl(encoded); + RSAKeyFactory.checkKeyAlgo(key, type.keyAlgo); + // check all CRT-specific components are available, if any one + // missing, return a non-CRT key instead + if (checkComponents(key)) { + return key; + } else { + return new RSAPrivateKeyImpl(key.type, key.keyParams, + key.getModulus(), key.getPrivateExponent()); + } + case "PKCS#1": + try { + BigInteger[] comps = parseASN1(encoded); + if ((comps[1].signum() == 0) || (comps[3].signum() == 0) || + (comps[4].signum() == 0) || (comps[5].signum() == 0) || + (comps[6].signum() == 0) || (comps[7].signum() == 0)) { + return new RSAPrivateKeyImpl(type, null, comps[0], + comps[2]); + } else { + return new RSAPrivateCrtKeyImpl(type, null, comps[0], + comps[1], comps[2], comps[3], comps[4], comps[5], + comps[6], comps[7]); + } + } catch (IOException ioe) { + throw new InvalidKeyException("Invalid PKCS#1 encoding", ioe); + } + default: + throw new InvalidKeyException("Unsupported RSA Private(Crt)Key " + + "format: " + format); } } @@ -113,14 +139,13 @@ BigInteger p, BigInteger q, BigInteger pe, BigInteger qe, BigInteger coeff) throws InvalidKeyException { RSAPrivateKey key; - AlgorithmId rsaId = RSAUtil.createAlgorithmId(type, params); if ((e.signum() == 0) || (p.signum() == 0) || (q.signum() == 0) || (pe.signum() == 0) || (qe.signum() == 0) || (coeff.signum() == 0)) { // if any component is missing, return a non-CRT key - return new RSAPrivateKeyImpl(rsaId, n, d); + return new RSAPrivateKeyImpl(type, params, n, d); } else { - return new RSAPrivateCrtKeyImpl(rsaId, n, e, d, + return new RSAPrivateCrtKeyImpl(type, params, n, e, d, p, q, pe, qe, coeff); } } @@ -128,7 +153,7 @@ /** * Construct a key from its encoding. Called from newKey above. */ - RSAPrivateCrtKeyImpl(byte[] encoded) throws InvalidKeyException { + private RSAPrivateCrtKeyImpl(byte[] encoded) throws InvalidKeyException { if (encoded == null || encoded.length == 0) { throw new InvalidKeyException("Missing key encoding"); } @@ -136,8 +161,10 @@ decode(encoded); RSAKeyFactory.checkRSAProviderKeyLengths(n.bitLength(), e); try { - // this will check the validity of params - this.keyParams = RSAUtil.getParamSpec(algid); + // check the validity of oid and params + Object[] o = RSAUtil.getTypeAndParamSpec(algid); + this.type = (KeyType) o[0]; + this.keyParams = (AlgorithmParameterSpec) o[1]; } catch (ProviderException e) { throw new InvalidKeyException(e); } @@ -147,7 +174,7 @@ * Construct a RSA key from its components. Used by the * RSAKeyFactory and the RSAKeyPairGenerator. */ - RSAPrivateCrtKeyImpl(AlgorithmId rsaId, + RSAPrivateCrtKeyImpl(KeyType type, AlgorithmParameterSpec keyParams, BigInteger n, BigInteger e, BigInteger d, BigInteger p, BigInteger q, BigInteger pe, BigInteger qe, BigInteger coeff) throws InvalidKeyException { @@ -161,11 +188,19 @@ this.pe = pe; this.qe = qe; this.coeff = coeff; - this.keyParams = RSAUtil.getParamSpec(rsaId); - // generate the encoding - algid = rsaId; try { + // validate and generate the algid encoding + algid = RSAUtil.createAlgorithmId(type, keyParams); + } catch (ProviderException exc) { + throw new InvalidKeyException(exc); + } + + this.type = type; + this.keyParams = keyParams; + + try { + // generate the key encoding DerOutputStream out = new DerOutputStream(); out.putInteger(0); // version must be 0 out.putInteger(n); @@ -188,7 +223,7 @@ // see JCA doc @Override public String getAlgorithm() { - return algid.getName(); + return type.keyAlgo; } // see JCA doc @@ -248,9 +283,39 @@ // return a string representation of this key for debugging @Override public String toString() { - return "SunRsaSign " + getAlgorithm() + " private CRT key, " + n.bitLength() - + " bits" + "\n params: " + keyParams + "\n modulus: " + n - + "\n private exponent: " + d; + return "SunRsaSign " + type.keyAlgo + " private CRT key, " + + n.bitLength() + " bits" + "\n params: " + keyParams + + "\n modulus: " + n + "\n private exponent: " + d; + } + + // utility method for parsing DER encoding of RSA private keys in PKCS#1 + // format as defined in RFC 8017 Appendix A.1.2, i.e. SEQ of version, n, + // e, d, p, q, pe, qe, and coeff, and return the parsed components. + private static BigInteger[] parseASN1(byte[] raw) throws IOException { + DerValue derValue = new DerValue(raw); + if (derValue.tag != DerValue.tag_Sequence) { + throw new IOException("Not a SEQUENCE"); + } + int version = derValue.data.getInteger(); + if (version != 0) { + throw new IOException("Version must be 0"); + } + + BigInteger[] result = new BigInteger[8]; // n, e, d, p, q, pe, qe, coeff + /* + * Some implementations do not correctly encode ASN.1 INTEGER values + * in 2's complement format, resulting in a negative integer when + * decoded. Correct the error by converting it to a positive integer. + * + * See CR 6255949 + */ + for (int i = 0; i < result.length; i++) { + result[i] = derValue.data.getPositiveBigInteger(); + } + if (derValue.data.available() != 0) { + throw new IOException("Extra data available"); + } + return result; } /** @@ -258,37 +323,32 @@ */ protected void parseKeyBits() throws InvalidKeyException { try { - DerInputStream in = new DerInputStream(key); - DerValue derValue = in.getDerValue(); - if (derValue.tag != DerValue.tag_Sequence) { - throw new IOException("Not a SEQUENCE"); - } - DerInputStream data = derValue.data; - int version = data.getInteger(); - if (version != 0) { - throw new IOException("Version must be 0"); - } - - /* - * Some implementations do not correctly encode ASN.1 INTEGER values - * in 2's complement format, resulting in a negative integer when - * decoded. Correct the error by converting it to a positive integer. - * - * See CR 6255949 - */ - n = data.getPositiveBigInteger(); - e = data.getPositiveBigInteger(); - d = data.getPositiveBigInteger(); - p = data.getPositiveBigInteger(); - q = data.getPositiveBigInteger(); - pe = data.getPositiveBigInteger(); - qe = data.getPositiveBigInteger(); - coeff = data.getPositiveBigInteger(); - if (derValue.data.available() != 0) { - throw new IOException("Extra data available"); - } + BigInteger[] comps = parseASN1(key); + n = comps[0]; + e = comps[1]; + d = comps[2]; + p = comps[3]; + q = comps[4]; + pe = comps[5]; + qe = comps[6]; + coeff = comps[7]; } catch (IOException e) { throw new InvalidKeyException("Invalid RSA private key", e); } } + + /** + * Restores the state of this object from the stream. + *

+ * Deserialization of this object is not supported. + * + * @param stream the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded + */ + private void readObject(ObjectInputStream stream) + throws IOException, ClassNotFoundException { + throw new InvalidObjectException( + "RSAPrivateCrtKeyImpl keys are not directly deserializable"); + } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/rsa/RSAPrivateKeyImpl.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/RSAPrivateKeyImpl.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/rsa/RSAPrivateKeyImpl.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/RSAPrivateKeyImpl.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2003, 2018, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2003, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -26,6 +26,8 @@ package sun.security.rsa; import java.io.IOException; +import java.io.InvalidObjectException; +import java.io.ObjectInputStream; import java.math.BigInteger; import java.security.*; @@ -33,15 +35,17 @@ import java.security.interfaces.*; import sun.security.util.*; -import sun.security.x509.AlgorithmId; import sun.security.pkcs.PKCS8Key; +import sun.security.rsa.RSAUtil.KeyType; + /** * RSA private key implementation for "RSA", "RSASSA-PSS" algorithms in non-CRT - * form (modulus, private exponent only). For CRT private keys, see - * RSAPrivateCrtKeyImpl. We need separate classes to ensure correct behavior - * in instanceof checks, etc. - * + * form (modulus, private exponent only). + *

+ * For CRT private keys, see RSAPrivateCrtKeyImpl. We need separate classes + * to ensure correct behavior in instanceof checks, etc. + *

* Note: RSA keys must be at least 512 bits long * * @see RSAPrivateCrtKeyImpl @@ -57,26 +61,37 @@ private final BigInteger n; // modulus private final BigInteger d; // private exponent + private transient final KeyType type; + // optional parameters associated with this RSA key // specified in the encoding of its AlgorithmId. // must be null for "RSA" keys. - private final AlgorithmParameterSpec keyParams; + private transient final AlgorithmParameterSpec keyParams; /** * Construct a key from its components. Used by the * RSAKeyFactory and the RSAKeyPairGenerator. */ - RSAPrivateKeyImpl(AlgorithmId rsaId, BigInteger n, BigInteger d) - throws InvalidKeyException { + RSAPrivateKeyImpl(KeyType type, AlgorithmParameterSpec keyParams, + BigInteger n, BigInteger d) throws InvalidKeyException { + RSAKeyFactory.checkRSAProviderKeyLengths(n.bitLength(), null); this.n = n; this.d = d; - this.keyParams = RSAUtil.getParamSpec(rsaId); - // generate the encoding - algid = rsaId; try { + // validate and generate the algid encoding + algid = RSAUtil.createAlgorithmId(type, keyParams); + } catch (ProviderException pe) { + throw new InvalidKeyException(pe); + } + + this.type = type; + this.keyParams = keyParams; + + try { + // generate the key encoding DerOutputStream out = new DerOutputStream(); out.putInteger(0); // version must be 0 out.putInteger(n); @@ -99,7 +114,7 @@ // see JCA doc @Override public String getAlgorithm() { - return algid.getName(); + return type.keyAlgo; } // see JCA doc @@ -123,8 +138,23 @@ // return a string representation of this key for debugging @Override public String toString() { - return "Sun " + getAlgorithm() + " private key, " + n.bitLength() + return "Sun " + type.keyAlgo + " private key, " + n.bitLength() + " bits" + "\n params: " + keyParams + "\n modulus: " + n + "\n private exponent: " + d; } + + /** + * Restores the state of this object from the stream. + *

+ * Deserialization of this object is not supported. + * + * @param stream the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded + */ + private void readObject(ObjectInputStream stream) + throws IOException, ClassNotFoundException { + throw new InvalidObjectException( + "RSAPrivateKeyImpl keys are not directly deserializable"); + } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/rsa/RSAPublicKeyImpl.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/RSAPublicKeyImpl.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/rsa/RSAPublicKeyImpl.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/RSAPublicKeyImpl.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2003, 2018, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2003, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -26,6 +26,8 @@ package sun.security.rsa; import java.io.IOException; +import java.io.InvalidObjectException; +import java.io.ObjectInputStream; import java.math.BigInteger; import java.security.*; @@ -34,13 +36,12 @@ import sun.security.util.*; import sun.security.x509.X509Key; -import sun.security.x509.AlgorithmId; -import static sun.security.rsa.RSAUtil.KeyType; +import sun.security.rsa.RSAUtil.KeyType; /** * RSA public key implementation for "RSA", "RSASSA-PSS" algorithms. - * + *

* Note: RSA keys must be at least 512 bits long * * @see RSAPrivateCrtKeyImpl @@ -58,47 +59,76 @@ private BigInteger n; // modulus private BigInteger e; // public exponent + private transient KeyType type; + // optional parameters associated with this RSA key // specified in the encoding of its AlgorithmId // must be null for "RSA" keys. - private AlgorithmParameterSpec keyParams; + private transient AlgorithmParameterSpec keyParams; /** - * Generate a new RSAPublicKey from the specified encoding. - * Used by SunPKCS11 provider. + * Generate a new RSAPublicKey from the specified type, format, and + * encoding. + * Also used by SunPKCS11 provider. */ - public static RSAPublicKey newKey(byte[] encoded) - throws InvalidKeyException { - return new RSAPublicKeyImpl(encoded); + public static RSAPublicKey newKey(KeyType type, String format, + byte[] encoded) throws InvalidKeyException { + RSAPublicKey key; + switch (format) { + case "X.509": + key = new RSAPublicKeyImpl(encoded); + RSAKeyFactory.checkKeyAlgo(key, type.keyAlgo); + break; + case "PKCS#1": + try { + BigInteger[] comps = parseASN1(encoded); + key = new RSAPublicKeyImpl(type, null, comps[0], comps[1]); + } catch (IOException ioe) { + throw new InvalidKeyException("Invalid PKCS#1 encoding", ioe); + } + break; + default: + throw new InvalidKeyException("Unsupported RSA PublicKey format: " + + format); + } + return key; } /** * Generate a new RSAPublicKey from the specified type and components. - * Used by SunPKCS11 provider. + * Also used by SunPKCS11 provider. */ public static RSAPublicKey newKey(KeyType type, AlgorithmParameterSpec params, BigInteger n, BigInteger e) throws InvalidKeyException { - AlgorithmId rsaId = RSAUtil.createAlgorithmId(type, params); - return new RSAPublicKeyImpl(rsaId, n, e); + return new RSAPublicKeyImpl(type, params, n, e); } /** - * Construct a RSA key from AlgorithmId and its components. Used by + * Construct a RSA key from the specified type and components. Used by * RSAKeyFactory and RSAKeyPairGenerator. */ - RSAPublicKeyImpl(AlgorithmId rsaId, BigInteger n, BigInteger e) - throws InvalidKeyException { + RSAPublicKeyImpl(KeyType type, AlgorithmParameterSpec keyParams, + BigInteger n, BigInteger e) throws InvalidKeyException { + RSAKeyFactory.checkRSAProviderKeyLengths(n.bitLength(), e); checkExponentRange(n, e); this.n = n; this.e = e; - this.keyParams = RSAUtil.getParamSpec(rsaId); - // generate the encoding - algid = rsaId; try { + // validate and generate algid encoding + algid = RSAUtil.createAlgorithmId(type, keyParams); + } catch (ProviderException pe) { + throw new InvalidKeyException(pe); + } + + this.type = type; + this.keyParams = keyParams; + + try { + // generate the key encoding DerOutputStream out = new DerOutputStream(); out.putInteger(n); out.putInteger(e); @@ -113,9 +143,9 @@ } /** - * Construct a key from its encoding. Used by RSAKeyFactory. + * Construct a key from its encoding. */ - RSAPublicKeyImpl(byte[] encoded) throws InvalidKeyException { + private RSAPublicKeyImpl(byte[] encoded) throws InvalidKeyException { if (encoded == null || encoded.length == 0) { throw new InvalidKeyException("Missing key encoding"); } @@ -124,8 +154,10 @@ checkExponentRange(n, e); try { - // this will check the validity of params - this.keyParams = RSAUtil.getParamSpec(algid); + // check the validity of oid and params + Object[] o = RSAUtil.getTypeAndParamSpec(algid); + this.type = (KeyType) o[0]; + this.keyParams = (AlgorithmParameterSpec) o[1]; } catch (ProviderException e) { throw new InvalidKeyException(e); } @@ -148,7 +180,7 @@ // see JCA doc @Override public String getAlgorithm() { - return algid.getName(); + return type.keyAlgo; } // see JCA doc @@ -169,22 +201,30 @@ return keyParams; } + // utility method for parsing DER encoding of RSA public keys in PKCS#1 + // format as defined in RFC 8017 Appendix A.1.1, i.e. SEQ of n and e. + private static BigInteger[] parseASN1(byte[] raw) throws IOException { + DerValue derValue = new DerValue(raw); + if (derValue.tag != DerValue.tag_Sequence) { + throw new IOException("Not a SEQUENCE"); + } + BigInteger[] result = new BigInteger[2]; // n, e + result[0] = derValue.data.getPositiveBigInteger(); + result[1] = derValue.data.getPositiveBigInteger(); + if (derValue.data.available() != 0) { + throw new IOException("Extra data available"); + } + return result; + } + /** * Parse the key. Called by X509Key. */ protected void parseKeyBits() throws InvalidKeyException { try { - DerInputStream in = new DerInputStream(getKey().toByteArray()); - DerValue derValue = in.getDerValue(); - if (derValue.tag != DerValue.tag_Sequence) { - throw new IOException("Not a SEQUENCE"); - } - DerInputStream data = derValue.data; - n = data.getPositiveBigInteger(); - e = data.getPositiveBigInteger(); - if (derValue.data.available() != 0) { - throw new IOException("Extra data available"); - } + BigInteger[] comps = parseASN1(getKey().toByteArray()); + n = comps[0]; + e = comps[1]; } catch (IOException e) { throw new InvalidKeyException("Invalid RSA public key", e); } @@ -193,15 +233,30 @@ // return a string representation of this key for debugging @Override public String toString() { - return "Sun " + getAlgorithm() + " public key, " + n.bitLength() + return "Sun " + type.keyAlgo + " public key, " + n.bitLength() + " bits" + "\n params: " + keyParams + "\n modulus: " + n + "\n public exponent: " + e; } - protected Object writeReplace() throws java.io.ObjectStreamException { + private Object writeReplace() throws java.io.ObjectStreamException { return new KeyRep(KeyRep.Type.PUBLIC, getAlgorithm(), getFormat(), getEncoded()); } + + /** + * Restores the state of this object from the stream. + *

+ * Deserialization of this object is not supported. + * + * @param stream the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded + */ + private void readObject(ObjectInputStream stream) + throws IOException, ClassNotFoundException { + throw new InvalidObjectException( + "RSAPublicKeyImpl keys are not directly deserializable"); + } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/rsa/RSAUtil.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/RSAUtil.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/rsa/RSAUtil.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/RSAUtil.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -40,52 +40,71 @@ public class RSAUtil { public enum KeyType { - RSA ("RSA"), - PSS ("RSASSA-PSS") + RSA ("RSA", AlgorithmId.RSAEncryption_oid, null), + PSS ("RSASSA-PSS", AlgorithmId.RSASSA_PSS_oid, PSSParameterSpec.class) ; - private final String algo; - - KeyType(String keyAlgo) { - this.algo = keyAlgo; - } - public String keyAlgo() { - return algo; - } - public static KeyType lookup(String name) - throws InvalidKeyException, ProviderException { - if (name == null) { - throw new InvalidKeyException("Null key algorithm"); + final String keyAlgo; + final ObjectIdentifier oid; + final Class paramSpecCls; + + KeyType(String keyAlgo, ObjectIdentifier oid, + Class paramSpecCls) { + this.keyAlgo = keyAlgo; + this.oid = oid; + this.paramSpecCls = paramSpecCls; + } + + public static KeyType lookup(String name) throws ProviderException { + + requireNonNull(name, "Key algorithm should not be null"); + + // match loosely in order to work with 3rd party providers which + // may not follow the standard names + if (name.indexOf("PSS") != -1) { + return PSS; + } else if (name.indexOf("RSA") != -1) { + return RSA; + } else { // no match + throw new ProviderException("Unsupported algorithm " + name); } - for (KeyType kt : KeyType.values()) { - if (kt.keyAlgo().equalsIgnoreCase(name)) { - return kt; - } - } - // no match - throw new ProviderException("Unsupported algorithm " + name); } } - public static void checkParamsAgainstType(KeyType type, + private static void requireNonNull(Object obj, String msg) { + if (obj == null) throw new ProviderException(msg); + } + + public static AlgorithmParameterSpec checkParamsAgainstType(KeyType type, AlgorithmParameterSpec paramSpec) throws ProviderException { - switch (type) { - case RSA: - if (paramSpec != null) { - throw new ProviderException("null params expected for " + - type.keyAlgo()); - } - break; - case PSS: - if ((paramSpec != null) && - !(paramSpec instanceof PSSParameterSpec)) { - throw new ProviderException - ("PSSParmeterSpec expected for " + type.keyAlgo()); - } - break; - default: - throw new ProviderException - ("Unsupported RSA algorithm " + type); + + // currently no check for null parameter spec + // assumption is parameter spec is optional and can be null + if (paramSpec == null) return null; + + Class expCls = type.paramSpecCls; + if (expCls == null) { + throw new ProviderException("null params expected for " + + type.keyAlgo); + } else if (!expCls.isInstance(paramSpec)) { + throw new ProviderException + (expCls + " expected for " + type.keyAlgo); + } + return paramSpec; + } + + public static AlgorithmParameters getParams(KeyType type, + AlgorithmParameterSpec spec) throws ProviderException { + + if (spec == null) return null; + + try { + AlgorithmParameters params = + AlgorithmParameters.getInstance(type.keyAlgo); + params.init(spec); + return params; + } catch (NoSuchAlgorithmException | InvalidParameterSpecException ex) { + throw new ProviderException(ex); } } @@ -94,69 +113,53 @@ checkParamsAgainstType(type, paramSpec); - ObjectIdentifier oid = null; - AlgorithmParameters params = null; - try { - switch (type) { - case RSA: - oid = AlgorithmId.RSAEncryption_oid; - break; - case PSS: - if (paramSpec != null) { - params = AlgorithmParameters.getInstance(type.keyAlgo()); - params.init(paramSpec); - } - oid = AlgorithmId.RSASSA_PSS_oid; - break; - default: - throw new ProviderException - ("Unsupported RSA algorithm " + type); - } - AlgorithmId result; - if (params == null) { - result = new AlgorithmId(oid); - } else { - result = new AlgorithmId(oid, params); - } - return result; - } catch (NoSuchAlgorithmException | InvalidParameterSpecException e) { - // should not happen - throw new ProviderException(e); - } + ObjectIdentifier oid = type.oid; + AlgorithmParameters params = getParams(type, paramSpec); + return new AlgorithmId(oid, params); } - public static AlgorithmParameterSpec getParamSpec(AlgorithmId algid) - throws ProviderException { - if (algid == null) { - throw new ProviderException("AlgorithmId should not be null"); + public static AlgorithmParameterSpec getParamSpec( + AlgorithmParameters params) throws ProviderException { + + if (params == null) return null; + + String algName = params.getAlgorithm(); + + KeyType type = KeyType.lookup(algName); + Class specCls = type.paramSpecCls; + if (specCls == null) { + throw new ProviderException("No params accepted for " + + type.keyAlgo); + } + try { + return params.getParameterSpec(specCls); + } catch (InvalidParameterSpecException ex) { + throw new ProviderException(ex); } - return getParamSpec(algid.getParameters()); } - public static AlgorithmParameterSpec getParamSpec(AlgorithmParameters params) + public static Object[] getTypeAndParamSpec(AlgorithmId algid) throws ProviderException { - if (params == null) return null; + requireNonNull(algid, "AlgorithmId should not be null"); + + Object[] result = new Object[2]; + + String algName = algid.getName(); try { - String algName = params.getAlgorithm(); - KeyType type = KeyType.lookup(algName); - Class specCls; - switch (type) { - case RSA: - throw new ProviderException("No params accepted for " + - type.keyAlgo()); - case PSS: - specCls = PSSParameterSpec.class; - break; - default: - throw new ProviderException("Unsupported RSA algorithm: " + algName); - } - return params.getParameterSpec(specCls); + result[0] = KeyType.lookup(algName); } catch (ProviderException pe) { - // pass it up - throw pe; - } catch (Exception e) { - throw new ProviderException(e); + // accommodate RSA keys encoded with various RSA signature oids + // for backward compatibility + if (algName.indexOf("RSA") != -1) { + result[0] = KeyType.RSA; + } else { + // pass it up + throw pe; + } } + + result[1] = getParamSpec(algid.getParameters()); + return result; } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2003, 2018, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -27,7 +27,7 @@ import java.util.*; import java.security.Provider; -import static sun.security.provider.SunEntries.createAliasesWithOid; +import static sun.security.util.SecurityProviderConstants.getAliases; /** * Defines the entries of the SunRsaSign provider. @@ -38,7 +38,14 @@ private void add(Provider p, String type, String algo, String cn, List aliases, HashMap attrs) { - services.add(new Provider.Service(p, type, algo, cn, aliases, attrs)); + services.add(new Provider.Service(p, type, algo, cn, + aliases, attrs)); + } + + private void addA(Provider p, String type, String algo, String cn, + HashMap attrs) { + services.add(new Provider.Service(p, type, algo, cn, + getAliases(algo), attrs)); } // extend LinkedHashSet for consistency with SunEntries @@ -47,13 +54,6 @@ services = new LinkedHashSet<>(20, 0.9f); // start populating content using the specified provider - - // common oids - String rsaOid = "1.2.840.113549.1.1"; - List rsaAliases = createAliasesWithOid(rsaOid); - List rsapssAliases = createAliasesWithOid(rsaOid + ".10"); - String sha1withRSAOid2 = "1.3.14.3.2.29"; - // common attribute map HashMap attrs = new HashMap<>(3); attrs.put("SupportedKeyClasses", @@ -62,50 +62,37 @@ add(p, "KeyFactory", "RSA", "sun.security.rsa.RSAKeyFactory$Legacy", - rsaAliases, null); + getAliases("PKCS1"), null); add(p, "KeyPairGenerator", "RSA", "sun.security.rsa.RSAKeyPairGenerator$Legacy", - rsaAliases, null); - add(p, "Signature", "MD2withRSA", - "sun.security.rsa.RSASignature$MD2withRSA", - createAliasesWithOid(rsaOid + ".2"), attrs); - add(p, "Signature", "MD5withRSA", - "sun.security.rsa.RSASignature$MD5withRSA", - createAliasesWithOid(rsaOid + ".4"), attrs); - add(p, "Signature", "SHA1withRSA", - "sun.security.rsa.RSASignature$SHA1withRSA", - createAliasesWithOid(rsaOid + ".5", sha1withRSAOid2), attrs); - add(p, "Signature", "SHA224withRSA", - "sun.security.rsa.RSASignature$SHA224withRSA", - createAliasesWithOid(rsaOid + ".14"), attrs); - add(p, "Signature", "SHA256withRSA", - "sun.security.rsa.RSASignature$SHA256withRSA", - createAliasesWithOid(rsaOid + ".11"), attrs); - add(p, "Signature", "SHA384withRSA", - "sun.security.rsa.RSASignature$SHA384withRSA", - createAliasesWithOid(rsaOid + ".12"), attrs); - add(p, "Signature", "SHA512withRSA", - "sun.security.rsa.RSASignature$SHA512withRSA", - createAliasesWithOid(rsaOid + ".13"), attrs); - add(p, "Signature", "SHA512/224withRSA", - "sun.security.rsa.RSASignature$SHA512_224withRSA", - createAliasesWithOid(rsaOid + ".15"), attrs); - add(p, "Signature", "SHA512/256withRSA", - "sun.security.rsa.RSASignature$SHA512_256withRSA", - createAliasesWithOid(rsaOid + ".16"), attrs); - - add(p, "KeyFactory", "RSASSA-PSS", - "sun.security.rsa.RSAKeyFactory$PSS", - rsapssAliases, null); - add(p, "KeyPairGenerator", "RSASSA-PSS", - "sun.security.rsa.RSAKeyPairGenerator$PSS", - rsapssAliases, null); - add(p, "Signature", "RSASSA-PSS", - "sun.security.rsa.RSAPSSSignature", - rsapssAliases, attrs); - add(p, "AlgorithmParameters", "RSASSA-PSS", - "sun.security.rsa.PSSParameters", - rsapssAliases, null); + getAliases("PKCS1"), null); + addA(p, "Signature", "MD2withRSA", + "sun.security.rsa.RSASignature$MD2withRSA", attrs); + addA(p, "Signature", "MD5withRSA", + "sun.security.rsa.RSASignature$MD5withRSA", attrs); + addA(p, "Signature", "SHA1withRSA", + "sun.security.rsa.RSASignature$SHA1withRSA", attrs); + addA(p, "Signature", "SHA224withRSA", + "sun.security.rsa.RSASignature$SHA224withRSA", attrs); + addA(p, "Signature", "SHA256withRSA", + "sun.security.rsa.RSASignature$SHA256withRSA", attrs); + addA(p, "Signature", "SHA384withRSA", + "sun.security.rsa.RSASignature$SHA384withRSA", attrs); + addA(p, "Signature", "SHA512withRSA", + "sun.security.rsa.RSASignature$SHA512withRSA", attrs); + addA(p, "Signature", "SHA512/224withRSA", + "sun.security.rsa.RSASignature$SHA512_224withRSA", attrs); + addA(p, "Signature", "SHA512/256withRSA", + "sun.security.rsa.RSASignature$SHA512_256withRSA", attrs); + + addA(p, "KeyFactory", "RSASSA-PSS", + "sun.security.rsa.RSAKeyFactory$PSS", attrs); + addA(p, "KeyPairGenerator", "RSASSA-PSS", + "sun.security.rsa.RSAKeyPairGenerator$PSS", attrs); + addA(p, "Signature", "RSASSA-PSS", + "sun.security.rsa.RSAPSSSignature", attrs); + addA(p, "AlgorithmParameters", "RSASSA-PSS", + "sun.security.rsa.PSSParameters", attrs); } public Iterator iterator() { diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/ssl/DHKeyExchange.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/ssl/DHKeyExchange.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/ssl/DHKeyExchange.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/ssl/DHKeyExchange.java 2023-10-06 05:33:33.000000000 +0000 @@ -327,45 +327,36 @@ } /* - * 768 bits ephemeral DH private keys were used to be used in + * 768 bit ephemeral DH private keys used to be used in * ServerKeyExchange except that exportable ciphers max out at 512 - * bits modulus values. We still adhere to this behavior in legacy + * bit modulus values. We still adhere to this behavior in legacy * mode (system property "jdk.tls.ephemeralDHKeySize" is defined * as "legacy"). * - * Old JDK (JDK 7 and previous) releases don't support DH keys - * bigger than 1024 bits. We have to consider the compatibility - * requirement. 1024 bits DH key is always used for non-exportable - * cipher suites in default mode (system property + * Only very old JDK releases don't support DH keys bigger than + * 1024 bits (JDK 1.5 and 6u/7u releases prior to adding support + * for DH keys > 1024 bits - see JDK-8062834). A 2048 bit + * DH key is always used for non-exportable cipher suites in + * default mode (when the system property * "jdk.tls.ephemeralDHKeySize" is not defined). * - * However, if applications want more stronger strength, setting - * system property "jdk.tls.ephemeralDHKeySize" to "matched" - * is a workaround to use ephemeral DH key which size matches the - * corresponding authentication key. For example, if the public key - * size of an authentication certificate is 2048 bits, then the - * ephemeral DH key size should be 2048 bits accordingly unless - * the cipher suite is exportable. This key sizing scheme keeps - * the cryptographic strength consistent between authentication - * keys and key-exchange keys. - * * Applications may also want to customize the ephemeral DH key * size to a fixed length for non-exportable cipher suites. This - * can be approached by setting system property + * can be done by setting the system property * "jdk.tls.ephemeralDHKeySize" to a valid positive integer between * 1024 and 8192 bits, inclusive. * - * Note that the minimum acceptable key size is 1024 bits except - * exportable cipher suites or legacy mode. + * Note that the minimum acceptable key size is 2048 bits except + * for exportable cipher suites or legacy mode. * * Note that per RFC 2246, the key size limit of DH is 512 bits for * exportable cipher suites. Because of the weakness, exportable * cipher suites are deprecated since TLS v1.1 and they are not * enabled by default in Oracle provider. The legacy behavior is - * reserved and 512 bits DH key is always used for exportable + * preserved and a 512 bit DH key is always used for exportable * cipher suites. */ - int keySize = exportable ? 512 : 1024; // default mode + int keySize = exportable ? 512 : 2048; // default mode if (!exportable) { if (useLegacyEphemeralDHKeys) { // legacy mode keySize = 768; @@ -391,7 +382,7 @@ // limit in the future when the compatibility and // interoperability impact is limited. keySize = ks <= 1024 ? 1024 : 2048; - } // Otherwise, anonymous cipher suites, 1024-bit is used. + } // Otherwise, anonymous cipher suites, 2048-bit is used. } else if (customizedDHKeySize > 0) { // customized mode keySize = customizedDHKeySize; } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/ssl/SSLConfiguration.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/ssl/SSLConfiguration.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/ssl/SSLConfiguration.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/ssl/SSLConfiguration.java 2023-10-06 05:33:33.000000000 +0000 @@ -143,7 +143,7 @@ this.identificationProtocol = null; this.serverNames = Collections.emptyList(); this.sniMatchers = Collections.emptyList(); - this.preferLocalCipherSuites = false; + this.preferLocalCipherSuites = true; this.applicationProtocols = new String[0]; this.enableRetransmissions = sslContext.isDTLS(); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/ssl/SunJSSE.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/ssl/SunJSSE.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/ssl/SunJSSE.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/ssl/SunJSSE.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1999, 2018, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1999, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -29,7 +29,7 @@ import java.util.*; import sun.security.rsa.SunRsaSignEntries; import static sun.security.util.SecurityConstants.PROVIDER_VER; -import static sun.security.provider.SunEntries.createAliases; +import static sun.security.util.SecurityProviderConstants.*; /** * The JSSE provider. @@ -161,8 +161,8 @@ } private void ps(String type, String algo, String cn, - List aliases, HashMap attrs) { - putService(new Provider.Service(this, type, algo, cn, aliases, attrs)); + List a, HashMap attrs) { + putService(new Provider.Service(this, type, algo, cn, a, attrs)); } private void doRegister(boolean isfips) { @@ -180,17 +180,17 @@ "sun.security.ssl.KeyManagerFactoryImpl$SunX509", null, null); ps("KeyManagerFactory", "NewSunX509", "sun.security.ssl.KeyManagerFactoryImpl$X509", - createAliases("PKIX"), null); + List.of("PKIX"), null); ps("TrustManagerFactory", "SunX509", "sun.security.ssl.TrustManagerFactoryImpl$SimpleFactory", null, null); ps("TrustManagerFactory", "PKIX", "sun.security.ssl.TrustManagerFactoryImpl$PKIXFactory", - createAliases("SunPKIX", "X509", "X.509"), null); + List.of("SunPKIX", "X509", "X.509"), null); ps("SSLContext", "TLSv1", "sun.security.ssl.SSLContextImpl$TLS10Context", - (isfips? null : createAliases("SSLv3")), null); + (isfips? null : List.of("SSLv3")), null); ps("SSLContext", "TLSv1.1", "sun.security.ssl.SSLContextImpl$TLS11Context", null, null); ps("SSLContext", "TLSv1.2", @@ -199,7 +199,7 @@ "sun.security.ssl.SSLContextImpl$TLS13Context", null, null); ps("SSLContext", "TLS", "sun.security.ssl.SSLContextImpl$TLSContext", - (isfips? null : createAliases("SSL")), null); + (isfips? null : List.of("SSL")), null); ps("SSLContext", "DTLSv1.0", "sun.security.ssl.SSLContextImpl$DTLS10Context", null, null); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/ssl/X509KeyManagerImpl.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/ssl/X509KeyManagerImpl.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/ssl/X509KeyManagerImpl.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/ssl/X509KeyManagerImpl.java 2023-10-06 05:33:33.000000000 +0000 @@ -43,6 +43,7 @@ import javax.net.ssl.*; import sun.security.provider.certpath.AlgorithmChecker; import sun.security.validator.Validator; +import sun.security.util.KnownOIDs; /** * The new X509 key manager implementation. The main differences to the @@ -521,14 +522,19 @@ // enum constant for "tls client" check // valid EKU for TLS client: any, tls_client - CLIENT(new HashSet(Arrays.asList(new String[] { - "2.5.29.37.0", "1.3.6.1.5.5.7.3.2" }))), + CLIENT(new HashSet(List.of( + KnownOIDs.anyExtendedKeyUsage.value(), + KnownOIDs.clientAuth.value() + ))), // enum constant for "tls server" check // valid EKU for TLS server: any, tls_server, ns_sgc, ms_sgc - SERVER(new HashSet(Arrays.asList(new String[] { - "2.5.29.37.0", "1.3.6.1.5.5.7.3.1", "2.16.840.1.113730.4.1", - "1.3.6.1.4.1.311.10.3.3" }))); + SERVER(new HashSet(List.of( + KnownOIDs.anyExtendedKeyUsage.value(), + KnownOIDs.serverAuth.value(), + KnownOIDs.NETSCAPE_ExportApproved.value(), + KnownOIDs.MICROSOFT_ExportApproved.value() + ))); // set of valid EKU values for this type final Set validEku; diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/timestamp/TSRequest.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/timestamp/TSRequest.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/timestamp/TSRequest.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/timestamp/TSRequest.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2003, 2013, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -163,7 +163,7 @@ // encode optional elements if (policyId != null) { - request.putOID(new ObjectIdentifier(policyId)); + request.putOID(ObjectIdentifier.of(policyId)); } if (nonce != null) { request.putInteger(nonce); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/tools/keytool/Main.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/tools/keytool/Main.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/tools/keytool/Main.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/tools/keytool/Main.java 2023-10-06 05:33:33.000000000 +0000 @@ -4278,6 +4278,23 @@ } /** + * Match a command with a command set. The match can be exact, or + * partial, or case-insensitive. + * + * @param s the command provided by user + * @param list the legal command set represented by KnownOIDs enums. + * @return the position of a single match, or -1 if none matched + * @throws Exception if s is ambiguous + */ + private static int oneOf(String s, KnownOIDs... list) throws Exception { + String[] convertedList = new String[list.length]; + for (int i = 0; i < list.length; i++) { + convertedList[i] = list[i].stdName(); + } + return oneOf(s, convertedList); + } + + /** * Match a command (may be abbreviated) with a command set. * @param s the command provided * @param list the legal command set. If there is a null, commands after it @@ -4395,7 +4412,7 @@ case 5: return PKIXExtensions.SubjectInfoAccess_Id; case 6: return PKIXExtensions.AuthInfoAccess_Id; case 8: return PKIXExtensions.CRLDistributionPoints_Id; - default: return new ObjectIdentifier(type); + default: return ObjectIdentifier.of(type); } } @@ -4616,30 +4633,26 @@ case 2: // EKU if(value != null) { Vector v = new Vector<>(); + KnownOIDs[] choices = { + KnownOIDs.anyExtendedKeyUsage, + KnownOIDs.serverAuth, + KnownOIDs.clientAuth, + KnownOIDs.codeSigning, + KnownOIDs.emailProtection, + KnownOIDs.KP_TimeStamping, + KnownOIDs.OCSPSigning + }; for (String s: value.split(",")) { - int p = oneOf(s, - "anyExtendedKeyUsage", - "serverAuth", //1 - "clientAuth", //2 - "codeSigning", //3 - "emailProtection", //4 - "", //5 - "", //6 - "", //7 - "timeStamping", //8 - "OCSPSigning" //9 - ); - if (p < 0) { - try { - v.add(new ObjectIdentifier(s)); - } catch (Exception e) { - throw new Exception(rb.getString( - "Unknown.extendedkeyUsage.type.") + s); - } - } else if (p == 0) { - v.add(new ObjectIdentifier("2.5.29.37.0")); - } else { - v.add(new ObjectIdentifier("1.3.6.1.5.5.7.3." + p)); + int p = oneOf(s, choices); + String o = s; + if (p >= 0) { + o = choices[p].value(); + } + try { + v.add(ObjectIdentifier.of(o)); + } catch (Exception e) { + throw new Exception(rb.getString( + "Unknown.extendedkeyUsage.type.") + s); } } setExt(result, new ExtendedKeyUsageExtension(isCritical, v)); @@ -4694,24 +4707,23 @@ String m = item.substring(0, colonpos); String t = item.substring(colonpos+1, colonpos2); String v = item.substring(colonpos2+1); - int p = oneOf(m, - "", - "ocsp", //1 - "caIssuers", //2 - "timeStamping", //3 - "", - "caRepository" //5 - ); + KnownOIDs[] choices = { + KnownOIDs.OCSP, + KnownOIDs.caIssuers, + KnownOIDs.AD_TimeStamping, + KnownOIDs.caRepository + }; + int p = oneOf(m, choices); ObjectIdentifier oid; - if (p < 0) { + if (p >= 0) { + oid = ObjectIdentifier.of(choices[p]); + } else { try { - oid = new ObjectIdentifier(m); + oid = ObjectIdentifier.of(m); } catch (Exception e) { throw new Exception(rb.getString( "Unknown.AccessDescription.type.") + m); } - } else { - oid = new ObjectIdentifier("1.3.6.1.5.5.7.48." + p); } accessDescriptions.add(new AccessDescription( oid, createGeneralName(t, v, exttype))); @@ -4748,7 +4760,7 @@ } break; case -1: - ObjectIdentifier oid = new ObjectIdentifier(name); + ObjectIdentifier oid = ObjectIdentifier.of(name); byte[] data = null; if (value != null) { data = new byte[value.length() / 2 + 1]; diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/util/ConstraintsParameters.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/ConstraintsParameters.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/util/ConstraintsParameters.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/ConstraintsParameters.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2016, 2017, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2016, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/util/CurveDB.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/CurveDB.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/util/CurveDB.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/CurveDB.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2006, 2019, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2006, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -30,7 +30,6 @@ import java.security.spec.*; import java.util.*; -import java.util.regex.Pattern; /** * Repository for well-known Elliptic Curve parameters. It is used by both @@ -54,8 +53,6 @@ private static Collection specCollection; - public static final String SPLIT_PATTERN = ",|\\[|\\]"; - // Used by SunECEntries public static CollectiongetSupportedCurves() { return specCollection; @@ -117,9 +114,8 @@ return new BigInteger(s, 16); } - private static void add(String name, String soid, int type, String sfield, - String a, String b, String x, String y, String n, int h, - Pattern nameSplitPattern) { + private static void add(KnownOIDs o, int type, String sfield, + String a, String b, String x, String y, String n, int h) { BigInteger p = bi(sfield); ECField field; if ((type == P) || (type == PD)) { @@ -133,15 +129,16 @@ EllipticCurve curve = new EllipticCurve(field, bi(a), bi(b)); ECPoint g = new ECPoint(bi(x), bi(y)); - NamedCurve params = new NamedCurve(name, soid, curve, g, bi(n), h); - if (oidMap.put(soid, params) != null) { - throw new RuntimeException("Duplication oid: " + soid); + String oid = o.value(); + NamedCurve params = new NamedCurve(o, curve, g, bi(n), h); + if (oidMap.put(oid, params) != null) { + throw new RuntimeException("Duplication oid: " + oid); } - String[] commonNames = nameSplitPattern.split(name); - for (String commonName : commonNames) { - if (nameMap.put(commonName.trim(), params) != null) { - throw new RuntimeException("Duplication name: " + commonName); + for (String cn : params.getNameAndAliases()) { + if (nameMap.put(cn, + params) != null) { + throw new RuntimeException("Duplication name: " + cn); } } @@ -153,445 +150,424 @@ } } - private static class Holder { - private static final Pattern nameSplitPattern = Pattern.compile( - SPLIT_PATTERN); - } - - // Return all the names the EC curve could be using. - static String[] getNamesByOID(String oid) { - NamedCurve nc = oidMap.get(oid); - if (nc == null) { - return new String[0]; - } - String[] list = Holder.nameSplitPattern.split(nc.getName()); - int i = 0; - do { - list[i] = list[i].trim(); - } while (++i < list.length); - return list; - } - static { - Pattern nameSplitPattern = Holder.nameSplitPattern; - /* SEC2 prime curves */ - add("secp112r1", "1.3.132.0.6", P, + add(KnownOIDs.secp112r1, P, "DB7C2ABF62E35E668076BEAD208B", "DB7C2ABF62E35E668076BEAD2088", "659EF8BA043916EEDE8911702B22", "09487239995A5EE76B55F9C2F098", "A89CE5AF8724C0A23E0E0FF77500", "DB7C2ABF62E35E7628DFAC6561C5", - 1, nameSplitPattern); + 1); - add("secp112r2", "1.3.132.0.7", P, + add(KnownOIDs.secp112r2, P, "DB7C2ABF62E35E668076BEAD208B", "6127C24C05F38A0AAAF65C0EF02C", "51DEF1815DB5ED74FCC34C85D709", "4BA30AB5E892B4E1649DD0928643", "adcd46f5882e3747def36e956e97", "36DF0AAFD8B8D7597CA10520D04B", - 4, nameSplitPattern); + 4); - add("secp128r1", "1.3.132.0.28", P, + add(KnownOIDs.secp128r1, P, "FFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFF", "FFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFC", "E87579C11079F43DD824993C2CEE5ED3", "161FF7528B899B2D0C28607CA52C5B86", "CF5AC8395BAFEB13C02DA292DDED7A83", "FFFFFFFE0000000075A30D1B9038A115", - 1, nameSplitPattern); + 1); - add("secp128r2", "1.3.132.0.29", P, + add(KnownOIDs.secp128r2, P, "FFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFF", "D6031998D1B3BBFEBF59CC9BBFF9AEE1", "5EEEFCA380D02919DC2C6558BB6D8A5D", "7B6AA5D85E572983E6FB32A7CDEBC140", "27B6916A894D3AEE7106FE805FC34B44", "3FFFFFFF7FFFFFFFBE0024720613B5A3", - 4, nameSplitPattern); + 4); - add("secp160k1", "1.3.132.0.9", P, + add(KnownOIDs.secp160k1, P, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73", "0000000000000000000000000000000000000000", "0000000000000000000000000000000000000007", "3B4C382CE37AA192A4019E763036F4F5DD4D7EBB", "938CF935318FDCED6BC28286531733C3F03C4FEE", "0100000000000000000001B8FA16DFAB9ACA16B6B3", - 1, nameSplitPattern); + 1); - add("secp160r1", "1.3.132.0.8", P, + add(KnownOIDs.secp160r1, P, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF", "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC", "1C97BEFC54BD7A8B65ACF89F81D4D4ADC565FA45", "4A96B5688EF573284664698968C38BB913CBFC82", "23A628553168947D59DCC912042351377AC5FB32", "0100000000000000000001F4C8F927AED3CA752257", - 1, nameSplitPattern); + 1); - add("secp160r2", "1.3.132.0.30", P, + add(KnownOIDs.secp160r2, P, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73", "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC70", "B4E134D3FB59EB8BAB57274904664D5AF50388BA", "52DCB034293A117E1F4FF11B30F7199D3144CE6D", "FEAFFEF2E331F296E071FA0DF9982CFEA7D43F2E", "0100000000000000000000351EE786A818F3A1A16B", - 1, nameSplitPattern); + 1); - add("secp192k1", "1.3.132.0.31", P, + add(KnownOIDs.secp192k1, P, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFEE37", "000000000000000000000000000000000000000000000000", "000000000000000000000000000000000000000000000003", "DB4FF10EC057E9AE26B07D0280B7F4341DA5D1B1EAE06C7D", "9B2F2F6D9C5628A7844163D015BE86344082AA88D95E2F9D", "FFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8D", - 1, nameSplitPattern); + 1); - add("secp192r1 [NIST P-192, X9.62 prime192v1]", "1.2.840.10045.3.1.1", PD, + add(KnownOIDs.secp192r1, PD, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF", "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC", "64210519E59C80E70FA7E9AB72243049FEB8DEECC146B9B1", "188DA80EB03090F67CBF20EB43A18800F4FF0AFD82FF1012", "07192B95FFC8DA78631011ED6B24CDD573F977A11E794811", "FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831", - 1, nameSplitPattern); + 1); - add("secp224k1", "1.3.132.0.32", P, + add(KnownOIDs.secp224k1, P, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFE56D", "00000000000000000000000000000000000000000000000000000000", "00000000000000000000000000000000000000000000000000000005", "A1455B334DF099DF30FC28A169A467E9E47075A90F7E650EB6B7A45C", "7E089FED7FBA344282CAFBD6F7E319F7C0B0BD59E2CA4BDB556D61A5", "010000000000000000000000000001DCE8D2EC6184CAF0A971769FB1F7", - 1, nameSplitPattern); + 1); - add("secp224r1 [NIST P-224]", "1.3.132.0.33", PD, + add(KnownOIDs.secp224r1, PD, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001", "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE", "B4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4", "B70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21", "BD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34", "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D", - 1, nameSplitPattern); + 1); - add("secp256k1", "1.3.132.0.10", P, + add(KnownOIDs.secp256k1, P, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F", "0000000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000007", "79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798", "483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8", "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141", - 1, nameSplitPattern); + 1); - add("secp256r1 [NIST P-256, X9.62 prime256v1]", "1.2.840.10045.3.1.7", PD, + add(KnownOIDs.secp256r1, PD, "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", "6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296", "4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551", - 1, nameSplitPattern); + 1); - add("secp384r1 [NIST P-384]", "1.3.132.0.34", PD, + add(KnownOIDs.secp384r1, PD, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF", "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFC", "B3312FA7E23EE7E4988E056BE3F82D19181D9C6EFE8141120314088F5013875AC656398D8A2ED19D2A85C8EDD3EC2AEF", "AA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B9859F741E082542A385502F25DBF55296C3A545E3872760AB7", "3617DE4A96262C6F5D9E98BF9292DC29F8F41DBD289A147CE9DA3113B5F0B8C00A60B1CE1D7E819D7A431D7C90EA0E5F", "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973", - 1, nameSplitPattern); + 1); - add("secp521r1 [NIST P-521]", "1.3.132.0.35", PD, + add(KnownOIDs.secp521r1, PD, "01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF", "01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC", "0051953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00", "00C6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66", "011839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650", "01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409", - 1, nameSplitPattern); + 1); /* ANSI X9.62 prime curves */ - add("X9.62 prime192v2", "1.2.840.10045.3.1.2", P, + add(KnownOIDs.prime192v2, P, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF", "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC", "CC22D6DFB95C6B25E49C0D6364A4E5980C393AA21668D953", "EEA2BAE7E1497842F2DE7769CFE9C989C072AD696F48034A", "6574D11D69B6EC7A672BB82A083DF2F2B0847DE970B2DE15", "FFFFFFFFFFFFFFFFFFFFFFFE5FB1A724DC80418648D8DD31", - 1, nameSplitPattern); + 1); - add("X9.62 prime192v3", "1.2.840.10045.3.1.3", P, + add(KnownOIDs.prime192v3, P, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF", "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC", "22123DC2395A05CAA7423DAECCC94760A7D462256BD56916", "7D29778100C65A1DA1783716588DCE2B8B4AEE8E228F1896", "38A90F22637337334B49DCB66A6DC8F9978ACA7648A943B0", "FFFFFFFFFFFFFFFFFFFFFFFF7A62D031C83F4294F640EC13", - 1, nameSplitPattern); + 1); - add("X9.62 prime239v1", "1.2.840.10045.3.1.4", P, + add(KnownOIDs.prime239v1, P, "7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF", "7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC", "6B016C3BDCF18941D0D654921475CA71A9DB2FB27D1D37796185C2942C0A", "0FFA963CDCA8816CCC33B8642BEDF905C3D358573D3F27FBBD3B3CB9AAAF", "7DEBE8E4E90A5DAE6E4054CA530BA04654B36818CE226B39FCCB7B02F1AE", "7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF9E5E9A9F5D9071FBD1522688909D0B", - 1, nameSplitPattern); + 1); - add("X9.62 prime239v2", "1.2.840.10045.3.1.5", P, + add(KnownOIDs.prime239v2, P, "7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF", "7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC", "617FAB6832576CBBFED50D99F0249C3FEE58B94BA0038C7AE84C8C832F2C", "38AF09D98727705120C921BB5E9E26296A3CDCF2F35757A0EAFD87B830E7", "5B0125E4DBEA0EC7206DA0FC01D9B081329FB555DE6EF460237DFF8BE4BA", "7FFFFFFFFFFFFFFFFFFFFFFF800000CFA7E8594377D414C03821BC582063", - 1, nameSplitPattern); + 1); - add("X9.62 prime239v3", "1.2.840.10045.3.1.6", P, + add(KnownOIDs.prime239v3, P, "7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF", "7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC", "255705FA2A306654B1F4CB03D6A750A30C250102D4988717D9BA15AB6D3E", "6768AE8E18BB92CFCF005C949AA2C6D94853D0E660BBF854B1C9505FE95A", "1607E6898F390C06BC1D552BAD226F3B6FCFE48B6E818499AF18E3ED6CF3", "7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF975DEB41B3A6057C3C432146526551", - 1, nameSplitPattern); + 1); /* SEC2 binary curves */ - add("sect113r1", "1.3.132.0.4", B, + add(KnownOIDs.sect113r1, B, "020000000000000000000000000201", "003088250CA6E7C7FE649CE85820F7", "00E8BEE4D3E2260744188BE0E9C723", "009D73616F35F4AB1407D73562C10F", "00A52830277958EE84D1315ED31886", "0100000000000000D9CCEC8A39E56F", - 2, nameSplitPattern); + 2); - add("sect113r2", "1.3.132.0.5", B, + add(KnownOIDs.sect113r2, B, "020000000000000000000000000201", "00689918DBEC7E5A0DD6DFC0AA55C7", "0095E9A9EC9B297BD4BF36E059184F", "01A57A6A7B26CA5EF52FCDB8164797", "00B3ADC94ED1FE674C06E695BABA1D", "010000000000000108789B2496AF93", - 2, nameSplitPattern); + 2); - add("sect131r1", "1.3.132.0.22", B, + add(KnownOIDs.sect131r1, B, "080000000000000000000000000000010D", "07A11B09A76B562144418FF3FF8C2570B8", "0217C05610884B63B9C6C7291678F9D341", "0081BAF91FDF9833C40F9C181343638399", "078C6E7EA38C001F73C8134B1B4EF9E150", "0400000000000000023123953A9464B54D", - 2, nameSplitPattern); + 2); - add("sect131r2", "1.3.132.0.23", B, + add(KnownOIDs.sect131r2, B, "080000000000000000000000000000010D", "03E5A88919D7CAFCBF415F07C2176573B2", "04B8266A46C55657AC734CE38F018F2192", "0356DCD8F2F95031AD652D23951BB366A8", "0648F06D867940A5366D9E265DE9EB240F", "0400000000000000016954A233049BA98F", - 2, nameSplitPattern); + 2); - add("sect163k1 [NIST K-163]", "1.3.132.0.1", BD, + add(KnownOIDs.sect163k1, BD, "0800000000000000000000000000000000000000C9", "000000000000000000000000000000000000000001", "000000000000000000000000000000000000000001", "02FE13C0537BBC11ACAA07D793DE4E6D5E5C94EEE8", "0289070FB05D38FF58321F2E800536D538CCDAA3D9", "04000000000000000000020108A2E0CC0D99F8A5EF", - 2, nameSplitPattern); + 2); - add("sect163r1", "1.3.132.0.2", B, + add(KnownOIDs.sect163r1, B, "0800000000000000000000000000000000000000C9", "07B6882CAAEFA84F9554FF8428BD88E246D2782AE2", "0713612DCDDCB40AAB946BDA29CA91F73AF958AFD9", "0369979697AB43897789566789567F787A7876A654", "00435EDB42EFAFB2989D51FEFCE3C80988F41FF883", "03FFFFFFFFFFFFFFFFFFFF48AAB689C29CA710279B", - 2, nameSplitPattern); + 2); - add("sect163r2 [NIST B-163]", "1.3.132.0.15", BD, + add(KnownOIDs.sect163r2, BD, "0800000000000000000000000000000000000000C9", "000000000000000000000000000000000000000001", "020A601907B8C953CA1481EB10512F78744A3205FD", "03F0EBA16286A2D57EA0991168D4994637E8343E36", "00D51FBC6C71A0094FA2CDD545B11C5C0C797324F1", "040000000000000000000292FE77E70C12A4234C33", - 2, nameSplitPattern); + 2); - add("sect193r1", "1.3.132.0.24", B, + add(KnownOIDs.sect193r1, B, "02000000000000000000000000000000000000000000008001", "0017858FEB7A98975169E171F77B4087DE098AC8A911DF7B01", "00FDFB49BFE6C3A89FACADAA7A1E5BBC7CC1C2E5D831478814", "01F481BC5F0FF84A74AD6CDF6FDEF4BF6179625372D8C0C5E1", "0025E399F2903712CCF3EA9E3A1AD17FB0B3201B6AF7CE1B05", "01000000000000000000000000C7F34A778F443ACC920EBA49", - 2, nameSplitPattern); + 2); - add("sect193r2", "1.3.132.0.25", B, + add(KnownOIDs.sect193r2, B, "02000000000000000000000000000000000000000000008001", "0163F35A5137C2CE3EA6ED8667190B0BC43ECD69977702709B", "00C9BB9E8927D4D64C377E2AB2856A5B16E3EFB7F61D4316AE", "00D9B67D192E0367C803F39E1A7E82CA14A651350AAE617E8F", "01CE94335607C304AC29E7DEFBD9CA01F596F927224CDECF6C", "010000000000000000000000015AAB561B005413CCD4EE99D5", - 2, nameSplitPattern); + 2); - add("sect233k1 [NIST K-233]", "1.3.132.0.26", BD, + add(KnownOIDs.sect233k1, BD, "020000000000000000000000000000000000000004000000000000000001", "000000000000000000000000000000000000000000000000000000000000", "000000000000000000000000000000000000000000000000000000000001", "017232BA853A7E731AF129F22FF4149563A419C26BF50A4C9D6EEFAD6126", "01DB537DECE819B7F70F555A67C427A8CD9BF18AEB9B56E0C11056FAE6A3", "008000000000000000000000000000069D5BB915BCD46EFB1AD5F173ABDF", - 4, nameSplitPattern); + 4); - add("sect233r1 [NIST B-233]", "1.3.132.0.27", B, + add(KnownOIDs.sect233r1, B, "020000000000000000000000000000000000000004000000000000000001", "000000000000000000000000000000000000000000000000000000000001", "0066647EDE6C332C7F8C0923BB58213B333B20E9CE4281FE115F7D8F90AD", "00FAC9DFCBAC8313BB2139F1BB755FEF65BC391F8B36F8F8EB7371FD558B", "01006A08A41903350678E58528BEBF8A0BEFF867A7CA36716F7E01F81052", "01000000000000000000000000000013E974E72F8A6922031D2603CFE0D7", - 2, nameSplitPattern); + 2); - add("sect239k1", "1.3.132.0.3", B, + add(KnownOIDs.sect239k1, B, "800000000000000000004000000000000000000000000000000000000001", "000000000000000000000000000000000000000000000000000000000000", "000000000000000000000000000000000000000000000000000000000001", "29A0B6A887A983E9730988A68727A8B2D126C44CC2CC7B2A6555193035DC", "76310804F12E549BDB011C103089E73510ACB275FC312A5DC6B76553F0CA", "2000000000000000000000000000005A79FEC67CB6E91F1C1DA800E478A5", - 4, nameSplitPattern); + 4); - add("sect283k1 [NIST K-283]", "1.3.132.0.16", BD, + add(KnownOIDs.sect283k1, BD, "0800000000000000000000000000000000000000000000000000000000000000000010A1", "000000000000000000000000000000000000000000000000000000000000000000000000", "000000000000000000000000000000000000000000000000000000000000000000000001", "0503213F78CA44883F1A3B8162F188E553CD265F23C1567A16876913B0C2AC2458492836", "01CCDA380F1C9E318D90F95D07E5426FE87E45C0E8184698E45962364E34116177DD2259", "01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE9AE2ED07577265DFF7F94451E061E163C61", - 4, nameSplitPattern); + 4); - add("sect283r1 [NIST B-283]", "1.3.132.0.17", B, + add(KnownOIDs.sect283r1, B, "0800000000000000000000000000000000000000000000000000000000000000000010A1", "000000000000000000000000000000000000000000000000000000000000000000000001", "027B680AC8B8596DA5A4AF8A19A0303FCA97FD7645309FA2A581485AF6263E313B79A2F5", "05F939258DB7DD90E1934F8C70B0DFEC2EED25B8557EAC9C80E2E198F8CDBECD86B12053", "03676854FE24141CB98FE6D4B20D02B4516FF702350EDDB0826779C813F0DF45BE8112F4", "03FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEF90399660FC938A90165B042A7CEFADB307", - 2, nameSplitPattern); + 2); - add("sect409k1 [NIST K-409]", "1.3.132.0.36", BD, + add(KnownOIDs.sect409k1, BD, "02000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000001", "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001", "0060F05F658F49C1AD3AB1890F7184210EFD0987E307C84C27ACCFB8F9F67CC2C460189EB5AAAA62EE222EB1B35540CFE9023746", "01E369050B7C4E42ACBA1DACBF04299C3460782F918EA427E6325165E9EA10E3DA5F6C42E9C55215AA9CA27A5863EC48D8E0286B", "007FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE5F83B2D4EA20400EC4557D5ED3E3E7CA5B4B5C83B8E01E5FCF", - 4, nameSplitPattern); + 4); - add("sect409r1 [NIST B-409]", "1.3.132.0.37", B, + add(KnownOIDs.sect409r1, B, "02000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000001", "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001", "0021A5C2C8EE9FEB5C4B9A753B7B476B7FD6422EF1F3DD674761FA99D6AC27C8A9A197B272822F6CD57A55AA4F50AE317B13545F", "015D4860D088DDB3496B0C6064756260441CDE4AF1771D4DB01FFE5B34E59703DC255A868A1180515603AEAB60794E54BB7996A7", "0061B1CFAB6BE5F32BBFA78324ED106A7636B9C5A7BD198D0158AA4F5488D08F38514F1FDF4B4F40D2181B3681C364BA0273C706", "010000000000000000000000000000000000000000000000000001E2AAD6A612F33307BE5FA47C3C9E052F838164CD37D9A21173", - 2, nameSplitPattern); + 2); - add("sect571k1 [NIST K-571]", "1.3.132.0.38", BD, + add(KnownOIDs.sect571k1, BD, "080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000425", "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001", "026EB7A859923FBC82189631F8103FE4AC9CA2970012D5D46024804801841CA44370958493B205E647DA304DB4CEB08CBBD1BA39494776FB988B47174DCA88C7E2945283A01C8972", "0349DC807F4FBF374F4AEADE3BCA95314DD58CEC9F307A54FFC61EFC006D8A2C9D4979C0AC44AEA74FBEBBB9F772AEDCB620B01A7BA7AF1B320430C8591984F601CD4C143EF1C7A3", "020000000000000000000000000000000000000000000000000000000000000000000000131850E1F19A63E4B391A8DB917F4138B630D84BE5D639381E91DEB45CFE778F637C1001", - 4, nameSplitPattern); + 4); - add("sect571r1 [NIST B-571]", "1.3.132.0.39", B, + add(KnownOIDs.sect571r1, B, "080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000425", "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001", "02F40E7E2221F295DE297117B7F3D62F5C6A97FFCB8CEFF1CD6BA8CE4A9A18AD84FFABBD8EFA59332BE7AD6756A66E294AFD185A78FF12AA520E4DE739BACA0C7FFEFF7F2955727A", "0303001D34B856296C16C0D40D3CD7750A93D1D2955FA80AA5F40FC8DB7B2ABDBDE53950F4C0D293CDD711A35B67FB1499AE60038614F1394ABFA3B4C850D927E1E7769C8EEC2D19", "037BF27342DA639B6DCCFFFEB73D69D78C6C27A6009CBBCA1980F8533921E8A684423E43BAB08A576291AF8F461BB2A8B3531D2F0485C19B16E2F1516E23DD3C1A4827AF1B8AC15B", "03FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE661CE18FF55987308059B186823851EC7DD9CA1161DE93D5174D66E8382E9BB2FE84E47", - 2, nameSplitPattern); + 2); /* ANSI X9.62 binary curves */ - add("X9.62 c2tnb191v1", "1.2.840.10045.3.0.5", B, + add(KnownOIDs.c2tnb191v1, B, "800000000000000000000000000000000000000000000201", "2866537B676752636A68F56554E12640276B649EF7526267", "2E45EF571F00786F67B0081B9495A3D95462F5DE0AA185EC", "36B3DAF8A23206F9C4F299D7B21A9C369137F2C84AE1AA0D", "765BE73433B3F95E332932E70EA245CA2418EA0EF98018FB", "40000000000000000000000004A20E90C39067C893BBB9A5", - 2, nameSplitPattern); + 2); - add("X9.62 c2tnb191v2", "1.2.840.10045.3.0.6", B, + add(KnownOIDs.c2tnb191v2, B, "800000000000000000000000000000000000000000000201", "401028774D7777C7B7666D1366EA432071274F89FF01E718", "0620048D28BCBD03B6249C99182B7C8CD19700C362C46A01", "3809B2B7CC1B28CC5A87926AAD83FD28789E81E2C9E3BF10", "17434386626D14F3DBF01760D9213A3E1CF37AEC437D668A", "20000000000000000000000050508CB89F652824E06B8173", - 4, nameSplitPattern); + 4); - add("X9.62 c2tnb191v3", "1.2.840.10045.3.0.7", B, + add(KnownOIDs.c2tnb191v3, B, "800000000000000000000000000000000000000000000201", "6C01074756099122221056911C77D77E77A777E7E7E77FCB", "71FE1AF926CF847989EFEF8DB459F66394D90F32AD3F15E8", "375D4CE24FDE434489DE8746E71786015009E66E38A926DD", "545A39176196575D985999366E6AD34CE0A77CD7127B06BE", "155555555555555555555555610C0B196812BFB6288A3EA3", - 6, nameSplitPattern); + 6); - add("X9.62 c2tnb239v1", "1.2.840.10045.3.0.11", B, + add(KnownOIDs.c2tnb239v1, B, "800000000000000000000000000000000000000000000000001000000001", "32010857077C5431123A46B808906756F543423E8D27877578125778AC76", "790408F2EEDAF392B012EDEFB3392F30F4327C0CA3F31FC383C422AA8C16", "57927098FA932E7C0A96D3FD5B706EF7E5F5C156E16B7E7C86038552E91D", "61D8EE5077C33FECF6F1A16B268DE469C3C7744EA9A971649FC7A9616305", "2000000000000000000000000000000F4D42FFE1492A4993F1CAD666E447", - 4, nameSplitPattern); + 4); - add("X9.62 c2tnb239v2", "1.2.840.10045.3.0.12", B, + add(KnownOIDs.c2tnb239v2, B, "800000000000000000000000000000000000000000000000001000000001", "4230017757A767FAE42398569B746325D45313AF0766266479B75654E65F", "5037EA654196CFF0CD82B2C14A2FCF2E3FF8775285B545722F03EACDB74B", "28F9D04E900069C8DC47A08534FE76D2B900B7D7EF31F5709F200C4CA205", "5667334C45AFF3B5A03BAD9DD75E2C71A99362567D5453F7FA6E227EC833", "1555555555555555555555555555553C6F2885259C31E3FCDF154624522D", - 6, nameSplitPattern); + 6); - add("X9.62 c2tnb239v3", "1.2.840.10045.3.0.13", B, + add(KnownOIDs.c2tnb239v3, B, "800000000000000000000000000000000000000000000000001000000001", "01238774666A67766D6676F778E676B66999176666E687666D8766C66A9F", "6A941977BA9F6A435199ACFC51067ED587F519C5ECB541B8E44111DE1D40", "70F6E9D04D289C4E89913CE3530BFDE903977D42B146D539BF1BDE4E9C92", "2E5A0EAF6E5E1305B9004DCE5C0ED7FE59A35608F33837C816D80B79F461", "0CCCCCCCCCCCCCCCCCCCCCCCCCCCCCAC4912D2D9DF903EF9888B8A0E4CFF", - 0xA, nameSplitPattern); + 0xA); - add("X9.62 c2tnb359v1", "1.2.840.10045.3.0.18", B, + add(KnownOIDs.c2tnb359v1, B, "800000000000000000000000000000000000000000000000000000000000000000000000100000000000000001", "5667676A654B20754F356EA92017D946567C46675556F19556A04616B567D223A5E05656FB549016A96656A557", "2472E2D0197C49363F1FE7F5B6DB075D52B6947D135D8CA445805D39BC345626089687742B6329E70680231988", "3C258EF3047767E7EDE0F1FDAA79DAEE3841366A132E163ACED4ED2401DF9C6BDCDE98E8E707C07A2239B1B097", "53D7E08529547048121E9C95F3791DD804963948F34FAE7BF44EA82365DC7868FE57E4AE2DE211305A407104BD", "01AF286BCA1AF286BCA1AF286BCA1AF286BCA1AF286BC9FB8F6B85C556892C20A7EB964FE7719E74F490758D3B", - 0x4C, nameSplitPattern); + 0x4C); - add("X9.62 c2tnb431r1", "1.2.840.10045.3.0.20", B, + add(KnownOIDs.c2tnb431r1, B, "800000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000001", "1A827EF00DD6FC0E234CAF046C6A5D8A85395B236CC4AD2CF32A0CADBDC9DDF620B0EB9906D0957F6C6FEACD615468DF104DE296CD8F", "10D9B4A3D9047D8B154359ABFB1B7F5485B04CEB868237DDC9DEDA982A679A5A919B626D4E50A8DD731B107A9962381FB5D807BF2618", "120FC05D3C67A99DE161D2F4092622FECA701BE4F50F4758714E8A87BBF2A658EF8C21E7C5EFE965361F6C2999C0C247B0DBD70CE6B7", "20D0AF8903A96F8D5FA2C255745D3C451B302C9346D9B7E485E7BCE41F6B591F3E8F6ADDCBB0BC4C2F947A7DE1A89B625D6A598B3760", "0340340340340340340340340340340340340340340340340340340323C313FAB50589703B5EC68D3587FEC60D161CC149C1AD4A91", - 0x2760, nameSplitPattern); + 0x2760); /* ANSI X9.62 binary curves from the 1998 standard but forbidden * in the 2005 version of the standard. @@ -599,77 +575,77 @@ * case we need to support them after all. */ /* - add("X9.62 c2pnb163v1", "1.2.840.10045.3.0.1", B, + add(KnownOIDs.c2pnb163v1, B, "080000000000000000000000000000000000000107", "072546B5435234A422E0789675F432C89435DE5242", "00C9517D06D5240D3CFF38C74B20B6CD4D6F9DD4D9", "07AF69989546103D79329FCC3D74880F33BBE803CB", "01EC23211B5966ADEA1D3F87F7EA5848AEF0B7CA9F", "0400000000000000000001E60FC8821CC74DAEAFC1", - 2, nameSplitPattern); + 2); - add("X9.62 c2pnb163v2", "1.2.840.10045.3.0.2", B, + add(KnownOIDs.c2pnb163v2, B, "080000000000000000000000000000000000000107", "0108B39E77C4B108BED981ED0E890E117C511CF072", "0667ACEB38AF4E488C407433FFAE4F1C811638DF20", "0024266E4EB5106D0A964D92C4860E2671DB9B6CC5", "079F684DDF6684C5CD258B3890021B2386DFD19FC5", "03FFFFFFFFFFFFFFFFFFFDF64DE1151ADBB78F10A7", - 2, nameSplitPattern); + 2); - add("X9.62 c2pnb163v3", "1.2.840.10045.3.0.3", B, + add(KnownOIDs.c2pnb163v3, B, "080000000000000000000000000000000000000107", "07A526C63D3E25A256A007699F5447E32AE456B50E", "03F7061798EB99E238FD6F1BF95B48FEEB4854252B", "02F9F87B7C574D0BDECF8A22E6524775F98CDEBDCB", "05B935590C155E17EA48EB3FF3718B893DF59A05D0", "03FFFFFFFFFFFFFFFFFFFE1AEE140F110AFF961309", - 2, nameSplitPattern); + 2); - add("X9.62 c2pnb176w1", "1.2.840.10045.3.0.4", B, + add(KnownOIDs.c2pnb176w1, B, "0100000000000000000000000000000000080000000007", "E4E6DB2995065C407D9D39B8D0967B96704BA8E9C90B", "5DDA470ABE6414DE8EC133AE28E9BBD7FCEC0AE0FFF2", "8D16C2866798B600F9F08BB4A8E860F3298CE04A5798", "6FA4539C2DADDDD6BAB5167D61B436E1D92BB16A562C", "00010092537397ECA4F6145799D62B0A19CE06FE26AD", - 0xFF6E, nameSplitPattern); + 0xFF6E); - add("X9.62 c2pnb208w1", "1.2.840.10045.3.0.10", B, + add(KnownOIDs.c2pnb208w1, B, "010000000000000000000000000000000800000000000000000007", "0000000000000000000000000000000000000000000000000000", "C8619ED45A62E6212E1160349E2BFA844439FAFC2A3FD1638F9E", "89FDFBE4ABE193DF9559ECF07AC0CE78554E2784EB8C1ED1A57A", "0F55B51A06E78E9AC38A035FF520D8B01781BEB1A6BB08617DE3", "000101BAF95C9723C57B6C21DA2EFF2D5ED588BDD5717E212F9D", - 0xFE48, nameSplitPattern); + 0xFE48); - add("X9.62 c2pnb272w1", "1.2.840.10045.3.0.16", B, + add(KnownOIDs.c2pnb272w1, B, "010000000000000000000000000000000000000000000000000000010000000000000B", "91A091F03B5FBA4AB2CCF49C4EDD220FB028712D42BE752B2C40094DBACDB586FB20", "7167EFC92BB2E3CE7C8AAAFF34E12A9C557003D7C73A6FAF003F99F6CC8482E540F7", "6108BABB2CEEBCF787058A056CBE0CFE622D7723A289E08A07AE13EF0D10D171DD8D", "10C7695716851EEF6BA7F6872E6142FBD241B830FF5EFCACECCAB05E02005DDE9D23", "000100FAF51354E0E39E4892DF6E319C72C8161603FA45AA7B998A167B8F1E629521", - 0xFF06, nameSplitPattern); + 0xFF06); - add("X9.62 c2pnb304w1", "1.2.840.10045.3.0.17", B, + add(KnownOIDs.c2pnb304w1, B, "010000000000000000000000000000000000000000000000000000000000000000000000000807", "FD0D693149A118F651E6DCE6802085377E5F882D1B510B44160074C1288078365A0396C8E681", "BDDB97E555A50A908E43B01C798EA5DAA6788F1EA2794EFCF57166B8C14039601E55827340BE", "197B07845E9BE2D96ADB0F5F3C7F2CFFBD7A3EB8B6FEC35C7FD67F26DDF6285A644F740A2614", "E19FBEB76E0DA171517ECF401B50289BF014103288527A9B416A105E80260B549FDC1B92C03B", "000101D556572AABAC800101D556572AABAC8001022D5C91DD173F8FB561DA6899164443051D", - 0xFE2E, nameSplitPattern); + 0xFE2E); - add("X9.62 c2pnb368w1", "1.2.840.10045.3.0.19", B, + add(KnownOIDs.c2pnb368w1, B, "0100000000000000000000000000000000000000000000000000000000000000000000002000000000000000000007", "E0D2EE25095206F5E2A4F9ED229F1F256E79A0E2B455970D8D0D865BD94778C576D62F0AB7519CCD2A1A906AE30D", "FC1217D4320A90452C760A58EDCD30C8DD069B3C34453837A34ED50CB54917E1C2112D84D164F444F8F74786046A", "1085E2755381DCCCE3C1557AFA10C2F0C0C2825646C5B34A394CBCFA8BC16B22E7E789E927BE216F02E1FB136A5F", "7B3EB1BDDCBA62D5D8B2059B525797FC73822C59059C623A45FF3843CEE8F87CD1855ADAA81E2A0750B80FDA2310", "00010090512DA9AF72B08349D98A5DD4C7B0532ECA51CE03E2D10F3B7AC579BD87E909AE40A6F131E9CFCE5BD967", - 0xFF70, nameSplitPattern); + 0xFF70); */ /* @@ -677,68 +653,68 @@ * (Twisted curves are not included) */ - add("brainpoolP160r1", "1.3.36.3.3.2.8.1.1.1", P, + add(KnownOIDs.brainpoolP160r1, P, "E95E4A5F737059DC60DFC7AD95B3D8139515620F", "340E7BE2A280EB74E2BE61BADA745D97E8F7C300", "1E589A8595423412134FAA2DBDEC95C8D8675E58", "BED5AF16EA3F6A4F62938C4631EB5AF7BDBCDBC3", "1667CB477A1A8EC338F94741669C976316DA6321", "E95E4A5F737059DC60DF5991D45029409E60FC09", - 1, nameSplitPattern); + 1); - add("brainpoolP192r1", "1.3.36.3.3.2.8.1.1.3", P, + add(KnownOIDs.brainpoolP192r1, P, "C302F41D932A36CDA7A3463093D18DB78FCE476DE1A86297", "6A91174076B1E0E19C39C031FE8685C1CAE040E5C69A28EF", "469A28EF7C28CCA3DC721D044F4496BCCA7EF4146FBF25C9", "C0A0647EAAB6A48753B033C56CB0F0900A2F5C4853375FD6", "14B690866ABD5BB88B5F4828C1490002E6773FA2FA299B8F", "C302F41D932A36CDA7A3462F9E9E916B5BE8F1029AC4ACC1", - 1, nameSplitPattern); + 1); - add("brainpoolP224r1", "1.3.36.3.3.2.8.1.1.5", P, + add(KnownOIDs.brainpoolP224r1, P, "D7C134AA264366862A18302575D1D787B09F075797DA89F57EC8C0FF", "68A5E62CA9CE6C1C299803A6C1530B514E182AD8B0042A59CAD29F43", "2580F63CCFE44138870713B1A92369E33E2135D266DBB372386C400B", "0D9029AD2C7E5CF4340823B2A87DC68C9E4CE3174C1E6EFDEE12C07D", "58AA56F772C0726F24C6B89E4ECDAC24354B9E99CAA3F6D3761402CD", "D7C134AA264366862A18302575D0FB98D116BC4B6DDEBCA3A5A7939F", - 1, nameSplitPattern); + 1); - add("brainpoolP256r1", "1.3.36.3.3.2.8.1.1.7", P, + add(KnownOIDs.brainpoolP256r1, P, "A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", "7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", "26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", "8BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262", "547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", "A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7", - 1, nameSplitPattern); + 1); - add("brainpoolP320r1", "1.3.36.3.3.2.8.1.1.9", P, + add(KnownOIDs.brainpoolP320r1, P, "D35E472036BC4FB7E13C785ED201E065F98FCFA6F6F40DEF4F92B9EC7893EC28FCD412B1F1B32E27", "3EE30B568FBAB0F883CCEBD46D3F3BB8A2A73513F5EB79DA66190EB085FFA9F492F375A97D860EB4", "520883949DFDBC42D3AD198640688A6FE13F41349554B49ACC31DCCD884539816F5EB4AC8FB1F1A6", "43BD7E9AFB53D8B85289BCC48EE5BFE6F20137D10A087EB6E7871E2A10A599C710AF8D0D39E20611", "14FDD05545EC1CC8AB4093247F77275E0743FFED117182EAA9C77877AAAC6AC7D35245D1692E8EE1", "D35E472036BC4FB7E13C785ED201E065F98FCFA5B68F12A32D482EC7EE8658E98691555B44C59311", - 1, nameSplitPattern); + 1); - add("brainpoolP384r1", "1.3.36.3.3.2.8.1.1.11", P, + add(KnownOIDs.brainpoolP384r1, P, "8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B412B1DA197FB71123ACD3A729901D1A71874700133107EC53", "7BC382C63D8C150C3C72080ACE05AFA0C2BEA28E4FB22787139165EFBA91F90F8AA5814A503AD4EB04A8C7DD22CE2826", "04A8C7DD22CE28268B39B55416F0447C2FB77DE107DCD2A62E880EA53EEB62D57CB4390295DBC9943AB78696FA504C11", "1D1C64F068CF45FFA2A63A81B7C13F6B8847A3E77EF14FE3DB7FCAFE0CBD10E8E826E03436D646AAEF87B2E247D4AF1E", "8ABE1D7520F9C2A45CB1EB8E95CFD55262B70B29FEEC5864E19C054FF99129280E4646217791811142820341263C5315", "8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B31F166E6CAC0425A7CF3AB6AF6B7FC3103B883202E9046565", - 1, nameSplitPattern); + 1); - add("brainpoolP512r1", "1.3.36.3.3.2.8.1.1.13", P, + add(KnownOIDs.brainpoolP512r1, P, "AADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA703308717D4D9B009BC66842AECDA12AE6A380E62881FF2F2D82C68528AA6056583A48F3", "7830A3318B603B89E2327145AC234CC594CBDD8D3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CA", "3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CADC083E67984050B75EBAE5DD2809BD638016F723", "81AEE4BDD82ED9645A21322E9C4C6A9385ED9F70B5D916C1B43B62EEF4D0098EFF3B1F78E2D0D48D50D1687B93B97D5F7C6D5047406A5E688B352209BCB9F822", "7DDE385D566332ECC0EABFA9CF7822FDF209F70024A57B1AA000C55B881F8111B2DCDE494A5F485E5BCA4BD88A2763AED1CA2B2FA8F0540678CD1E0F3AD80892", "AADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA70330870553E5C414CA92619418661197FAC10471DB1D381085DDADDB58796829CA90069", - 1, nameSplitPattern); + 1); specCollection = Collections.unmodifiableCollection(oidMap.values()); } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/util/DisabledAlgorithmConstraints.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/DisabledAlgorithmConstraints.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/util/DisabledAlgorithmConstraints.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/DisabledAlgorithmConstraints.java 2023-10-06 05:33:33.000000000 +0000 @@ -261,7 +261,7 @@ if (key instanceof ECKey) { NamedCurve nc = CurveDB.lookup(((ECKey)key).getParams()); return (nc == null ? List.of() - : Arrays.asList(CurveDB.getNamesByOID(nc.getObjectId()))); + : Arrays.asList(nc.getNameAndAliases())); } else if (key instanceof XECKey) { return List.of( ((NamedParameterSpec)((XECKey)key).getParams()).getName()); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/util/KnownOIDs.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/KnownOIDs.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/util/KnownOIDs.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/KnownOIDs.java 2023-10-06 05:33:33.000000000 +0000 @@ -356,6 +356,11 @@ boolean registerNames() { return false; } }, + OIW_SHA1withRSA_Odd("1.3.14.3.2.15", "SHA1withRSA") { + @Override + boolean registerNames() { return false; } + }, + SHA_1("1.3.14.3.2.26", "SHA-1", "SHA", "SHA1"), OIW_SHA1withDSA("1.3.14.3.2.27", "SHA1withDSA") { diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/util/NamedCurve.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/NamedCurve.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/util/NamedCurve.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/NamedCurve.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2006, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2006, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -29,7 +29,7 @@ import java.math.BigInteger; import java.security.spec.*; - +import java.util.Arrays; /** * Contains Elliptic Curve parameters. @@ -39,8 +39,8 @@ */ public final class NamedCurve extends ECParameterSpec { - // friendly name for toString() output - private final String name; + // friendly names with stdName followed by aliases + private final String[] nameAndAliases; // well known OID private final String oid; @@ -48,25 +48,28 @@ // encoded form (as NamedCurve identified via OID) private final byte[] encoded; - NamedCurve(String name, String oid, EllipticCurve curve, + NamedCurve(KnownOIDs ko, EllipticCurve curve, ECPoint g, BigInteger n, int h) { super(curve, g, n, h); - this.name = name; - this.oid = oid; + String[] aliases = ko.aliases(); + this.nameAndAliases = new String[aliases.length + 1]; + nameAndAliases[0] = ko.stdName(); + System.arraycopy(aliases, 0, nameAndAliases, 1, aliases.length); - DerOutputStream out = new DerOutputStream(); + this.oid = ko.value(); + DerOutputStream out = new DerOutputStream(); try { - out.putOID(new ObjectIdentifier(oid)); + out.putOID(ObjectIdentifier.of(ko)); } catch (IOException e) { throw new RuntimeException("Internal error", e); } - encoded = out.toByteArray(); } - public String getName() { - return name; + // returns the curve's standard name followed by its aliases + public String[] getNameAndAliases() { + return nameAndAliases; } public byte[] getEncoded() { @@ -78,6 +81,17 @@ } public String toString() { - return name + " (" + oid + ")"; + StringBuilder sb = new StringBuilder(nameAndAliases[0]); + if (nameAndAliases.length > 1) { + sb.append(" ["); + int j = 1; + while (j < nameAndAliases.length - 1) { + sb.append(nameAndAliases[j++]); + sb.append(','); + } + sb.append(nameAndAliases[j] + "]"); + } + sb.append(" (" + oid + ")"); + return sb.toString(); } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/util/ObjectIdentifier.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/ObjectIdentifier.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/util/ObjectIdentifier.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/ObjectIdentifier.java 2023-10-06 05:33:33.000000000 +0000 @@ -51,9 +51,7 @@ * @author Hemma Prafullchandra */ -public final -class ObjectIdentifier implements Serializable -{ +public final class ObjectIdentifier implements Serializable { /* * The maximum encoded OID length, excluding the ASN.1 encoding tag and * length. @@ -73,7 +71,6 @@ */ private static final int MAXIMUM_OID_SIZE = 4096; // 2^12 - /** * We use the DER value (no tag, no length) as the internal format * @serial @@ -119,6 +116,7 @@ * @serial */ private Object components = null; // path from root + /** * @serial */ @@ -163,15 +161,15 @@ static class HugeOidNotSupportedByOldJDK implements Serializable { private static final long serialVersionUID = 1L; - static HugeOidNotSupportedByOldJDK theOne = new HugeOidNotSupportedByOldJDK(); + static HugeOidNotSupportedByOldJDK theOne = + new HugeOidNotSupportedByOldJDK(); } /** * Constructs, from a string. This string should be of the form 1.23.56. * Validity check included. */ - public ObjectIdentifier (String oid) throws IOException - { + private ObjectIdentifier(String oid) throws IOException { int ch = '.'; int start = 0; int end = 0; @@ -267,8 +265,7 @@ * @param in DER-encoded data holding an object ID * @exception IOException indicates a decoding error */ - public ObjectIdentifier (DerInputStream in) throws IOException - { + public ObjectIdentifier(DerInputStream in) throws IOException { byte type_id; int bufferEnd; @@ -281,7 +278,7 @@ * up so that we can use in.available() to check for the end of * this value in the data stream. */ - type_id = (byte) in.getByte (); + type_id = (byte)in.getByte(); if (type_id != DerValue.tag_ObjectId) throw new IOException ( "ObjectIdentifier() -- data isn't an object ID" @@ -306,8 +303,7 @@ * the tag and length have been removed/verified * Validity check NOT included. */ - ObjectIdentifier (DerInputBuffer buf) throws IOException - { + ObjectIdentifier(DerInputBuffer buf) throws IOException { DerInputStream in = new DerInputStream(buf); int len = in.available(); checkOidSize(len); @@ -361,6 +357,11 @@ private static ConcurrentHashMap oidTable = new ConcurrentHashMap<>(); + /** + * Returns an ObjectIdentifier instance for the specific String. + * + * If the String is not a valid OID string, an IOException is thrown. + */ public static ObjectIdentifier of(String oidStr) throws IOException { // check cache first ObjectIdentifier oid = oidTable.get(oidStr); @@ -393,8 +394,7 @@ /* * n.b. the only public interface is DerOutputStream.putOID() */ - void encode (DerOutputStream out) throws IOException - { + void encode(DerOutputStream out) throws IOException { out.write (DerValue.tag_ObjectId, encoding); } @@ -435,17 +435,21 @@ if ((encoding[i] & 0x80) == 0) { // one section [fromPos..i] if (i - fromPos + 1 > 4) { - BigInteger big = new BigInteger(1, pack(encoding, fromPos, i-fromPos+1, 7, 8)); + BigInteger big = new BigInteger(1, pack(encoding, + fromPos, i-fromPos+1, 7, 8)); if (fromPos == 0) { result[which++] = 2; - BigInteger second = big.subtract(BigInteger.valueOf(80)); - if (second.compareTo(BigInteger.valueOf(Integer.MAX_VALUE)) == 1) { + BigInteger second = + big.subtract(BigInteger.valueOf(80)); + if (second.compareTo( + BigInteger.valueOf(Integer.MAX_VALUE)) == 1) { return null; } else { result[which++] = second.intValue(); } } else { - if (big.compareTo(BigInteger.valueOf(Integer.MAX_VALUE)) == 1) { + if (big.compareTo( + BigInteger.valueOf(Integer.MAX_VALUE)) == 1) { return null; } else { result[which++] = big.intValue(); @@ -500,7 +504,8 @@ sb.append('.'); } if (i - fromPos + 1 > 4) { // maybe big integer - BigInteger big = new BigInteger(1, pack(encoding, fromPos, i-fromPos+1, 7, 8)); + BigInteger big = new BigInteger( + 1, pack(encoding, fromPos, i-fromPos+1, 7, 8)); if (fromPos == 0) { // first section encoded with more than 4 bytes, // must be 2.something @@ -541,7 +546,7 @@ /** * Repack all bits from input to output. On the both sides, only a portion * (from the least significant bit) of the 8 bits in a byte is used. This - * number is defined as the number of useful bits (NUB) for the array. All the + * number is defined as the number of useful bits (NUB) for the array. All * used bits from the input byte array and repacked into the output in the * exactly same order. The output bits are aligned so that the final bit of * the input (the least significant bit in the last byte), when repacked as @@ -563,7 +568,8 @@ * @param ow NUB for output * @return the repacked bytes */ - private static byte[] pack(byte[] in, int ioffset, int ilength, int iw, int ow) { + private static byte[] pack(byte[] in, + int ioffset, int ilength, int iw, int ow) { assert (iw > 0 && iw <= 8): "input NUB must be between 1 and 8"; assert (ow > 0 && ow <= 8): "output NUB must be between 1 and 8"; @@ -585,12 +591,13 @@ if (count > ow - opos%ow) { // free space available in output byte count = ow - opos%ow; // choose the smaller number } + // and move them! - out[opos/ow] |= // paste! - (((in[ioffset+ipos/iw]+256) // locate the byte (+256 so that it's never negative) - >> (iw-ipos%iw-count)) // move to the end of a byte - & ((1 << (count))-1)) // zero out all other bits - << (ow-opos%ow-count); // move to the output position + out[opos/ow] |= // paste! + (((in[ioffset+ipos/iw]+256) // locate the byte (+256 so that it's never negative) + >> (iw-ipos%iw-count)) & // move to the end of a byte + ((1 << (count))-1)) // zero out all other bits + << (ow-opos%ow-count); // move to the output position ipos += count; // advance opos += count; // advance } @@ -606,7 +613,8 @@ * @param ooffset the starting position to paste * @return the number of bytes pasted */ - private static int pack7Oid(byte[] in, int ioffset, int ilength, byte[] out, int ooffset) { + private static int pack7Oid(byte[] in, + int ioffset, int ilength, byte[] out, int ooffset) { byte[] pack = pack(in, ioffset, ilength, 8, 7); int firstNonZero = pack.length-1; // paste at least one byte for (int i=pack.length-2; i>=0; i--) { @@ -615,7 +623,8 @@ } pack[i] |= 0x80; } - System.arraycopy(pack, firstNonZero, out, ooffset, pack.length-firstNonZero); + System.arraycopy(pack, firstNonZero, + out, ooffset, pack.length-firstNonZero); return pack.length-firstNonZero; } @@ -626,7 +635,8 @@ * @param ooffset the starting position to paste * @return the number of bytes pasted */ - private static int pack8(byte[] in, int ioffset, int ilength, byte[] out, int ooffset) { + private static int pack8(byte[] in, + int ioffset, int ilength, byte[] out, int ooffset) { byte[] pack = pack(in, ioffset, ilength, 7, 8); int firstNonZero = pack.length-1; // paste at least one byte for (int i=pack.length-2; i>=0; i--) { @@ -634,7 +644,8 @@ firstNonZero = i; } } - System.arraycopy(pack, firstNonZero, out, ooffset, pack.length-firstNonZero); + System.arraycopy(pack, firstNonZero, + out, ooffset, pack.length-firstNonZero); return pack.length-firstNonZero; } @@ -686,31 +697,39 @@ } } } + private static void checkCount(int count) throws IOException { if (count < 2) { throw new IOException("ObjectIdentifier() -- " + "Must be at least two oid components "); } } + private static void checkFirstComponent(int first) throws IOException { if (first < 0 || first > 2) { throw new IOException("ObjectIdentifier() -- " + "First oid component is invalid "); } } - private static void checkFirstComponent(BigInteger first) throws IOException { + + private static void checkFirstComponent( + BigInteger first) throws IOException { if (first.signum() == -1 || first.compareTo(BigInteger.TWO) > 0) { throw new IOException("ObjectIdentifier() -- " + "First oid component is invalid "); } } - private static void checkSecondComponent(int first, int second) throws IOException { + + private static void checkSecondComponent( + int first, int second) throws IOException { if (second < 0 || first != 2 && second > 39) { throw new IOException("ObjectIdentifier() -- " + "Second oid component is invalid "); } } - private static void checkSecondComponent(int first, BigInteger second) throws IOException { + + private static void checkSecondComponent( + int first, BigInteger second) throws IOException { if (second.signum() == -1 || first != 2 && second.compareTo(BigInteger.valueOf(39)) == 1) { @@ -718,13 +737,16 @@ "Second oid component is invalid "); } } + private static void checkOtherComponent(int i, int num) throws IOException { if (num < 0) { throw new IOException("ObjectIdentifier() -- " + "oid component #" + (i+1) + " must be non-negative "); } } - private static void checkOtherComponent(int i, BigInteger num) throws IOException { + + private static void checkOtherComponent( + int i, BigInteger num) throws IOException { if (num.signum() == -1) { throw new IOException("ObjectIdentifier() -- " + "oid component #" + (i+1) + " must be non-negative "); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/util/SecurityProviderConstants.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/SecurityProviderConstants.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/util/SecurityProviderConstants.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/util/SecurityProviderConstants.java 2023-10-06 05:33:33.000000000 +0000 @@ -25,8 +25,11 @@ package sun.security.util; +import java.util.*; +import java.util.concurrent.ConcurrentHashMap; import java.util.regex.PatternSyntaxException; import java.security.InvalidParameterException; +import java.security.ProviderException; import javax.crypto.spec.DHParameterSpec; import sun.security.action.GetPropertyAction; @@ -35,11 +38,59 @@ * the JDK security/crypto providers. */ public final class SecurityProviderConstants { + // Cannot create one of these + private SecurityProviderConstants () {} + private static final Debug debug = Debug.getInstance("jca", "ProviderConfig"); - // Cannot create one of these - private SecurityProviderConstants () { + // cache for provider aliases; key is the standard algorithm name + // value is the associated aliases List + private static final ConcurrentHashMap> aliasesMap; + + // utility method for generating aliases list using the supplied + // 'oid' and 'extraAliases', then store into "aliasesMap" cache under the + // key 'stdName' + private static List store(String stdName, KnownOIDs oid, + String ... extraAliases) { + List value; + if (oid == null && extraAliases.length != 0) { + value = List.of(extraAliases); + } else { + value = new ArrayList<>(); + if (oid != null) { + value.add("OID." + oid.value()); + value.add(oid.value()); + String[] knownAliases = oid.aliases(); + if (knownAliases != null) { + for (String ka : knownAliases) { + value.add(ka); + } + } + } + for (String ea : extraAliases) { + value.add(ea); + } + } + aliasesMap.put(stdName, value); + return value; + } + + // returns an aliases List for the specified algorithm name o + // NOTE: exception is thrown if no aliases nor oid found, so + // only call this method if aliases are expected + public static List getAliases(String o) { + List res = aliasesMap.get(o); + if (res == null) { + KnownOIDs e = KnownOIDs.findMatch(o); + if (e != null) { + return store(o, e); + } + ProviderException pe = + new ProviderException("Cannot find aliases for " + o); + throw pe; + } + return res; } public static final int getDefDSASubprimeSize(int primeSize) { @@ -99,6 +150,7 @@ private static final String KEY_LENGTH_PROP = "jdk.security.defaultKeySize"; + static { String keyLengthStr = GetPropertyAction.privilegedGetProperty (KEY_LENGTH_PROP); @@ -169,5 +221,39 @@ DEF_RSASSA_PSS_KEY_SIZE = rsaSsaPssKeySize; DEF_DH_KEY_SIZE = dhKeySize; DEF_EC_KEY_SIZE = ecKeySize; + + // Set up aliases with default mappings + // This is needed when the mapping contains non-oid + // aliases + aliasesMap = new ConcurrentHashMap<>(); + + store("SHA1withDSA", KnownOIDs.SHA1withDSA, + KnownOIDs.OIW_JDK_SHA1withDSA.value(), + KnownOIDs.OIW_SHA1withDSA.value(), + "DSA", "SHA/DSA", "SHA-1/DSA", + "SHA1/DSA", "SHAwithDSA", "DSAWithSHA1"); + + store("DSA", KnownOIDs.DSA, KnownOIDs.OIW_DSA.value()); + + store("SHA1withRSA", KnownOIDs.SHA1withRSA, + KnownOIDs.OIW_SHA1withRSA.value()); + + store("SHA-1", KnownOIDs.SHA_1); + + store("PBEWithMD5AndDES", KnownOIDs.PBEWithMD5AndDES, "PBE"); + + store("DiffieHellman", KnownOIDs.DiffieHellman); + + store("AES", KnownOIDs.AES, "Rijndael"); + + store("EC", KnownOIDs.EC, "EllipticCurve"); + + store("X.509", null, "X509"); + store("NONEwithDSA", null, "RawDSA"); + store("DESede", null, "TripleDES"); + store("ARCFOUR", KnownOIDs.ARCFOUR); + // For backward compatility, refer to PKCS1 mapping for RSA + // KeyPairGenerator and KeyFactory + store("PKCS1", KnownOIDs.PKCS1, KnownOIDs.RSA.value()); } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/validator/EndEntityChecker.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/validator/EndEntityChecker.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/validator/EndEntityChecker.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/validator/EndEntityChecker.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2002, 2019, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2002, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -28,7 +28,7 @@ import java.util.*; import java.security.cert.*; - +import sun.security.util.KnownOIDs; import sun.security.x509.NetscapeCertTypeExtension; /** @@ -71,24 +71,32 @@ private static final String OID_EXTENDED_KEY_USAGE = SimpleValidator.OID_EXTENDED_KEY_USAGE; - private static final String OID_EKU_TLS_SERVER = "1.3.6.1.5.5.7.3.1"; + private static final String OID_EKU_TLS_SERVER = + KnownOIDs.serverAuth.value(); - private static final String OID_EKU_TLS_CLIENT = "1.3.6.1.5.5.7.3.2"; + private static final String OID_EKU_TLS_CLIENT = + KnownOIDs.clientAuth.value(); - private static final String OID_EKU_CODE_SIGNING = "1.3.6.1.5.5.7.3.3"; + private static final String OID_EKU_CODE_SIGNING = + KnownOIDs.codeSigning.value(); - private static final String OID_EKU_TIME_STAMPING = "1.3.6.1.5.5.7.3.8"; + private static final String OID_EKU_TIME_STAMPING = + KnownOIDs.KP_TimeStamping.value(); - private static final String OID_EKU_ANY_USAGE = "2.5.29.37.0"; + private static final String OID_EKU_ANY_USAGE = + KnownOIDs.anyExtendedKeyUsage.value(); // the Netscape Server-Gated-Cryptography EKU extension OID - private static final String OID_EKU_NS_SGC = "2.16.840.1.113730.4.1"; + private static final String OID_EKU_NS_SGC = + KnownOIDs.NETSCAPE_ExportApproved.value(); // the Microsoft Server-Gated-Cryptography EKU extension OID - private static final String OID_EKU_MS_SGC = "1.3.6.1.4.1.311.10.3.3"; + private static final String OID_EKU_MS_SGC = + KnownOIDs.MICROSOFT_ExportApproved.value(); // the recognized extension OIDs - private static final String OID_SUBJECT_ALT_NAME = "2.5.29.17"; + private static final String OID_SUBJECT_ALT_NAME = + KnownOIDs.SubjectAlternativeName.value(); private static final String NSCT_SSL_CLIENT = NetscapeCertTypeExtension.SSL_CLIENT; diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/validator/SimpleValidator.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/validator/SimpleValidator.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/validator/SimpleValidator.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/validator/SimpleValidator.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2002, 2017, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2002, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -39,6 +39,7 @@ import sun.security.util.DerValue; import sun.security.util.DerInputStream; import sun.security.util.ObjectIdentifier; +import sun.security.util.KnownOIDs; import sun.security.provider.certpath.AlgorithmChecker; import sun.security.provider.certpath.UntrustedChecker; @@ -60,24 +61,28 @@ // Constants for the OIDs we need - static final String OID_BASIC_CONSTRAINTS = "2.5.29.19"; + static final String OID_BASIC_CONSTRAINTS = + KnownOIDs.BasicConstraints.value(); - static final String OID_NETSCAPE_CERT_TYPE = "2.16.840.1.113730.1.1"; + static final String OID_NETSCAPE_CERT_TYPE = + KnownOIDs.NETSCAPE_CertType.value(); - static final String OID_KEY_USAGE = "2.5.29.15"; + static final String OID_KEY_USAGE = KnownOIDs.KeyUsage.value(); - static final String OID_EXTENDED_KEY_USAGE = "2.5.29.37"; + static final String OID_EXTENDED_KEY_USAGE = + KnownOIDs.extendedKeyUsage.value(); - static final String OID_EKU_ANY_USAGE = "2.5.29.37.0"; + static final String OID_EKU_ANY_USAGE = + KnownOIDs.anyExtendedKeyUsage.value(); static final ObjectIdentifier OBJID_NETSCAPE_CERT_TYPE = - NetscapeCertTypeExtension.NetscapeCertType_Id; + NetscapeCertTypeExtension.NetscapeCertType_Id; private static final String NSCT_SSL_CA = - NetscapeCertTypeExtension.SSL_CA; + NetscapeCertTypeExtension.SSL_CA; private static final String NSCT_CODE_SIGNING_CA = - NetscapeCertTypeExtension.OBJECT_SIGNING_CA; + NetscapeCertTypeExtension.OBJECT_SIGNING_CA; /** * The trusted certificates as: diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/AVA.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/AVA.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/AVA.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/AVA.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1996, 2015, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1996, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -1237,7 +1237,7 @@ return ak.oid; } } else { - return new ObjectIdentifier(oidString); + return ObjectIdentifier.of(oidString); } // no keyword found, check if OID string @@ -1255,7 +1255,7 @@ if (number == false) { throw new IOException("Invalid keyword \"" + keyword + "\""); } - return new ObjectIdentifier(keyword); + return ObjectIdentifier.of(keyword); } /** diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/AccessDescription.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/AccessDescription.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/AccessDescription.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/AccessDescription.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2003, 2015, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -42,16 +42,16 @@ private GeneralName accessLocation; public static final ObjectIdentifier Ad_OCSP_Id = - ObjectIdentifier.newInternal(new int[] {1, 3, 6, 1, 5, 5, 7, 48, 1}); + ObjectIdentifier.of(KnownOIDs.OCSP); public static final ObjectIdentifier Ad_CAISSUERS_Id = - ObjectIdentifier.newInternal(new int[] {1, 3, 6, 1, 5, 5, 7, 48, 2}); + ObjectIdentifier.of(KnownOIDs.caIssuers); public static final ObjectIdentifier Ad_TIMESTAMPING_Id = - ObjectIdentifier.newInternal(new int[] {1, 3, 6, 1, 5, 5, 7, 48, 3}); + ObjectIdentifier.of(KnownOIDs.AD_TimeStamping); public static final ObjectIdentifier Ad_CAREPOSITORY_Id = - ObjectIdentifier.newInternal(new int[] {1, 3, 6, 1, 5, 5, 7, 48, 5}); + ObjectIdentifier.of(KnownOIDs.caRepository); public AccessDescription(ObjectIdentifier accessMethod, GeneralName accessLocation) { this.accessMethod = accessMethod; diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/AlgorithmId.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/AlgorithmId.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/AlgorithmId.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/AlgorithmId.java 2023-10-06 05:33:33.000000000 +0000 @@ -31,6 +31,7 @@ import java.security.spec.MGF1ParameterSpec; import java.security.spec.PSSParameterSpec; import java.util.*; +import java.util.concurrent.ConcurrentHashMap; import java.security.*; import sun.security.rsa.PSSParameters; @@ -256,21 +257,31 @@ * returns the "full" signature algorithm (Ex: SHA256withECDSA) directly. */ public String getName() { - String algName = nameTable.get(algid); - if (algName != null) { - return algName; - } - if ((params != null) && algid.equals((Object)specifiedWithECDSA_oid)) { - try { - AlgorithmId paramsId = + String oidStr = algid.toString(); + // first check the list of support oids + KnownOIDs o = KnownOIDs.findMatch(oidStr); + if (o == KnownOIDs.SpecifiedSHA2withECDSA) { + if (params != null) { + try { + AlgorithmId paramsId = AlgorithmId.parse(new DerValue(encodedParams)); - String paramsName = paramsId.getName(); - algName = makeSigAlg(paramsName, "EC"); - } catch (IOException e) { - // ignore + String paramsName = paramsId.getName(); + return makeSigAlg(paramsName, "EC"); + } catch (IOException e) { + // ignore + } + } + } + if (o != null) { + return o.stdName(); + } else { + String n = aliasOidsTable().get(oidStr); + if (n != null) { + return n; + } else { + return algid.toString(); } } - return (algName == null) ? algid.toString() : algName; } public AlgorithmParameters getParameters() { @@ -292,7 +303,8 @@ * @return DER encoded parameters, or null not present. */ public byte[] getEncodedParams() throws IOException { - return (encodedParams == null || algid.equals(specifiedWithECDSA_oid)) + return (encodedParams == null || + algid.toString().equals(KnownOIDs.SpecifiedSHA2withECDSA.value())) ? null : encodedParams.clone(); } @@ -488,541 +500,142 @@ * used as a "KeyPairGenerator" algorithm. */ private static ObjectIdentifier algOID(String name) throws IOException { - // See if algname is in printable OID ("dot-dot") notation - if (name.indexOf('.') != -1) { - if (name.startsWith("OID.")) { - return new ObjectIdentifier(name.substring("OID.".length())); - } else { - return new ObjectIdentifier(name); - } - } - - // Digesting algorithms - if (name.equalsIgnoreCase("MD5")) { - return AlgorithmId.MD5_oid; - } - if (name.equalsIgnoreCase("MD2")) { - return AlgorithmId.MD2_oid; - } - if (name.equalsIgnoreCase("SHA") || name.equalsIgnoreCase("SHA1") - || name.equalsIgnoreCase("SHA-1")) { - return AlgorithmId.SHA_oid; - } - if (name.equalsIgnoreCase("SHA-256") || - name.equalsIgnoreCase("SHA256")) { - return AlgorithmId.SHA256_oid; - } - if (name.equalsIgnoreCase("SHA-384") || - name.equalsIgnoreCase("SHA384")) { - return AlgorithmId.SHA384_oid; - } - if (name.equalsIgnoreCase("SHA-512") || - name.equalsIgnoreCase("SHA512")) { - return AlgorithmId.SHA512_oid; - } - if (name.equalsIgnoreCase("SHA-224") || - name.equalsIgnoreCase("SHA224")) { - return AlgorithmId.SHA224_oid; - } - if (name.equalsIgnoreCase("SHA-512/224") || - name.equalsIgnoreCase("SHA512/224")) { - return AlgorithmId.SHA512_224_oid; - } - if (name.equalsIgnoreCase("SHA-512/256") || - name.equalsIgnoreCase("SHA512/256")) { - return AlgorithmId.SHA512_256_oid; - } - // Various public key algorithms - if (name.equalsIgnoreCase("RSA")) { - return AlgorithmId.RSAEncryption_oid; - } - if (name.equalsIgnoreCase("RSASSA-PSS")) { - return AlgorithmId.RSASSA_PSS_oid; - } - if (name.equalsIgnoreCase("RSAES-OAEP")) { - return AlgorithmId.RSAES_OAEP_oid; - } - if (name.equalsIgnoreCase("Diffie-Hellman") - || name.equalsIgnoreCase("DH")) { - return AlgorithmId.DH_oid; - } - if (name.equalsIgnoreCase("DSA")) { - return AlgorithmId.DSA_oid; - } - if (name.equalsIgnoreCase("EC")) { - return EC_oid; - } - if (name.equalsIgnoreCase("ECDH")) { - return AlgorithmId.ECDH_oid; - } - - // Secret key algorithms - if (name.equalsIgnoreCase("AES")) { - return AlgorithmId.AES_oid; + if (name.startsWith("OID.")) { + name = name.substring("OID.".length()); } - // Common signature types - if (name.equalsIgnoreCase("MD5withRSA") - || name.equalsIgnoreCase("MD5/RSA")) { - return AlgorithmId.md5WithRSAEncryption_oid; - } - if (name.equalsIgnoreCase("MD2withRSA") - || name.equalsIgnoreCase("MD2/RSA")) { - return AlgorithmId.md2WithRSAEncryption_oid; - } - if (name.equalsIgnoreCase("SHAwithDSA") - || name.equalsIgnoreCase("SHA1withDSA") - || name.equalsIgnoreCase("SHA/DSA") - || name.equalsIgnoreCase("SHA1/DSA") - || name.equalsIgnoreCase("DSAWithSHA1") - || name.equalsIgnoreCase("DSS") - || name.equalsIgnoreCase("SHA-1/DSA")) { - return AlgorithmId.sha1WithDSA_oid; - } - if (name.equalsIgnoreCase("SHA224WithDSA")) { - return AlgorithmId.sha224WithDSA_oid; - } - if (name.equalsIgnoreCase("SHA256WithDSA")) { - return AlgorithmId.sha256WithDSA_oid; - } - if (name.equalsIgnoreCase("SHA1WithRSA") - || name.equalsIgnoreCase("SHA1/RSA")) { - return AlgorithmId.sha1WithRSAEncryption_oid; - } - if (name.equalsIgnoreCase("SHA256WithRSA")) { - return AlgorithmId.sha256WithRSAEncryption_oid; - } - if (name.equalsIgnoreCase("SHA384WithRSA")) { - return AlgorithmId.sha384WithRSAEncryption_oid; - } - if (name.equalsIgnoreCase("SHA512WithRSA")) { - return AlgorithmId.sha512WithRSAEncryption_oid; - } - if (name.equalsIgnoreCase("SHA1withECDSA") - || name.equalsIgnoreCase("ECDSA")) { - return AlgorithmId.sha1WithECDSA_oid; - } - if (name.equalsIgnoreCase("SHA224withECDSA")) { - return AlgorithmId.sha224WithECDSA_oid; - } - if (name.equalsIgnoreCase("SHA256withECDSA")) { - return AlgorithmId.sha256WithECDSA_oid; - } - if (name.equalsIgnoreCase("SHA384withECDSA")) { - return AlgorithmId.sha384WithECDSA_oid; - } - if (name.equalsIgnoreCase("SHA512withECDSA")) { - return AlgorithmId.sha512WithECDSA_oid; + KnownOIDs k = KnownOIDs.findMatch(name); + if (k != null) { + return ObjectIdentifier.of(k); + } + + // unknown algorithm oids + if (name.indexOf(".") == -1) { + // see if there is a matching oid string alias mapping from + // 3rd party providers + name = name.toUpperCase(Locale.ENGLISH); + String oidStr = aliasOidsTable().get(name); + if (oidStr != null) { + return ObjectIdentifier.of(oidStr); + } return null; + } else { + return ObjectIdentifier.of(name); } - - return oidTable().get(name.toUpperCase(Locale.ENGLISH)); - } - - private static ObjectIdentifier oid(int ... values) { - return ObjectIdentifier.newInternal(values); } - private static volatile Map oidTable; - private static final Map nameTable; + // oid string cache index'ed by algorithm name and oid strings + private static volatile Map aliasOidsTable; - /** Returns the oidTable, lazily initializing it on first access. */ - private static Map oidTable() - throws IOException { - // Double checked locking; safe because oidTable is volatile - Map tab; - if ((tab = oidTable) == null) { + // returns the aliasOidsTable, lazily initializing it on first access. + private static Map aliasOidsTable() { + // Double checked locking; safe because aliasOidsTable is volatile + Map tab = aliasOidsTable; + if (tab == null) { synchronized (AlgorithmId.class) { - if ((tab = oidTable) == null) - oidTable = tab = computeOidTable(); + if ((tab = aliasOidsTable) == null) { + aliasOidsTable = tab = collectOIDAliases(); + } } } return tab; } - /** Collects the algorithm names from the installed providers. */ - private static HashMap computeOidTable() - throws IOException { - HashMap tab = new HashMap<>(); + private static boolean isKnownProvider(Provider p) { + String pn = p.getName(); + String mn = p.getClass().getModule().getName(); + if (pn != null && mn != null) { + return ((mn.equals("java.base") && + (pn.equals("SUN") || pn.equals("SunRsaSign") || + pn.equals("SunJCE") || pn.equals("SunJSSE"))) || + (mn.equals("jdk.crypto.ec") && pn.equals("SunEC")) || + (mn.equals("jdk.crypto.mscapi") && pn.equals("SunMSCAPI")) || + (mn.equals("jdk.crypto.cryptoki") && + pn.startsWith("SunPKCS11"))); + } else { + return false; + } + } + + private static ConcurrentHashMap collectOIDAliases() { + ConcurrentHashMap t = new ConcurrentHashMap<>(); for (Provider provider : Security.getProviders()) { + // skip providers which are already using SecurityProviderConstants + // and KnownOIDs + if (isKnownProvider(provider)) { + continue; + } for (Object key : provider.keySet()) { String alias = (String)key; String upperCaseAlias = alias.toUpperCase(Locale.ENGLISH); int index; if (upperCaseAlias.startsWith("ALG.ALIAS") && - (index=upperCaseAlias.indexOf("OID.", 0)) != -1) { + (index = upperCaseAlias.indexOf("OID.", 0)) != -1) { index += "OID.".length(); if (index == alias.length()) { // invalid alias entry break; } - String oidString = alias.substring(index); + String ostr = alias.substring(index); String stdAlgName = provider.getProperty(alias); if (stdAlgName != null) { stdAlgName = stdAlgName.toUpperCase(Locale.ENGLISH); } - if (stdAlgName != null && - tab.get(stdAlgName) == null) { - tab.put(stdAlgName, new ObjectIdentifier(oidString)); + // add the name->oid and oid->name mappings if none exists + if (KnownOIDs.findMatch(stdAlgName) == null) { + // not override earlier entries if it exists + t.putIfAbsent(stdAlgName, ostr); + } + if (KnownOIDs.findMatch(ostr) == null) { + // not override earlier entries if it exists + t.putIfAbsent(ostr, stdAlgName); } } } } - return tab; + return t; } - /*****************************************************************/ - - /* - * HASHING ALGORITHMS - */ - - /** - * Algorithm ID for the MD2 Message Digest Algorthm, from RFC 1319. - * OID = 1.2.840.113549.2.2 - */ public static final ObjectIdentifier MD2_oid = - ObjectIdentifier.newInternal(new int[] {1, 2, 840, 113549, 2, 2}); + ObjectIdentifier.of(KnownOIDs.MD2); - /** - * Algorithm ID for the MD5 Message Digest Algorthm, from RFC 1321. - * OID = 1.2.840.113549.2.5 - */ public static final ObjectIdentifier MD5_oid = - ObjectIdentifier.newInternal(new int[] {1, 2, 840, 113549, 2, 5}); + ObjectIdentifier.of(KnownOIDs.MD5); - /** - * Algorithm ID for the SHA1 Message Digest Algorithm, from FIPS 180-1. - * This is sometimes called "SHA", though that is often confusing since - * many people refer to FIPS 180 (which has an error) as defining SHA. - * OID = 1.3.14.3.2.26. Old SHA-0 OID: 1.3.14.3.2.18. - */ public static final ObjectIdentifier SHA_oid = - ObjectIdentifier.newInternal(new int[] {1, 3, 14, 3, 2, 26}); + ObjectIdentifier.of(KnownOIDs.SHA_1); public static final ObjectIdentifier SHA224_oid = - ObjectIdentifier.newInternal(new int[] {2, 16, 840, 1, 101, 3, 4, 2, 4}); + ObjectIdentifier.of(KnownOIDs.SHA_224); public static final ObjectIdentifier SHA256_oid = - ObjectIdentifier.newInternal(new int[] {2, 16, 840, 1, 101, 3, 4, 2, 1}); + ObjectIdentifier.of(KnownOIDs.SHA_256); public static final ObjectIdentifier SHA384_oid = - ObjectIdentifier.newInternal(new int[] {2, 16, 840, 1, 101, 3, 4, 2, 2}); + ObjectIdentifier.of(KnownOIDs.SHA_384); public static final ObjectIdentifier SHA512_oid = - ObjectIdentifier.newInternal(new int[] {2, 16, 840, 1, 101, 3, 4, 2, 3}); + ObjectIdentifier.of(KnownOIDs.SHA_512); public static final ObjectIdentifier SHA512_224_oid = - ObjectIdentifier.newInternal(new int[] {2, 16, 840, 1, 101, 3, 4, 2, 5}); + ObjectIdentifier.of(KnownOIDs.SHA_512$224); public static final ObjectIdentifier SHA512_256_oid = - ObjectIdentifier.newInternal(new int[] {2, 16, 840, 1, 101, 3, 4, 2, 6}); + ObjectIdentifier.of(KnownOIDs.SHA_512$256); - /* - * COMMON PUBLIC KEY TYPES - */ - private static final int[] DH_data = { 1, 2, 840, 113549, 1, 3, 1 }; - private static final int[] DH_PKIX_data = { 1, 2, 840, 10046, 2, 1 }; - private static final int[] DSA_OIW_data = { 1, 3, 14, 3, 2, 12 }; - private static final int[] DSA_PKIX_data = { 1, 2, 840, 10040, 4, 1 }; - private static final int[] RSA_data = { 2, 5, 8, 1, 1 }; - - public static final ObjectIdentifier DH_oid; - public static final ObjectIdentifier DH_PKIX_oid; - public static final ObjectIdentifier DSA_oid; - public static final ObjectIdentifier DSA_OIW_oid; - public static final ObjectIdentifier EC_oid = oid(1, 2, 840, 10045, 2, 1); - public static final ObjectIdentifier ECDH_oid = oid(1, 3, 132, 1, 12); - public static final ObjectIdentifier RSA_oid; - public static final ObjectIdentifier RSAEncryption_oid = - oid(1, 2, 840, 113549, 1, 1, 1); - public static final ObjectIdentifier RSAES_OAEP_oid = - oid(1, 2, 840, 113549, 1, 1, 7); - public static final ObjectIdentifier mgf1_oid = - oid(1, 2, 840, 113549, 1, 1, 8); - public static final ObjectIdentifier RSASSA_PSS_oid = - oid(1, 2, 840, 113549, 1, 1, 10); - - /* - * COMMON SECRET KEY TYPES - */ - public static final ObjectIdentifier AES_oid = - oid(2, 16, 840, 1, 101, 3, 4, 1); - - /* - * COMMON SIGNATURE ALGORITHMS - */ - private static final int[] md2WithRSAEncryption_data = - { 1, 2, 840, 113549, 1, 1, 2 }; - private static final int[] md5WithRSAEncryption_data = - { 1, 2, 840, 113549, 1, 1, 4 }; - private static final int[] sha1WithRSAEncryption_data = - { 1, 2, 840, 113549, 1, 1, 5 }; - private static final int[] sha1WithRSAEncryption_OIW_data = - { 1, 3, 14, 3, 2, 29 }; - private static final int[] sha224WithRSAEncryption_data = - { 1, 2, 840, 113549, 1, 1, 14 }; - private static final int[] sha256WithRSAEncryption_data = - { 1, 2, 840, 113549, 1, 1, 11 }; - private static final int[] sha384WithRSAEncryption_data = - { 1, 2, 840, 113549, 1, 1, 12 }; - private static final int[] sha512WithRSAEncryption_data = - { 1, 2, 840, 113549, 1, 1, 13 }; - - private static final int[] shaWithDSA_OIW_data = - { 1, 3, 14, 3, 2, 13 }; - private static final int[] sha1WithDSA_OIW_data = - { 1, 3, 14, 3, 2, 27 }; - private static final int[] dsaWithSHA1_PKIX_data = - { 1, 2, 840, 10040, 4, 3 }; - - public static final ObjectIdentifier md2WithRSAEncryption_oid; - public static final ObjectIdentifier md5WithRSAEncryption_oid; - public static final ObjectIdentifier sha1WithRSAEncryption_oid; - public static final ObjectIdentifier sha1WithRSAEncryption_OIW_oid; - public static final ObjectIdentifier sha224WithRSAEncryption_oid; - public static final ObjectIdentifier sha256WithRSAEncryption_oid; - public static final ObjectIdentifier sha384WithRSAEncryption_oid; - public static final ObjectIdentifier sha512WithRSAEncryption_oid; - public static final ObjectIdentifier sha512_224WithRSAEncryption_oid = - oid(1, 2, 840, 113549, 1, 1, 15); - public static final ObjectIdentifier sha512_256WithRSAEncryption_oid = - oid(1, 2, 840, 113549, 1, 1, 16);; - - public static final ObjectIdentifier shaWithDSA_OIW_oid; - public static final ObjectIdentifier sha1WithDSA_OIW_oid; - public static final ObjectIdentifier sha1WithDSA_oid; - public static final ObjectIdentifier sha224WithDSA_oid = - oid(2, 16, 840, 1, 101, 3, 4, 3, 1); - public static final ObjectIdentifier sha256WithDSA_oid = - oid(2, 16, 840, 1, 101, 3, 4, 3, 2); - - public static final ObjectIdentifier sha1WithECDSA_oid = - oid(1, 2, 840, 10045, 4, 1); - public static final ObjectIdentifier sha224WithECDSA_oid = - oid(1, 2, 840, 10045, 4, 3, 1); - public static final ObjectIdentifier sha256WithECDSA_oid = - oid(1, 2, 840, 10045, 4, 3, 2); - public static final ObjectIdentifier sha384WithECDSA_oid = - oid(1, 2, 840, 10045, 4, 3, 3); - public static final ObjectIdentifier sha512WithECDSA_oid = - oid(1, 2, 840, 10045, 4, 3, 4); - public static final ObjectIdentifier specifiedWithECDSA_oid = - oid(1, 2, 840, 10045, 4, 3); - - /** - * Algorithm ID for the PBE encryption algorithms from PKCS#5 and - * PKCS#12. - */ - public static final ObjectIdentifier pbeWithMD5AndDES_oid = - ObjectIdentifier.newInternal(new int[]{1, 2, 840, 113549, 1, 5, 3}); - public static final ObjectIdentifier pbeWithMD5AndRC2_oid = - ObjectIdentifier.newInternal(new int[] {1, 2, 840, 113549, 1, 5, 6}); - public static final ObjectIdentifier pbeWithSHA1AndDES_oid = - ObjectIdentifier.newInternal(new int[] {1, 2, 840, 113549, 1, 5, 10}); - public static final ObjectIdentifier pbeWithSHA1AndRC2_oid = - ObjectIdentifier.newInternal(new int[] {1, 2, 840, 113549, 1, 5, 11}); - public static ObjectIdentifier pbeWithSHA1AndRC4_128_oid = - ObjectIdentifier.newInternal(new int[] {1, 2, 840, 113549, 1, 12, 1, 1}); - public static ObjectIdentifier pbeWithSHA1AndRC4_40_oid = - ObjectIdentifier.newInternal(new int[] {1, 2, 840, 113549, 1, 12, 1, 2}); - public static ObjectIdentifier pbeWithSHA1AndDESede_oid = - ObjectIdentifier.newInternal(new int[] {1, 2, 840, 113549, 1, 12, 1, 3}); - public static ObjectIdentifier pbeWithSHA1AndRC2_128_oid = - ObjectIdentifier.newInternal(new int[] {1, 2, 840, 113549, 1, 12, 1, 5}); - public static ObjectIdentifier pbeWithSHA1AndRC2_40_oid = - ObjectIdentifier.newInternal(new int[] {1, 2, 840, 113549, 1, 12, 1, 6}); - - static { - /* - * Note the preferred OIDs are named simply with no "OIW" or - * "PKIX" in them, even though they may point to data from these - * specs; e.g. SHA_oid, DH_oid, DSA_oid, SHA1WithDSA_oid... - */ - /** - * Algorithm ID for Diffie Hellman Key agreement, from PKCS #3. - * Parameters include public values P and G, and may optionally specify - * the length of the private key X. Alternatively, algorithm parameters - * may be derived from another source such as a Certificate Authority's - * certificate. - * OID = 1.2.840.113549.1.3.1 - */ - DH_oid = ObjectIdentifier.newInternal(DH_data); - - /** - * Algorithm ID for the Diffie Hellman Key Agreement (DH), from RFC 3279. - * Parameters may include public values P and G. - * OID = 1.2.840.10046.2.1 - */ - DH_PKIX_oid = ObjectIdentifier.newInternal(DH_PKIX_data); - - /** - * Algorithm ID for the Digital Signing Algorithm (DSA), from the - * NIST OIW Stable Agreements part 12. - * Parameters may include public values P, Q, and G; or these may be - * derived from - * another source such as a Certificate Authority's certificate. - * OID = 1.3.14.3.2.12 - */ - DSA_OIW_oid = ObjectIdentifier.newInternal(DSA_OIW_data); - - /** - * Algorithm ID for the Digital Signing Algorithm (DSA), from RFC 3279. - * Parameters may include public values P, Q, and G; or these may be - * derived from another source such as a Certificate Authority's - * certificate. - * OID = 1.2.840.10040.4.1 - */ - DSA_oid = ObjectIdentifier.newInternal(DSA_PKIX_data); + public static final ObjectIdentifier DSA_oid = + ObjectIdentifier.of(KnownOIDs.DSA); - /** - * Algorithm ID for RSA keys used for any purpose, as defined in X.509. - * The algorithm parameter is a single value, the number of bits in the - * public modulus. - * OID = 2.5.8.1.1 - */ - RSA_oid = ObjectIdentifier.newInternal(RSA_data); - - /** - * Identifies a signing algorithm where an MD2 digest is encrypted - * using an RSA private key; defined in PKCS #1. Use of this - * signing algorithm is discouraged due to MD2 vulnerabilities. - * OID = 1.2.840.113549.1.1.2 - */ - md2WithRSAEncryption_oid = - ObjectIdentifier.newInternal(md2WithRSAEncryption_data); - - /** - * Identifies a signing algorithm where an MD5 digest is - * encrypted using an RSA private key; defined in PKCS #1. - * OID = 1.2.840.113549.1.1.4 - */ - md5WithRSAEncryption_oid = - ObjectIdentifier.newInternal(md5WithRSAEncryption_data); + public static final ObjectIdentifier EC_oid = + ObjectIdentifier.of(KnownOIDs.EC); - /** - * Identifies a signing algorithm where a SHA1 digest is - * encrypted using an RSA private key; defined by RSA DSI. - * OID = 1.2.840.113549.1.1.5 - */ - sha1WithRSAEncryption_oid = - ObjectIdentifier.newInternal(sha1WithRSAEncryption_data); - - /** - * Identifies a signing algorithm where a SHA1 digest is - * encrypted using an RSA private key; defined in NIST OIW. - * OID = 1.3.14.3.2.29 - */ - sha1WithRSAEncryption_OIW_oid = - ObjectIdentifier.newInternal(sha1WithRSAEncryption_OIW_data); - - /** - * Identifies a signing algorithm where a SHA224 digest is - * encrypted using an RSA private key; defined by PKCS #1. - * OID = 1.2.840.113549.1.1.14 - */ - sha224WithRSAEncryption_oid = - ObjectIdentifier.newInternal(sha224WithRSAEncryption_data); - - /** - * Identifies a signing algorithm where a SHA256 digest is - * encrypted using an RSA private key; defined by PKCS #1. - * OID = 1.2.840.113549.1.1.11 - */ - sha256WithRSAEncryption_oid = - ObjectIdentifier.newInternal(sha256WithRSAEncryption_data); - - /** - * Identifies a signing algorithm where a SHA384 digest is - * encrypted using an RSA private key; defined by PKCS #1. - * OID = 1.2.840.113549.1.1.12 - */ - sha384WithRSAEncryption_oid = - ObjectIdentifier.newInternal(sha384WithRSAEncryption_data); - - /** - * Identifies a signing algorithm where a SHA512 digest is - * encrypted using an RSA private key; defined by PKCS #1. - * OID = 1.2.840.113549.1.1.13 - */ - sha512WithRSAEncryption_oid = - ObjectIdentifier.newInternal(sha512WithRSAEncryption_data); - - /** - * Identifies the FIPS 186 "Digital Signature Standard" (DSS), where a - * SHA digest is signed using the Digital Signing Algorithm (DSA). - * This should not be used. - * OID = 1.3.14.3.2.13 - */ - shaWithDSA_OIW_oid = ObjectIdentifier.newInternal(shaWithDSA_OIW_data); - - /** - * Identifies the FIPS 186 "Digital Signature Standard" (DSS), where a - * SHA1 digest is signed using the Digital Signing Algorithm (DSA). - * OID = 1.3.14.3.2.27 - */ - sha1WithDSA_OIW_oid = ObjectIdentifier.newInternal(sha1WithDSA_OIW_data); - - /** - * Identifies the FIPS 186 "Digital Signature Standard" (DSS), where a - * SHA1 digest is signed using the Digital Signing Algorithm (DSA). - * OID = 1.2.840.10040.4.3 - */ - sha1WithDSA_oid = ObjectIdentifier.newInternal(dsaWithSHA1_PKIX_data); - - nameTable = new HashMap<>(); - nameTable.put(MD5_oid, "MD5"); - nameTable.put(MD2_oid, "MD2"); - nameTable.put(SHA_oid, "SHA-1"); - nameTable.put(SHA224_oid, "SHA-224"); - nameTable.put(SHA256_oid, "SHA-256"); - nameTable.put(SHA384_oid, "SHA-384"); - nameTable.put(SHA512_oid, "SHA-512"); - nameTable.put(SHA512_224_oid, "SHA-512/224"); - nameTable.put(SHA512_256_oid, "SHA-512/256"); - nameTable.put(RSAEncryption_oid, "RSA"); - nameTable.put(RSA_oid, "RSA"); - nameTable.put(DH_oid, "Diffie-Hellman"); - nameTable.put(DH_PKIX_oid, "Diffie-Hellman"); - nameTable.put(DSA_oid, "DSA"); - nameTable.put(DSA_OIW_oid, "DSA"); - nameTable.put(EC_oid, "EC"); - nameTable.put(ECDH_oid, "ECDH"); - - nameTable.put(AES_oid, "AES"); + public static final ObjectIdentifier RSAEncryption_oid = + ObjectIdentifier.of(KnownOIDs.RSA); - nameTable.put(sha1WithECDSA_oid, "SHA1withECDSA"); - nameTable.put(sha224WithECDSA_oid, "SHA224withECDSA"); - nameTable.put(sha256WithECDSA_oid, "SHA256withECDSA"); - nameTable.put(sha384WithECDSA_oid, "SHA384withECDSA"); - nameTable.put(sha512WithECDSA_oid, "SHA512withECDSA"); - nameTable.put(md5WithRSAEncryption_oid, "MD5withRSA"); - nameTable.put(md2WithRSAEncryption_oid, "MD2withRSA"); - nameTable.put(sha1WithDSA_oid, "SHA1withDSA"); - nameTable.put(sha1WithDSA_OIW_oid, "SHA1withDSA"); - nameTable.put(shaWithDSA_OIW_oid, "SHA1withDSA"); - nameTable.put(sha224WithDSA_oid, "SHA224withDSA"); - nameTable.put(sha256WithDSA_oid, "SHA256withDSA"); - nameTable.put(sha1WithRSAEncryption_oid, "SHA1withRSA"); - nameTable.put(sha1WithRSAEncryption_OIW_oid, "SHA1withRSA"); - nameTable.put(sha224WithRSAEncryption_oid, "SHA224withRSA"); - nameTable.put(sha256WithRSAEncryption_oid, "SHA256withRSA"); - nameTable.put(sha384WithRSAEncryption_oid, "SHA384withRSA"); - nameTable.put(sha512WithRSAEncryption_oid, "SHA512withRSA"); - nameTable.put(sha512_224WithRSAEncryption_oid, "SHA512/224withRSA"); - nameTable.put(sha512_256WithRSAEncryption_oid, "SHA512/256withRSA"); - nameTable.put(RSASSA_PSS_oid, "RSASSA-PSS"); - nameTable.put(RSAES_OAEP_oid, "RSAES-OAEP"); + public static final ObjectIdentifier RSASSA_PSS_oid = + ObjectIdentifier.of(KnownOIDs.RSASSA_PSS); - nameTable.put(pbeWithMD5AndDES_oid, "PBEWithMD5AndDES"); - nameTable.put(pbeWithMD5AndRC2_oid, "PBEWithMD5AndRC2"); - nameTable.put(pbeWithSHA1AndDES_oid, "PBEWithSHA1AndDES"); - nameTable.put(pbeWithSHA1AndRC2_oid, "PBEWithSHA1AndRC2"); - nameTable.put(pbeWithSHA1AndRC4_128_oid, "PBEWithSHA1AndRC4_128"); - nameTable.put(pbeWithSHA1AndRC4_40_oid, "PBEWithSHA1AndRC4_40"); - nameTable.put(pbeWithSHA1AndDESede_oid, "PBEWithSHA1AndDESede"); - nameTable.put(pbeWithSHA1AndRC2_128_oid, "PBEWithSHA1AndRC2_128"); - nameTable.put(pbeWithSHA1AndRC2_40_oid, "PBEWithSHA1AndRC2_40"); - } + public static final ObjectIdentifier MGF1_oid = + ObjectIdentifier.of(KnownOIDs.MGF1); /** * Creates a signature algorithm name from a digest algorithm diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/ExtendedKeyUsageExtension.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/ExtendedKeyUsageExtension.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/ExtendedKeyUsageExtension.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/ExtendedKeyUsageExtension.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -34,9 +34,7 @@ import java.util.Map; import java.util.Vector; -import sun.security.util.DerValue; -import sun.security.util.DerOutputStream; -import sun.security.util.ObjectIdentifier; +import sun.security.util.*; /** * This class defines the Extended Key Usage Extension, which @@ -94,35 +92,6 @@ public static final String NAME = "ExtendedKeyUsage"; public static final String USAGES = "usages"; - // OID defined in RFC 5280 Sections 4.2.1.12 - // more from http://www.alvestrand.no/objectid/1.3.6.1.5.5.7.3.html - private static final Map map = - new HashMap (); - - private static final int[] anyExtendedKeyUsageOidData = {2, 5, 29, 37, 0}; - private static final int[] serverAuthOidData = {1, 3, 6, 1, 5, 5, 7, 3, 1}; - private static final int[] clientAuthOidData = {1, 3, 6, 1, 5, 5, 7, 3, 2}; - private static final int[] codeSigningOidData = {1, 3, 6, 1, 5, 5, 7, 3, 3}; - private static final int[] emailProtectionOidData = {1, 3, 6, 1, 5, 5, 7, 3, 4}; - private static final int[] ipsecEndSystemOidData = {1, 3, 6, 1, 5, 5, 7, 3, 5}; - private static final int[] ipsecTunnelOidData = {1, 3, 6, 1, 5, 5, 7, 3, 6}; - private static final int[] ipsecUserOidData = {1, 3, 6, 1, 5, 5, 7, 3, 7}; - private static final int[] timeStampingOidData = {1, 3, 6, 1, 5, 5, 7, 3, 8}; - private static final int[] OCSPSigningOidData = {1, 3, 6, 1, 5, 5, 7, 3, 9}; - - static { - map.put(ObjectIdentifier.newInternal(anyExtendedKeyUsageOidData), "anyExtendedKeyUsage"); - map.put(ObjectIdentifier.newInternal(serverAuthOidData), "serverAuth"); - map.put(ObjectIdentifier.newInternal(clientAuthOidData), "clientAuth"); - map.put(ObjectIdentifier.newInternal(codeSigningOidData), "codeSigning"); - map.put(ObjectIdentifier.newInternal(emailProtectionOidData), "emailProtection"); - map.put(ObjectIdentifier.newInternal(ipsecEndSystemOidData), "ipsecEndSystem"); - map.put(ObjectIdentifier.newInternal(ipsecTunnelOidData), "ipsecTunnel"); - map.put(ObjectIdentifier.newInternal(ipsecUserOidData), "ipsecUser"); - map.put(ObjectIdentifier.newInternal(timeStampingOidData), "timeStamping"); - map.put(ObjectIdentifier.newInternal(OCSPSigningOidData), "OCSPSigning"); - }; - /** * Vector of KeyUsages for this object. */ @@ -209,11 +178,12 @@ usage += "\n "; } - String result = map.get(oid); - if (result != null) { - usage += result; + String res = oid.toString(); + KnownOIDs os = KnownOIDs.findMatch(res); + if (os != null) { + usage += os.stdName(); } else { - usage += oid.toString(); + usage += res; } first = false; } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/GeneralSubtrees.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/GeneralSubtrees.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/GeneralSubtrees.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/GeneralSubtrees.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 2003, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1997, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -270,8 +270,7 @@ newName = new GeneralName(new IPAddressName((byte[])null)); break; case GeneralNameInterface.NAME_OID: - newName = new GeneralName - (new OIDName(new ObjectIdentifier((int[])null))); + newName = new GeneralName(new OIDName("")); break; default: throw new IOException diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/InhibitAnyPolicyExtension.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/InhibitAnyPolicyExtension.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/InhibitAnyPolicyExtension.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/InhibitAnyPolicyExtension.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -29,10 +29,7 @@ import java.io.OutputStream; import java.util.Enumeration; -import sun.security.util.Debug; -import sun.security.util.DerOutputStream; -import sun.security.util.DerValue; -import sun.security.util.ObjectIdentifier; +import sun.security.util.*; /** * This class represents the Inhibit Any-Policy Extension. @@ -75,14 +72,8 @@ /** * Object identifier for "any-policy" */ - public static ObjectIdentifier AnyPolicy_Id; - static { - try { - AnyPolicy_Id = new ObjectIdentifier("2.5.29.32.0"); - } catch (IOException ioe) { - // Should not happen - } - } + public static ObjectIdentifier AnyPolicy_Id = + ObjectIdentifier.of(KnownOIDs.CE_CERT_POLICIES_ANY); /** * Attribute names. diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/NetscapeCertTypeExtension.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/NetscapeCertTypeExtension.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/NetscapeCertTypeExtension.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/NetscapeCertTypeExtension.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1998, 2015, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1998, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -69,20 +69,11 @@ public static final String S_MIME_CA = "s_mime_ca"; public static final String OBJECT_SIGNING_CA = "object_signing_ca"; - private static final int[] CertType_data = { 2, 16, 840, 1, 113730, 1, 1 }; - /** * Object identifier for the Netscape-Cert-Type extension. */ - public static ObjectIdentifier NetscapeCertType_Id; - - static { - try { - NetscapeCertType_Id = new ObjectIdentifier(CertType_data); - } catch (IOException ioe) { - // should not happen - } - } + public static ObjectIdentifier NetscapeCertType_Id = + ObjectIdentifier.of(KnownOIDs.NETSCAPE_CertType); private boolean[] bitString; diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/OIDMap.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/OIDMap.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/OIDMap.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/OIDMap.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 2011, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1997, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -102,9 +102,6 @@ private static final String OCSPNOCHECK = ROOT + "." + OCSPNoCheckExtension.NAME; - private static final int[] NetscapeCertType_data = - { 2, 16, 840, 1, 113730, 1, 1 }; - /** Map ObjectIdentifier(oid) -> OIDInfo(info) */ private static final Map oidMap; @@ -138,8 +135,8 @@ "sun.security.x509.AuthorityKeyIdentifierExtension"); addInternal(POLICY_CONSTRAINTS, PKIXExtensions.PolicyConstraints_Id, "sun.security.x509.PolicyConstraintsExtension"); - addInternal(NETSCAPE_CERT, ObjectIdentifier.newInternal - (new int[] {2,16,840,1,113730,1,1}), + addInternal(NETSCAPE_CERT, + ObjectIdentifier.of(KnownOIDs.NETSCAPE_CertType), "sun.security.x509.NetscapeCertTypeExtension"); addInternal(CERT_POLICIES, PKIXExtensions.CertificatePolicies_Id, "sun.security.x509.CertificatePoliciesExtension"); @@ -230,7 +227,7 @@ throws CertificateException { ObjectIdentifier objId; try { - objId = new ObjectIdentifier(oid); + objId = ObjectIdentifier.of(oid); } catch (IOException ioe) { throw new CertificateException ("Invalid Object identifier: " + oid); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/OIDName.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/OIDName.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/OIDName.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/OIDName.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 2015, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1997, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -69,7 +69,7 @@ */ public OIDName(String name) throws IOException { try { - oid = new ObjectIdentifier(name); + oid = ObjectIdentifier.of(name); } catch (Exception e) { throw new IOException("Unable to create OIDName: " + e); } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/PKIXExtensions.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/PKIXExtensions.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/PKIXExtensions.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/PKIXExtensions.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 2015, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1997, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -25,7 +25,6 @@ package sun.security.x509; -import java.io.*; import sun.security.util.*; @@ -48,163 +47,151 @@ * @author Hemma Prafullchandra */ public class PKIXExtensions { - // The object identifiers - private static final int[] AuthorityKey_data = { 2, 5, 29, 35 }; - private static final int[] SubjectKey_data = { 2, 5, 29, 14 }; - private static final int[] KeyUsage_data = { 2, 5, 29, 15 }; - private static final int[] PrivateKeyUsage_data = { 2, 5, 29, 16 }; - private static final int[] CertificatePolicies_data = { 2, 5, 29, 32 }; - private static final int[] PolicyMappings_data = { 2, 5, 29, 33 }; - private static final int[] SubjectAlternativeName_data = { 2, 5, 29, 17 }; - private static final int[] IssuerAlternativeName_data = { 2, 5, 29, 18 }; - private static final int[] SubjectDirectoryAttributes_data = { 2, 5, 29, 9 }; - private static final int[] BasicConstraints_data = { 2, 5, 29, 19 }; - private static final int[] NameConstraints_data = { 2, 5, 29, 30 }; - private static final int[] PolicyConstraints_data = { 2, 5, 29, 36 }; - private static final int[] CRLDistributionPoints_data = { 2, 5, 29, 31 }; - private static final int[] CRLNumber_data = { 2, 5, 29, 20 }; - private static final int[] IssuingDistributionPoint_data = { 2, 5, 29, 28 }; - private static final int[] DeltaCRLIndicator_data = { 2, 5, 29, 27 }; - private static final int[] ReasonCode_data = { 2, 5, 29, 21 }; - private static final int[] HoldInstructionCode_data = { 2, 5, 29, 23 }; - private static final int[] InvalidityDate_data = { 2, 5, 29, 24 }; - private static final int[] ExtendedKeyUsage_data = { 2, 5, 29, 37 }; - private static final int[] InhibitAnyPolicy_data = { 2, 5, 29, 54 }; - private static final int[] CertificateIssuer_data = { 2, 5, 29, 29 }; - private static final int[] AuthInfoAccess_data = { 1, 3, 6, 1, 5, 5, 7, 1, 1}; - private static final int[] SubjectInfoAccess_data = { 1, 3, 6, 1, 5, 5, 7, 1, 11}; - private static final int[] FreshestCRL_data = { 2, 5, 29, 46 }; - private static final int[] OCSPNoCheck_data = { 1, 3, 6, 1, 5, 5, 7, - 48, 1, 5}; - - // Additional extensions under the PKIX arc that are not necessarily - // used in X.509 Certificates or CRLs. - private static final int OCSPNonce_data [] = { 1, 3, 6, 1, 5, 5, 7, - 48, 1, 2}; - /** * Identifies the particular public key used to sign the certificate. */ - public static final ObjectIdentifier AuthorityKey_Id; + public static final ObjectIdentifier AuthorityKey_Id = + ObjectIdentifier.of(KnownOIDs.AuthorityKeyID); /** * Identifies the particular public key used in an application. */ - public static final ObjectIdentifier SubjectKey_Id; + public static final ObjectIdentifier SubjectKey_Id = + ObjectIdentifier.of(KnownOIDs.SubjectKeyID); /** * Defines the purpose of the key contained in the certificate. */ - public static final ObjectIdentifier KeyUsage_Id; + public static final ObjectIdentifier KeyUsage_Id = + ObjectIdentifier.of(KnownOIDs.KeyUsage); /** * Allows the certificate issuer to specify a different validity period * for the private key than the certificate. */ - public static final ObjectIdentifier PrivateKeyUsage_Id; + public static final ObjectIdentifier PrivateKeyUsage_Id = + ObjectIdentifier.of(KnownOIDs.PrivateKeyUsage); /** * Contains the sequence of policy information terms. */ - public static final ObjectIdentifier CertificatePolicies_Id; + public static final ObjectIdentifier CertificatePolicies_Id = + ObjectIdentifier.of(KnownOIDs.CertificatePolicies); /** * Lists pairs of object identifiers of policies considered equivalent by * the issuing CA to the subject CA. */ - public static final ObjectIdentifier PolicyMappings_Id; + public static final ObjectIdentifier PolicyMappings_Id = + ObjectIdentifier.of(KnownOIDs.PolicyMappings); /** * Allows additional identities to be bound to the subject of the * certificate. */ - public static final ObjectIdentifier SubjectAlternativeName_Id; + public static final ObjectIdentifier SubjectAlternativeName_Id = + ObjectIdentifier.of(KnownOIDs.SubjectAlternativeName); /** * Allows additional identities to be associated with the certificate * issuer. */ - public static final ObjectIdentifier IssuerAlternativeName_Id; + public static final ObjectIdentifier IssuerAlternativeName_Id = + ObjectIdentifier.of(KnownOIDs.IssuerAlternativeName); /** * Identifies additional directory attributes. * This extension is always non-critical. */ - public static final ObjectIdentifier SubjectDirectoryAttributes_Id; + public static final ObjectIdentifier SubjectDirectoryAttributes_Id = + ObjectIdentifier.of(KnownOIDs.SubjectDirectoryAttributes); /** * Identifies whether the subject of the certificate is a CA and how deep * a certification path may exist through that CA. */ - public static final ObjectIdentifier BasicConstraints_Id; + public static final ObjectIdentifier BasicConstraints_Id = + ObjectIdentifier.of(KnownOIDs.BasicConstraints); /** * Provides for permitted and excluded subtrees that place restrictions * on names that may be included within a certificate issued by a given CA. */ - public static final ObjectIdentifier NameConstraints_Id; + public static final ObjectIdentifier NameConstraints_Id = + ObjectIdentifier.of(KnownOIDs.NameConstraints); /** * Used to either prohibit policy mapping or limit the set of policies * that can be in subsequent certificates. */ - public static final ObjectIdentifier PolicyConstraints_Id; + public static final ObjectIdentifier PolicyConstraints_Id = + ObjectIdentifier.of(KnownOIDs.PolicyConstraints); /** * Identifies how CRL information is obtained. */ - public static final ObjectIdentifier CRLDistributionPoints_Id; + public static final ObjectIdentifier CRLDistributionPoints_Id = + ObjectIdentifier.of(KnownOIDs.CRLDistributionPoints); /** * Conveys a monotonically increasing sequence number for each CRL * issued by a given CA. */ - public static final ObjectIdentifier CRLNumber_Id; + public static final ObjectIdentifier CRLNumber_Id = + ObjectIdentifier.of(KnownOIDs.CRLNumber); /** * Identifies the CRL distribution point for a particular CRL. */ - public static final ObjectIdentifier IssuingDistributionPoint_Id; + public static final ObjectIdentifier IssuingDistributionPoint_Id = + ObjectIdentifier.of(KnownOIDs.IssuingDistributionPoint); /** * Identifies the delta CRL. */ - public static final ObjectIdentifier DeltaCRLIndicator_Id; + public static final ObjectIdentifier DeltaCRLIndicator_Id = + ObjectIdentifier.of(KnownOIDs.DeltaCRLIndicator); /** * Identifies the reason for the certificate revocation. */ - public static final ObjectIdentifier ReasonCode_Id; + public static final ObjectIdentifier ReasonCode_Id = + ObjectIdentifier.of(KnownOIDs.ReasonCode); /** * This extension provides a registered instruction identifier indicating * the action to be taken, after encountering a certificate that has been * placed on hold. */ - public static final ObjectIdentifier HoldInstructionCode_Id; + public static final ObjectIdentifier HoldInstructionCode_Id = + ObjectIdentifier.of(KnownOIDs.HoldInstructionCode); /** * Identifies the date on which it is known or suspected that the private * key was compromised or that the certificate otherwise became invalid. */ - public static final ObjectIdentifier InvalidityDate_Id; + public static final ObjectIdentifier InvalidityDate_Id = + ObjectIdentifier.of(KnownOIDs.InvalidityDate); /** * Identifies one or more purposes for which the certified public key * may be used, in addition to or in place of the basic purposes * indicated in the key usage extension field. */ - public static final ObjectIdentifier ExtendedKeyUsage_Id; + public static final ObjectIdentifier ExtendedKeyUsage_Id = + ObjectIdentifier.of(KnownOIDs.extendedKeyUsage); /** * Specifies whether any-policy policy OID is permitted */ - public static final ObjectIdentifier InhibitAnyPolicy_Id; + public static final ObjectIdentifier InhibitAnyPolicy_Id = + ObjectIdentifier.of(KnownOIDs.InhibitAnyPolicy); /** * Identifies the certificate issuer associated with an entry in an * indirect CRL. */ - public static final ObjectIdentifier CertificateIssuer_Id; + public static final ObjectIdentifier CertificateIssuer_Id = + ObjectIdentifier.of(KnownOIDs.CertificateIssuer); /** * This extension indicates how to access CA information and services for @@ -212,73 +199,33 @@ * This information may be used for on-line certification validation * services. */ - public static final ObjectIdentifier AuthInfoAccess_Id; + public static final ObjectIdentifier AuthInfoAccess_Id = + ObjectIdentifier.of(KnownOIDs.AuthInfoAccess); /** * This extension indicates how to access CA information and services for * the subject of the certificate in which the extension appears. */ - public static final ObjectIdentifier SubjectInfoAccess_Id; + public static final ObjectIdentifier SubjectInfoAccess_Id = + ObjectIdentifier.of(KnownOIDs.SubjectInfoAccess); /** * Identifies how delta CRL information is obtained. */ - public static final ObjectIdentifier FreshestCRL_Id; + public static final ObjectIdentifier FreshestCRL_Id = + ObjectIdentifier.of(KnownOIDs.FreshestCRL); /** * Identifies the OCSP client can trust the responder for the * lifetime of the responder's certificate. */ - public static final ObjectIdentifier OCSPNoCheck_Id; + public static final ObjectIdentifier OCSPNoCheck_Id = + ObjectIdentifier.of(KnownOIDs.OCSPNoCheck); /** * This extension is used to provide nonce data for OCSP requests * or responses. */ - public static final ObjectIdentifier OCSPNonce_Id; - - static { - AuthorityKey_Id = ObjectIdentifier.newInternal(AuthorityKey_data); - SubjectKey_Id = ObjectIdentifier.newInternal(SubjectKey_data); - KeyUsage_Id = ObjectIdentifier.newInternal(KeyUsage_data); - PrivateKeyUsage_Id = ObjectIdentifier.newInternal(PrivateKeyUsage_data); - CertificatePolicies_Id = - ObjectIdentifier.newInternal(CertificatePolicies_data); - PolicyMappings_Id = ObjectIdentifier.newInternal(PolicyMappings_data); - SubjectAlternativeName_Id = - ObjectIdentifier.newInternal(SubjectAlternativeName_data); - IssuerAlternativeName_Id = - ObjectIdentifier.newInternal(IssuerAlternativeName_data); - ExtendedKeyUsage_Id = ObjectIdentifier.newInternal(ExtendedKeyUsage_data); - InhibitAnyPolicy_Id = ObjectIdentifier.newInternal(InhibitAnyPolicy_data); - SubjectDirectoryAttributes_Id = - ObjectIdentifier.newInternal(SubjectDirectoryAttributes_data); - BasicConstraints_Id = - ObjectIdentifier.newInternal(BasicConstraints_data); - ReasonCode_Id = ObjectIdentifier.newInternal(ReasonCode_data); - HoldInstructionCode_Id = - ObjectIdentifier.newInternal(HoldInstructionCode_data); - InvalidityDate_Id = ObjectIdentifier.newInternal(InvalidityDate_data); - - NameConstraints_Id = ObjectIdentifier.newInternal(NameConstraints_data); - PolicyConstraints_Id = - ObjectIdentifier.newInternal(PolicyConstraints_data); - CRLDistributionPoints_Id = - ObjectIdentifier.newInternal(CRLDistributionPoints_data); - CRLNumber_Id = - ObjectIdentifier.newInternal(CRLNumber_data); - IssuingDistributionPoint_Id = - ObjectIdentifier.newInternal(IssuingDistributionPoint_data); - DeltaCRLIndicator_Id = - ObjectIdentifier.newInternal(DeltaCRLIndicator_data); - CertificateIssuer_Id = - ObjectIdentifier.newInternal(CertificateIssuer_data); - AuthInfoAccess_Id = - ObjectIdentifier.newInternal(AuthInfoAccess_data); - SubjectInfoAccess_Id = - ObjectIdentifier.newInternal(SubjectInfoAccess_data); - FreshestCRL_Id = ObjectIdentifier.newInternal(FreshestCRL_data); - OCSPNoCheck_Id = ObjectIdentifier.newInternal(OCSPNoCheck_data); - OCSPNonce_Id = ObjectIdentifier.newInternal(OCSPNonce_data); - } + public static final ObjectIdentifier OCSPNonce_Id = + ObjectIdentifier.of(KnownOIDs.OCSPNonceExt); } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/X500Name.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/X500Name.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/X500Name.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/X500Name.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1996, 2019, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1996, 2020, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -1102,104 +1102,83 @@ * Includes all those specified in RFC 5280 as MUST or SHOULD * be recognized */ - private static final int[] commonName_data = { 2, 5, 4, 3 }; - private static final int[] SURNAME_DATA = { 2, 5, 4, 4 }; - private static final int[] SERIALNUMBER_DATA = { 2, 5, 4, 5 }; - private static final int[] countryName_data = { 2, 5, 4, 6 }; - private static final int[] localityName_data = { 2, 5, 4, 7 }; - private static final int[] stateName_data = { 2, 5, 4, 8 }; - private static final int[] streetAddress_data = { 2, 5, 4, 9 }; - private static final int[] orgName_data = { 2, 5, 4, 10 }; - private static final int[] orgUnitName_data = { 2, 5, 4, 11 }; - private static final int[] title_data = { 2, 5, 4, 12 }; - private static final int[] GIVENNAME_DATA = { 2, 5, 4, 42 }; - private static final int[] INITIALS_DATA = { 2, 5, 4, 43 }; - private static final int[] GENERATIONQUALIFIER_DATA = { 2, 5, 4, 44 }; - private static final int[] DNQUALIFIER_DATA = { 2, 5, 4, 46 }; - - private static final int[] ipAddress_data = { 1, 3, 6, 1, 4, 1, 42, 2, 11, 2, 1 }; - private static final int[] DOMAIN_COMPONENT_DATA = - { 0, 9, 2342, 19200300, 100, 1, 25 }; - private static final int[] userid_data = - { 0, 9, 2342, 19200300, 100, 1, 1 }; - // OID for the "CN=" attribute, denoting a person's common name. public static final ObjectIdentifier commonName_oid = - ObjectIdentifier.newInternal(commonName_data); + ObjectIdentifier.of(KnownOIDs.CommonName); + + // OID for the "SURNAME=" attribute, denoting a person's surname. + public static final ObjectIdentifier SURNAME_OID = + ObjectIdentifier.of(KnownOIDs.Surname); // OID for the "SERIALNUMBER=" attribute, denoting a serial number for. // a name. Do not confuse with PKCS#9 issuerAndSerialNumber or the // certificate serial number. public static final ObjectIdentifier SERIALNUMBER_OID = - ObjectIdentifier.newInternal(SERIALNUMBER_DATA); + ObjectIdentifier.of(KnownOIDs.SerialNumber); // OID for the "C=" attribute, denoting a country. public static final ObjectIdentifier countryName_oid = - ObjectIdentifier.newInternal(countryName_data); + ObjectIdentifier.of(KnownOIDs.CountryName); // OID for the "L=" attribute, denoting a locality (such as a city). public static final ObjectIdentifier localityName_oid = - ObjectIdentifier.newInternal(localityName_data); - - // OID for the "O=" attribute, denoting an organization name. - public static final ObjectIdentifier orgName_oid = - ObjectIdentifier.newInternal(orgName_data); - - // OID for the "OU=" attribute, denoting an organizational unit name. - public static final ObjectIdentifier orgUnitName_oid = - ObjectIdentifier.newInternal(orgUnitName_data); + ObjectIdentifier.of(KnownOIDs.LocalityName); // OID for the "S=" attribute, denoting a state (such as Delaware). public static final ObjectIdentifier stateName_oid = - ObjectIdentifier.newInternal(stateName_data); + ObjectIdentifier.of(KnownOIDs.StateName); // OID for the "STREET=" attribute, denoting a street address. public static final ObjectIdentifier streetAddress_oid = - ObjectIdentifier.newInternal(streetAddress_data); + ObjectIdentifier.of(KnownOIDs.StreetAddress); - // OID for the "T=" attribute, denoting a person's title. - public static final ObjectIdentifier title_oid = - ObjectIdentifier.newInternal(title_data); + // OID for the "O=" attribute, denoting an organization name. + public static final ObjectIdentifier orgName_oid = + ObjectIdentifier.of(KnownOIDs.OrgName); - // OID for the "DNQUALIFIER=" or "DNQ=" attribute, denoting DN - // disambiguating information. - public static final ObjectIdentifier DNQUALIFIER_OID = - ObjectIdentifier.newInternal(DNQUALIFIER_DATA); + // OID for the "OU=" attribute, denoting an organizational unit name. + public static final ObjectIdentifier orgUnitName_oid = + ObjectIdentifier.of(KnownOIDs.OrgUnitName); - // OID for the "SURNAME=" attribute, denoting a person's surname. - public static final ObjectIdentifier SURNAME_OID = - ObjectIdentifier.newInternal(SURNAME_DATA); + // OID for the "T=" attribute, denoting a person's title. + public static final ObjectIdentifier title_oid = + ObjectIdentifier.of(KnownOIDs.Title); // OID for the "GIVENNAME=" attribute, denoting a person's given name. public static final ObjectIdentifier GIVENNAME_OID = - ObjectIdentifier.newInternal(GIVENNAME_DATA); + ObjectIdentifier.of(KnownOIDs.GivenName); // OID for the "INITIALS=" attribute, denoting a person's initials. public static final ObjectIdentifier INITIALS_OID = - ObjectIdentifier.newInternal(INITIALS_DATA); + ObjectIdentifier.of(KnownOIDs.Initials); // OID for the "GENERATION=" attribute, denoting Jr., II, etc. public static final ObjectIdentifier GENERATIONQUALIFIER_OID = - ObjectIdentifier.newInternal(GENERATIONQUALIFIER_DATA); + ObjectIdentifier.of(KnownOIDs.GenerationQualifier); + + // OID for the "DNQUALIFIER=" or "DNQ=" attribute, denoting DN + // disambiguating information. + public static final ObjectIdentifier DNQUALIFIER_OID = + ObjectIdentifier.of(KnownOIDs.DNQualifier); // OIDs from other sources which show up in X.500 names we // expect to deal with often. // // OID for "IP=" IP address attributes, used with SKIP. public static final ObjectIdentifier ipAddress_oid = - ObjectIdentifier.newInternal(ipAddress_data); + ObjectIdentifier.of(KnownOIDs.SkipIPAddress); // Domain component OID from RFC 1274, RFC 2247, RFC 5280. // - // OID for "DC=" domain component attributes, used with DNSNames in DN + // OID for "DC=" domain component attributes.used with DNSNames in DN // format. public static final ObjectIdentifier DOMAIN_COMPONENT_OID = - ObjectIdentifier.newInternal(DOMAIN_COMPONENT_DATA); + ObjectIdentifier.of(KnownOIDs.UCL_DomainComponent); // OID for "UID=" denoting a user id, defined in RFCs 1274 & 2798. public static final ObjectIdentifier userid_oid = - ObjectIdentifier.newInternal(userid_data); + ObjectIdentifier.of(KnownOIDs.UCL_UserID); /** * Return constraint type:

    diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/X509CRLEntryImpl.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/X509CRLEntryImpl.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/X509CRLEntryImpl.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/X509CRLEntryImpl.java 2023-10-06 05:33:33.000000000 +0000 @@ -252,7 +252,8 @@ */ public static CRLReason getRevocationReason(X509CRLEntry crlEntry) { try { - byte[] ext = crlEntry.getExtensionValue("2.5.29.21"); + byte[] ext = crlEntry.getExtensionValue + (KnownOIDs.ReasonCode.value()); if (ext == null) { return null; } @@ -402,11 +403,11 @@ if (extensions == null) return null; try { - String extAlias = OIDMap.getName(new ObjectIdentifier(oid)); + String extAlias = OIDMap.getName(ObjectIdentifier.of(oid)); Extension crlExt = null; if (extAlias == null) { // may be unknown - ObjectIdentifier findOID = new ObjectIdentifier(oid); + ObjectIdentifier findOID = ObjectIdentifier.of(oid); Extension ex = null; ObjectIdentifier inCertOID; for (Enumeration e = extensions.getElements(); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java 2023-10-06 05:33:33.000000000 +0000 @@ -1036,11 +1036,11 @@ if (extensions == null) return null; try { - String extAlias = OIDMap.getName(new ObjectIdentifier(oid)); + String extAlias = OIDMap.getName(ObjectIdentifier.of(oid)); Extension crlExt = null; if (extAlias == null) { // may be unknown - ObjectIdentifier findOID = new ObjectIdentifier(oid); + ObjectIdentifier findOID = ObjectIdentifier.of(oid); Extension ex = null; ObjectIdentifier inCertOID; for (Enumeration e = extensions.getElements(); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/X509CertImpl.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/X509CertImpl.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/security/x509/X509CertImpl.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/security/x509/X509CertImpl.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1996, 2020, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1996, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -25,13 +25,7 @@ package sun.security.x509; -import java.io.BufferedReader; -import java.io.BufferedInputStream; -import java.io.ByteArrayOutputStream; -import java.io.IOException; -import java.io.InputStream; -import java.io.InputStreamReader; -import java.io.OutputStream; +import java.io.*; import java.math.BigInteger; import java.security.*; import java.security.spec.AlgorithmParameterSpec; @@ -42,6 +36,7 @@ import javax.security.auth.x500.X500Principal; +import sun.security.jca.JCAUtil; import sun.security.util.*; import sun.security.provider.X509Factory; @@ -130,14 +125,6 @@ protected AlgorithmId algId = null; protected byte[] signature = null; - // recognized extension OIDS - private static final String KEY_USAGE_OID = "2.5.29.15"; - private static final String EXTENDED_KEY_USAGE_OID = "2.5.29.37"; - private static final String BASIC_CONSTRAINT_OID = "2.5.29.19"; - private static final String SUBJECT_ALT_NAME_OID = "2.5.29.17"; - private static final String ISSUER_ALT_NAME_OID = "2.5.29.18"; - private static final String AUTH_INFO_ACCESS_OID = "1.3.6.1.5.5.7.1.1"; - // number of standard key usage bits. private static final int NUM_STANDARD_KEY_USAGE = 9; @@ -312,6 +299,13 @@ } } + // helper method to record certificate, if necessary, after construction + public static X509CertImpl newX509CertImpl(byte[] certData) throws CertificateException { + var cert = new X509CertImpl(certData); + JCAUtil.tryCommitCertEvent(cert); + return cert; + } + /** * Appends the certificate to an output stream. * @@ -677,7 +671,7 @@ /** * Return the requested attribute from the certificate. - * + *

    * Note that the X509CertInfo is not cloned for performance reasons. * Callers must ensure that they do not modify it. All other * attributes are cloned. @@ -1425,7 +1419,7 @@ */ public byte[] getExtensionValue(String oid) { try { - ObjectIdentifier findOID = new ObjectIdentifier(oid); + ObjectIdentifier findOID = ObjectIdentifier.of(oid); String extAlias = OIDMap.getName(findOID); Extension certExt = null; CertificateExtensions exts = (CertificateExtensions)info.get( @@ -1528,7 +1522,8 @@ public static List getExtendedKeyUsage(X509Certificate cert) throws CertificateParsingException { try { - byte[] ext = cert.getExtensionValue(EXTENDED_KEY_USAGE_OID); + byte[] ext = cert.getExtensionValue + (KnownOIDs.extendedKeyUsage.value()); if (ext == null) return null; DerValue val = new DerValue(ext); @@ -1585,7 +1580,7 @@ for (GeneralName gname : names.names()) { GeneralNameInterface name = gname.getName(); List nameEntry = new ArrayList<>(2); - nameEntry.add(Integer.valueOf(name.getType())); + nameEntry.add(name.getType()); switch (name.getType()) { case GeneralNameInterface.NAME_RFC822: nameEntry.add(((RFC822Name) name).getName()); @@ -1698,7 +1693,8 @@ public static Collection> getSubjectAlternativeNames(X509Certificate cert) throws CertificateParsingException { try { - byte[] ext = cert.getExtensionValue(SUBJECT_ALT_NAME_OID); + byte[] ext = cert.getExtensionValue + (KnownOIDs.SubjectAlternativeName.value()); if (ext == null) { return null; } @@ -1761,7 +1757,8 @@ public static Collection> getIssuerAlternativeNames(X509Certificate cert) throws CertificateParsingException { try { - byte[] ext = cert.getExtensionValue(ISSUER_ALT_NAME_OID); + byte[] ext = cert.getExtensionValue + (KnownOIDs.IssuerAlternativeName.value()); if (ext == null) { return null; } @@ -2005,4 +2002,19 @@ buf.append(hexChars[high]) .append(hexChars[low]); } + + /** + * Restores the state of this object from the stream. + *

    + * Deserialization of this object is not supported. + * + * @param stream the {@code ObjectInputStream} from which data is read + * @throws IOException if an I/O error occurs + * @throws ClassNotFoundException if a serialized class cannot be loaded + */ + private void readObject(ObjectInputStream stream) + throws IOException, ClassNotFoundException { + throw new InvalidObjectException( + "X509CertImpls are not directly deserializable"); + } } diff -Nru openjdk-11-11.0.20+8/src/java.base/share/classes/sun/text/bidi/BidiBase.java openjdk-11-11.0.21+9/src/java.base/share/classes/sun/text/bidi/BidiBase.java --- openjdk-11-11.0.20+8/src/java.base/share/classes/sun/text/bidi/BidiBase.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/classes/sun/text/bidi/BidiBase.java 2023-10-06 05:33:33.000000000 +0000 @@ -4592,7 +4592,7 @@ levelStart + " is out of range 0 to " + (objects.length-1)); } - if (0 > count || objects.length < (objectStart+count)) { + if (0 > count || objects.length - count < objectStart) { throw new IllegalArgumentException("Value count " + levelStart + " is out of range 0 to " + (objects.length - objectStart)); diff -Nru openjdk-11-11.0.20+8/src/java.base/share/conf/security/java.security openjdk-11-11.0.21+9/src/java.base/share/conf/security/java.security --- openjdk-11-11.0.20+8/src/java.base/share/conf/security/java.security 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/conf/security/java.security 2023-10-06 05:33:33.000000000 +0000 @@ -22,6 +22,9 @@ # the command line, set the key security.overridePropertiesFile # to false in the master security properties file. It is set to true # by default. +# +# If this properties file fails to load, the JDK implementation will throw +# an unspecified error when initializing the java.security.Security class. # In this file, various security properties are set for use by # java.security classes. This is where users can statically register diff -Nru openjdk-11-11.0.20+8/src/java.base/share/legal/public_suffix.md openjdk-11-11.0.21+9/src/java.base/share/legal/public_suffix.md --- openjdk-11-11.0.20+8/src/java.base/share/legal/public_suffix.md 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/share/legal/public_suffix.md 2023-10-06 05:33:33.000000000 +0000 @@ -11,7 +11,7 @@ The Source Code of this file is available under the Mozilla Public License, v. 2.0 and is located at -https://raw.githubusercontent.com/publicsuffix/list/3c213aab32b3c014f171b1673d4ce9b5cd72bf1c/public_suffix_list.dat. +https://raw.githubusercontent.com/publicsuffix/list/88467c960d6cdad2ca1623e892e5e17506bc269f/public_suffix_list.dat. If a copy of the MPL was not distributed with this file, you can obtain one at https://mozilla.org/MPL/2.0/. diff -Nru openjdk-11-11.0.20+8/src/java.base/windows/native/libnet/DefaultProxySelector.c openjdk-11-11.0.21+9/src/java.base/windows/native/libnet/DefaultProxySelector.c --- openjdk-11-11.0.20+8/src/java.base/windows/native/libnet/DefaultProxySelector.c 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.base/windows/native/libnet/DefaultProxySelector.c 2023-10-06 05:33:33.000000000 +0000 @@ -243,7 +243,7 @@ if (use_auto_proxy) { WCHAR url[MAX_STR_LEN]; /* Create url for WinHttpGetProxyForUrl */ - _snwprintf(url, sizeof(url) - 1, L"%s://%s", lpProto, lpHost); + swprintf(url, MAX_STR_LEN, L"%s://%s", lpProto, lpHost); /* Get proxy for URL from Windows */ use_auto_proxy = WinHttpGetProxyForUrl(session, &url[0], &auto_proxy_options, &proxy_info); if (use_auto_proxy) { diff -Nru openjdk-11-11.0.20+8/src/java.desktop/macosx/classes/sun/lwawt/macosx/CPrinterJob.java openjdk-11-11.0.21+9/src/java.desktop/macosx/classes/sun/lwawt/macosx/CPrinterJob.java --- openjdk-11-11.0.20+8/src/java.desktop/macosx/classes/sun/lwawt/macosx/CPrinterJob.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.desktop/macosx/classes/sun/lwawt/macosx/CPrinterJob.java 2023-10-06 05:33:33.000000000 +0000 @@ -45,6 +45,7 @@ import javax.print.attribute.standard.MediaSize; import javax.print.attribute.standard.MediaSizeName; import javax.print.attribute.standard.PageRanges; +import javax.print.attribute.standard.Sides; import javax.print.attribute.Attribute; import sun.java2d.*; @@ -630,7 +631,8 @@ } catch (Exception e) { return null; } - return page; + + return FlipPageFormat.flipPage(page); } private Printable getPrintable(int pageIndex) { @@ -682,6 +684,24 @@ return pageFormatArea; } + private int getSides() { + return (this.sidesAttr == null) ? -1 : this.sidesAttr.getValue(); + } + + private void setSides(int sides) { + if (attributes == null) { + return; + } + + final Sides[] sidesTable = new Sides[] {Sides.ONE_SIDED, Sides.TWO_SIDED_LONG_EDGE, Sides.TWO_SIDED_SHORT_EDGE}; + + if (sides >= 0 && sides < sidesTable.length) { + Sides s = sidesTable[sides]; + attributes.add(s); + this.sidesAttr = s; + } + } + private boolean cancelCheck() { // This is called from the native side. @@ -730,7 +750,7 @@ Graphics2D pathGraphics = new CPrinterGraphics(delegate, printerJob); // Just stores delegate into an ivar Rectangle2D pageFormatArea = getPageFormatArea(page); initPrinterGraphics(pathGraphics, pageFormatArea); - painter.print(pathGraphics, page, pageIndex); + painter.print(pathGraphics, FlipPageFormat.getOriginal(page), pageIndex); delegate.dispose(); delegate = null; } catch (PrinterException pe) { throw new java.lang.reflect.UndeclaredThrowableException(pe); } @@ -757,7 +777,7 @@ Runnable r = new Runnable() { public void run() { synchronized(ret) { try { Pageable pageable = getPageable(); - PageFormat pageFormat = pageable.getPageFormat(pageIndex); + PageFormat pageFormat = getPageFormat(pageIndex); if (pageFormat != null) { Printable printable = pageable.getPrintable(pageIndex); if (printable != null) { @@ -870,4 +890,75 @@ (float) (paper.getImageableHeight() / dpi), MediaPrintableArea.INCH); } + + // MacOS NSPrintInfo class has one to one correspondence + // between a paper size and its orientation. + // NSPrintInfo with paper width less than height + // has portrait orientation. + // NSPrintInfo with paper width greater than height + // has landscape orientation. + // (w < h) <-> portrait + // (w > h) <-> landscape + // + // Java PageFormat class has the following relation with NSPrintInfo: + // 1. PageFormat: + // page size: width < height + // orientation: portrait + // NSPrintInfo: width < height (portrait orientation) + // 2. PageFormat: + // page size: width < height + // orientation: landscape + // NSPrintInfo: width > height (landscape orientation) + // + // FlipPageFormat class establishes correspondence between + // Java PageFormat class which page width is greater than height + // with NSPrintInfo in the following way: + // 3. PageFormat: + // page size: width > height + // orientation: portrait + // FlipPageFormat + // page size: width < height + // orientation: landscape + // NSPrintInfo: width > height (landscape orientation) + // 4. PageFormat: + // page size: width > height + // orientation: landscape + // FlipPageFormat + // page size: width < height + // orientation: portrait + // NSPrintInfo: width < height (portrait orientation) + // + // FlipPageFormat preserves the original PageFormat class + // to pass it to Printable.print(Graphics, PageFormat, int) + // method overridden by a user. + private static class FlipPageFormat extends PageFormat { + + private final PageFormat original; + + private FlipPageFormat(PageFormat original) { + this.original = original; + Paper paper = original.getPaper(); + Paper copyPaper = this.getPaper(); + copyPaper.setSize(paper.getHeight(), paper.getWidth()); + copyPaper.setImageableArea( + paper.getImageableY(), paper.getImageableX(), + paper.getImageableHeight(), paper.getImageableWidth()); + this.setPaper(copyPaper); + this.setOrientation((original.getOrientation() == PageFormat.PORTRAIT) + ? PageFormat.LANDSCAPE + : PageFormat.PORTRAIT); + } + + private static PageFormat getOriginal(PageFormat page) { + return (page instanceof FlipPageFormat) ? ((FlipPageFormat) page).original : page; + } + + private static PageFormat flipPage(PageFormat page) { + if (page == null) { + return null; + } + Paper paper = page.getPaper(); + return (paper.getWidth() > paper.getHeight()) ? new FlipPageFormat(page) : page; + } + } } diff -Nru openjdk-11-11.0.20+8/src/java.desktop/macosx/native/libawt_lwawt/awt/CClipboard.m openjdk-11-11.0.21+9/src/java.desktop/macosx/native/libawt_lwawt/awt/CClipboard.m --- openjdk-11-11.0.20+8/src/java.desktop/macosx/native/libawt_lwawt/awt/CClipboard.m 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.desktop/macosx/native/libawt_lwawt/awt/CClipboard.m 2023-10-06 05:33:33.000000000 +0000 @@ -136,15 +136,16 @@ jint nElements = (*env)->GetArrayLength(env, inTypes); NSMutableArray *formatArray = [NSMutableArray arrayWithCapacity:nElements]; jlong *elements = (*env)->GetPrimitiveArrayCritical(env, inTypes, NULL); + if (elements != NULL) { + for (i = 0; i < nElements; i++) { + NSString *pbFormat = formatForIndex(elements[i]); + if (pbFormat) + [formatArray addObject:pbFormat]; + } - for (i = 0; i < nElements; i++) { - NSString *pbFormat = formatForIndex(elements[i]); - if (pbFormat) - [formatArray addObject:pbFormat]; + (*env)->ReleasePrimitiveArrayCritical(env, inTypes, elements, JNI_ABORT); + [[CClipboard sharedClipboard] declareTypes:formatArray withOwner:inJavaClip jniEnv:env]; } - - (*env)->ReleasePrimitiveArrayCritical(env, inTypes, elements, JNI_ABORT); - [[CClipboard sharedClipboard] declareTypes:formatArray withOwner:inJavaClip jniEnv:env]; JNI_COCOA_EXIT(env); } diff -Nru openjdk-11-11.0.20+8/src/java.desktop/macosx/native/libawt_lwawt/awt/CPrinterJob.m openjdk-11-11.0.21+9/src/java.desktop/macosx/native/libawt_lwawt/awt/CPrinterJob.m --- openjdk-11-11.0.20+8/src/java.desktop/macosx/native/libawt_lwawt/awt/CPrinterJob.m 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.desktop/macosx/native/libawt_lwawt/awt/CPrinterJob.m 2023-10-06 05:33:33.000000000 +0000 @@ -37,6 +37,10 @@ #import "GeomUtilities.h" #import "JNIUtilities.h" +#define ONE_SIDED 0 +#define TWO_SIDED_LONG_EDGE 1 +#define TWO_SIDED_SHORT_EDGE 2 + static jclass sjc_Paper = NULL; static jclass sjc_PageFormat = NULL; static jclass sjc_CPrinterJob = NULL; @@ -351,6 +355,24 @@ [dstPrintInfo setPrinter:printer]; } +static jint duplexModeToSides(PMDuplexMode duplexMode) { + switch(duplexMode) { + case kPMDuplexNone: return ONE_SIDED; + case kPMDuplexTumble: return TWO_SIDED_SHORT_EDGE; + case kPMDuplexNoTumble: return TWO_SIDED_LONG_EDGE; + default: return -1; + } +} + +static PMDuplexMode sidesToDuplexMode(jint sides) { + switch(sides) { + case ONE_SIDED: return kPMDuplexNone; + case TWO_SIDED_SHORT_EDGE: return kPMDuplexTumble; + case TWO_SIDED_LONG_EDGE: return kPMDuplexNoTumble; + default: return kPMDuplexNone; + } +} + static void nsPrintInfoToJavaPrinterJob(JNIEnv* env, NSPrintInfo* src, jobject dstPrinterJob, jobject dstPageable) { GET_CPRINTERJOB_CLASS(); @@ -360,6 +382,7 @@ DECLARE_METHOD(jm_setPageRangeAttribute, sjc_CPrinterJob, "setPageRangeAttribute", "(IIZ)V"); DECLARE_METHOD(jm_setPrintToFile, sjc_CPrinterJob, "setPrintToFile", "(Z)V"); DECLARE_METHOD(jm_setDestinationFile, sjc_CPrinterJob, "setDestinationFile", "(Ljava/lang/String;)V"); + DECLARE_METHOD(jm_setSides, sjc_CPrinterJob, "setSides", "(I)V"); // get the selected printer's name, and set the appropriate PrintService on the Java side NSString *name = [[src printer] name]; @@ -420,6 +443,12 @@ jFirstPage, jLastPage, isRangeSet); // AWT_THREADING Safe (known object) CHECK_EXCEPTION(); + PMDuplexMode duplexSetting; + if (PMGetDuplex(src.PMPrintSettings, &duplexSetting) == noErr) { + jint sides = duplexModeToSides(duplexSetting); + (*env)->CallVoidMethod(env, dstPrinterJob, jm_setSides, sides); // AWT_THREADING Safe (known object) + CHECK_EXCEPTION(); + } } } @@ -438,6 +467,8 @@ DECLARE_METHOD(jm_getNumberOfPages, jc_Pageable, "getNumberOfPages", "()I"); DECLARE_METHOD(jm_getPageFormat, sjc_CPrinterJob, "getPageFormatFromAttributes", "()Ljava/awt/print/PageFormat;"); DECLARE_METHOD(jm_getDestinationFile, sjc_CPrinterJob, "getDestinationFile", "()Ljava/lang/String;"); + DECLARE_METHOD(jm_getSides, sjc_CPrinterJob, "getSides", "()I"); + NSMutableDictionary* printingDictionary = [dst dictionary]; @@ -496,6 +527,17 @@ } else { [dst setJobDisposition:NSPrintSpoolJob]; } + + jint sides = (*env)->CallIntMethod(env, srcPrinterJob, jm_getSides); + CHECK_EXCEPTION(); + + if (sides >= 0) { + PMDuplexMode duplexMode = sidesToDuplexMode(sides); + PMPrintSettings printSettings = dst.PMPrintSettings; + if (PMSetDuplex(printSettings, duplexMode) == noErr) { + [dst updateFromPMPrintSettings]; + } + } } /* diff -Nru openjdk-11-11.0.20+8/src/java.desktop/macosx/native/libawt_lwawt/font/CCharToGlyphMapper.m openjdk-11-11.0.21+9/src/java.desktop/macosx/native/libawt_lwawt/font/CCharToGlyphMapper.m --- openjdk-11-11.0.20+8/src/java.desktop/macosx/native/libawt_lwawt/font/CCharToGlyphMapper.m 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.desktop/macosx/native/libawt_lwawt/font/CCharToGlyphMapper.m 2023-10-06 05:33:33.000000000 +0000 @@ -58,12 +58,14 @@ { jint *glyphCodeInts = (*env)->GetPrimitiveArrayCritical(env, glyphs, 0); - CTS_GetGlyphsAsIntsForCharacters(awtFont, unicodes, - cgGlyphs, glyphCodeInts, count); + if (glyphCodeInts != NULL) { + CTS_GetGlyphsAsIntsForCharacters(awtFont, unicodes, + cgGlyphs, glyphCodeInts, count); - // Do not use JNI_COMMIT, as that will not free the buffer copy - // when +ProtectJavaHeap is on. - (*env)->ReleasePrimitiveArrayCritical(env, glyphs, glyphCodeInts, 0); + // Do not use JNI_COMMIT, as that will not free the buffer copy + // when +ProtectJavaHeap is on. + (*env)->ReleasePrimitiveArrayCritical(env, glyphs, glyphCodeInts, 0); + } } static inline void diff -Nru openjdk-11-11.0.20+8/src/java.desktop/macosx/native/libosxui/JRSUIController.m openjdk-11-11.0.21+9/src/java.desktop/macosx/native/libosxui/JRSUIController.m --- openjdk-11-11.0.20+8/src/java.desktop/macosx/native/libosxui/JRSUIController.m 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.desktop/macosx/native/libosxui/JRSUIController.m 2023-10-06 05:33:33.000000000 +0000 @@ -277,11 +277,13 @@ CGRect partBounds = JRSUIControlGetScrollBarPartBounds(control, frame, part); jdouble *rect = (*env)->GetPrimitiveArrayCritical(env, rectArray, NULL); - rect[0] = partBounds.origin.x; - rect[1] = partBounds.origin.y; - rect[2] = partBounds.size.width; - rect[3] = partBounds.size.height; - (*env)->ReleasePrimitiveArrayCritical(env, rectArray, rect, 0); + if (rect != NULL) { + rect[0] = partBounds.origin.x; + rect[1] = partBounds.origin.y; + rect[2] = partBounds.size.width; + rect[3] = partBounds.size.height; + (*env)->ReleasePrimitiveArrayCritical(env, rectArray, rect, 0); + } } /* diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/classes/com/sun/media/sound/DirectAudioDevice.java openjdk-11-11.0.21+9/src/java.desktop/share/classes/com/sun/media/sound/DirectAudioDevice.java --- openjdk-11-11.0.20+8/src/java.desktop/share/classes/com/sun/media/sound/DirectAudioDevice.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.desktop/share/classes/com/sun/media/sound/DirectAudioDevice.java 2023-10-06 05:33:33.000000000 +0000 @@ -1377,8 +1377,9 @@ } } while (doIO && thread == curThread) { - if (newFramePosition >= 0) { - clipBytePosition = newFramePosition * frameSize; + int npf = newFramePosition; // copy into local variable + if (npf >= 0) { + clipBytePosition = npf * frameSize; newFramePosition = -1; } int endFrame = getFrameLength() - 1; diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/classes/sun/awt/FontConfiguration.java openjdk-11-11.0.21+9/src/java.desktop/share/classes/sun/awt/FontConfiguration.java --- openjdk-11-11.0.20+8/src/java.desktop/share/classes/sun/awt/FontConfiguration.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.desktop/share/classes/sun/awt/FontConfiguration.java 2023-10-06 05:33:33.000000000 +0000 @@ -1252,15 +1252,24 @@ return filenamesMap.get(platformName); } + private static final String fontconfigErrorMessage = + "Fontconfig head is null, check your fonts or fonts configuration"; + /** * Returns a configuration specific path to be appended to the font * search path. */ public String getExtraFontPath() { + if (head == null) { + throw new RuntimeException(fontconfigErrorMessage); + } return getString(head[INDEX_appendedfontpath]); } public String getVersion() { + if (head == null) { + throw new RuntimeException(fontconfigErrorMessage); + } return getString(head[INDEX_version]); } diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/classes/sun/awt/image/ImageRepresentation.java openjdk-11-11.0.21+9/src/java.desktop/share/classes/sun/awt/image/ImageRepresentation.java --- openjdk-11-11.0.20+8/src/java.desktop/share/classes/sun/awt/image/ImageRepresentation.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.desktop/share/classes/sun/awt/image/ImageRepresentation.java 2023-10-06 05:33:33.000000000 +0000 @@ -1,5 +1,5 @@ /* - * Copyright (c) 1995, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1995, 2023, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -27,24 +27,20 @@ import java.awt.Color; import java.awt.Graphics; -import java.awt.Transparency; -import java.awt.AWTException; +import java.awt.Graphics2D; import java.awt.Rectangle; +import java.awt.Transparency; +import java.awt.geom.AffineTransform; import java.awt.image.BufferedImage; import java.awt.image.ColorModel; +import java.awt.image.DataBuffer; +import java.awt.image.DataBufferInt; import java.awt.image.DirectColorModel; -import java.awt.image.IndexColorModel; import java.awt.image.ImageConsumer; import java.awt.image.ImageObserver; -import sun.awt.image.ByteComponentRaster; -import sun.awt.image.IntegerComponentRaster; +import java.awt.image.IndexColorModel; import java.awt.image.Raster; import java.awt.image.WritableRaster; -import java.awt.image.DataBuffer; -import java.awt.image.DataBufferInt; -import java.awt.Graphics2D; -import java.awt.geom.AffineTransform; -import sun.awt.image.ImageWatched; import java.util.Hashtable; public class ImageRepresentation extends ImageWatched implements ImageConsumer @@ -114,8 +110,8 @@ try { startProduction(); missinginfo = flags & ~availinfo; - while ((availinfo & ImageObserver.ERROR) == 0 && - missinginfo != 0) + while ((availinfo & (ImageObserver.ERROR | ImageObserver.FRAMEBITS)) == 0 + && missinginfo != 0) { try { wait(); diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/classes/sun/print/RasterPrinterJob.java openjdk-11-11.0.21+9/src/java.desktop/share/classes/sun/print/RasterPrinterJob.java --- openjdk-11-11.0.20+8/src/java.desktop/share/classes/sun/print/RasterPrinterJob.java 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.desktop/share/classes/sun/print/RasterPrinterJob.java 2023-10-06 05:33:33.000000000 +0000 @@ -1077,6 +1077,8 @@ return false; } + this.attributes = attributes; + if (!service.equals(newService)) { try { setPrintService(newService); diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/legal/freetype.md openjdk-11-11.0.21+9/src/java.desktop/share/legal/freetype.md --- openjdk-11-11.0.20+8/src/java.desktop/share/legal/freetype.md 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.desktop/share/legal/freetype.md 2023-10-06 05:33:33.000000000 +0000 @@ -1,4 +1,4 @@ -## The FreeType Project: Freetype v2.12.1 +## The FreeType Project: Freetype v2.13.0 ### FreeType Notice @@ -21,27 +21,26 @@ ### FreeType License ``` -Copyright (C) 1996-2022 by David Turner, Robert Wilhelm, and Werner Lemberg. -Copyright (C) 2007-2022 by Dereg Clegg and Michael Toftdal. -Copyright (C) 1996-2022 by Just van Rossum, David Turner, Robert Wilhelm, and Werner Lemberg. -Copyright (C) 2004-2022 by Masatake YAMATO and Redhat K.K. -Copyright (C) 2007-2022 by Derek Clegg and Michael Toftdal. -Copyright (C) 2007-2022 by David Turner. -Copyright (C) 2022 by David Turner, Robert Wilhelm, Werner Lemberg, and Moazin Khatti. -Copyright (C) 2007-2022 by Rahul Bhalerao , . -Copyright (C) 2008-2022 by David Turner, Robert Wilhelm, Werner Lemberg, and suzuki toshiya. -Copyright (C) 2019-2022 by Nikhil Ramakrishnan, David Turner, Robert Wilhelm, and Werner Lemberg. -Copyright (C) 2009-2022 by Oran Agra and Mickey Gabel. -Copyright (C) 2004-2022 by David Turner, Robert Wilhelm, Werner Lemberg, and George Williams. -Copyright (C) 2004-2022 by Masatake YAMATO, Red Hat K.K., -Copyright (C) 2003-2022 by Masatake YAMATO, Redhat K.K., -Copyright (C) 2013-2022 by Google, Inc. -Copyright (C) 2018-2022 by David Turner, Robert Wilhelm, Dominik Röttsches, and Werner Lemberg. -Copyright (C) 2005-2022 by David Turner, Robert Wilhelm, and Werner Lemberg. -Copyright 2013 by Google, Inc. +Copyright (C) 1996-2023 by David Turner, Robert Wilhelm, and Werner Lemberg. +Copyright (C) 2007-2023 by Dereg Clegg and Michael Toftdal. +Copyright (C) 1996-2023 by Just van Rossum, David Turner, Robert Wilhelm, and Werner Lemberg. +Copyright (C) 2022-2023 by David Turner, Robert Wilhelm, Werner Lemberg, George Williams, and +Copyright (C) 2004-2023 by Masatake YAMATO and Redhat K.K. +Copyright (C) 2007-2023 by Derek Clegg and Michael Toftdal. +Copyright (C) 2003-2023 by Masatake YAMATO, Red Hat K.K., +Copyright (C) 1996-2023 by David Turner, Robert Wilhelm, Werner Lemberg, and Dominik Röttsches. +Copyright (C) 2007-2023 by David Turner. +Copyright (C) 2022-2023 by David Turner, Robert Wilhelm, Werner Lemberg, and Moazin Khatti. +Copyright (C) 2007-2023 by Rahul Bhalerao , . +Copyright (C) 2008-2023 by David Turner, Robert Wilhelm, Werner Lemberg, and suzuki toshiya. +Copyright (C) 2013-2023 by Google, Inc. +Copyright (C) 2019-2023 by Nikhil Ramakrishnan, David Turner, Robert Wilhelm, and Werner Lemberg. +Copyright (C) 2009-2023 by Oran Agra and Mickey Gabel. +Copyright (C) 2018-2023 by David Turner, Robert Wilhelm, Dominik Röttsches, and Werner Lemberg. +Copyright (C) 2004-2023 by David Turner, Robert Wilhelm, Werner Lemberg, and George Williams. - The FreeType Project LICENSE + The FreeType Project LICENSE ---------------------------- 2006-Jan-27 @@ -206,7 +205,7 @@ Our home page can be found at - http://www.freetype.org + https://www.freetype.org ``` diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/legal/harfbuzz.md openjdk-11-11.0.21+9/src/java.desktop/share/legal/harfbuzz.md --- openjdk-11-11.0.20+8/src/java.desktop/share/legal/harfbuzz.md 2023-07-05 07:22:24.000000000 +0000 +++ openjdk-11-11.0.21+9/src/java.desktop/share/legal/harfbuzz.md 2023-10-06 05:33:33.000000000 +0000 @@ -1,8 +1,8 @@ -## Harfbuzz v7.0.1 +## Harfbuzz v7.2.0 ### Harfbuzz License -https://github.com/harfbuzz/harfbuzz/blob/7.0.1/COPYING +https://github.com/harfbuzz/harfbuzz/blob/7.2.0/COPYING 

     
@@ -10,7 +10,7 @@
 For parts of HarfBuzz that are licensed under different licenses see individual
 files names COPYING in subdirectories where applicable.
 
-Copyright © 2010-2022  Google, Inc.
+Copyright © 2010-2023  Google, Inc.
 Copyright © 2018-2020  Ebrahim Byagowi
 Copyright © 2004-2013  Red Hat, Inc.
 Copyright © 2019  Facebook, Inc.
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/legal/libpng.md openjdk-11-11.0.21+9/src/java.desktop/share/legal/libpng.md
--- openjdk-11-11.0.20+8/src/java.desktop/share/legal/libpng.md	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/legal/libpng.md	2023-10-06 05:33:33.000000000 +0000
@@ -1,4 +1,4 @@
-## libpng v1.6.38
+## libpng v1.6.39
 
 ### libpng License
 
    @@ -188,9 +188,10 @@
  * Arm Holdings
    - Richard Townsend
  * Google Inc.
+   - Dan Field
+   - Leon Scroggins III
    - Matt Sarett
    - Mike Klein
-   - Dan Field
    - Sami Boukortt
 
 The build projects, the build scripts, the test scripts, and other
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libawt/java2d/loops/FourByteAbgrPre.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libawt/java2d/loops/FourByteAbgrPre.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libawt/java2d/loops/FourByteAbgrPre.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libawt/java2d/loops/FourByteAbgrPre.c	2023-10-06 05:33:33.000000000 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2005, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -69,6 +69,8 @@
 DECLARE_ALPHA_MASKBLIT(IntArgb, FourByteAbgrPre);
 DECLARE_SRCOVER_MASKBLIT(IntArgbPre, FourByteAbgrPre);
 DECLARE_ALPHA_MASKBLIT(IntArgbPre, FourByteAbgrPre);
+DECLARE_SRCOVER_MASKBLIT(FourByteAbgrPre, IntArgbPre);
+DECLARE_ALPHA_MASKBLIT(FourByteAbgrPre, IntArgbPre);
 DECLARE_ALPHA_MASKBLIT(IntRgb, FourByteAbgrPre);
 DECLARE_SOLID_DRAWGLYPHLISTAA(FourByteAbgrPre);
 DECLARE_SOLID_DRAWGLYPHLISTLCD(FourByteAbgrPre);
@@ -103,6 +105,8 @@
     REGISTER_ALPHA_MASKBLIT(IntArgb, FourByteAbgrPre),
     REGISTER_SRCOVER_MASKBLIT(IntArgbPre, FourByteAbgrPre),
     REGISTER_ALPHA_MASKBLIT(IntArgbPre, FourByteAbgrPre),
+    REGISTER_SRCOVER_MASKBLIT(FourByteAbgrPre, IntArgbPre),
+    REGISTER_ALPHA_MASKBLIT(FourByteAbgrPre, IntArgbPre),
     REGISTER_ALPHA_MASKBLIT(IntRgb, FourByteAbgrPre),
     REGISTER_SOLID_DRAWGLYPHLISTAA(FourByteAbgrPre),
     REGISTER_SOLID_DRAWGLYPHLISTLCD(FourByteAbgrPre),
@@ -177,6 +181,10 @@
 
 DEFINE_ALPHA_MASKBLIT(IntArgbPre, FourByteAbgrPre, 4ByteArgb)
 
+DEFINE_SRCOVER_MASKBLIT(FourByteAbgrPre, IntArgbPre, 4ByteArgb)
+
+DEFINE_ALPHA_MASKBLIT(FourByteAbgrPre, IntArgbPre, 4ByteArgb)
+
 DEFINE_ALPHA_MASKBLIT(IntRgb, FourByteAbgrPre, 4ByteArgb)
 
 DEFINE_SOLID_DRAWGLYPHLISTAA(FourByteAbgrPre, 4ByteArgb)
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfontmanager/freetypeScaler.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfontmanager/freetypeScaler.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfontmanager/freetypeScaler.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfontmanager/freetypeScaler.c	2023-10-06 05:33:33.000000000 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2007, 2023, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -466,7 +466,8 @@
     if ((aa != TEXT_AA_ON) && (fm != TEXT_FM_ON) &&
         !context->doBold && !context->doItalize &&
         (context->transform.yx == 0) && (context->transform.xy == 0) &&
-        (context->transform.xx > 0) && (context->transform.yy > 0))
+        (context->transform.xx > 0) && (context->transform.yy > 0) &&
+        (context->transform.xx == context->transform.yy))
     {
         context->useSbits = 1;
     }
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/config/ftconfig.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/ftconfig.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/config/ftconfig.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/ftconfig.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   ANSI-specific configuration file (specification only).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/config/ftheader.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/ftheader.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/config/ftheader.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/ftheader.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Build macros of the FreeType 2 library.
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/config/ftoption.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/ftoption.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/config/ftoption.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/ftoption.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   User-selectable configuration macros (specification only).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -461,9 +461,9 @@
    *   while compiling in 'release' mode):
    *
    *   ```
-   *     _af_debug_disable_horz_hints
-   *     _af_debug_disable_vert_hints
-   *     _af_debug_disable_blue_hints
+   *     af_debug_disable_horz_hints_
+   *     af_debug_disable_vert_hints_
+   *     af_debug_disable_blue_hints_
    *   ```
    *
    *   Additionally, the following functions provide dumps of various
@@ -480,7 +480,7 @@
    *   As an argument, they use another global variable:
    *
    *   ```
-   *     _af_debug_hints
+   *     af_debug_hints_
    *   ```
    *
    *   Please have a look at the `ftgrid` demo program to see how those
@@ -584,12 +584,12 @@
   /**************************************************************************
    *
    * Define `TT_CONFIG_OPTION_POSTSCRIPT_NAMES` if you want to be able to
-   * load and enumerate the glyph Postscript names in a TrueType or OpenType
+   * load and enumerate Postscript names of glyphs in a TrueType or OpenType
    * file.
    *
-   * Note that when you do not compile the 'psnames' module by undefining the
-   * above `FT_CONFIG_OPTION_POSTSCRIPT_NAMES`, the 'sfnt' module will
-   * contain additional code used to read the PS Names table from a font.
+   * Note that if you do not compile the 'psnames' module by undefining the
+   * above `FT_CONFIG_OPTION_POSTSCRIPT_NAMES` macro, the 'sfnt' module will
+   * contain additional code to read the PostScript name table from a font.
    *
    * (By default, the module uses 'psnames' to extract glyph names.)
    */
@@ -740,6 +740,24 @@
 
 
   /**************************************************************************
+   *
+   * Define `TT_CONFIG_OPTION_NO_BORING_EXPANSION` if you want to exclude
+   * support for 'boring' OpenType specification expansions.
+   *
+   *   https://github.com/harfbuzz/boring-expansion-spec
+   *
+   * Right now, the following features are covered:
+   *
+   *   - 'avar' version 2.0
+   *
+   * Most likely, this is a temporary configuration option to be removed in
+   * the near future, since it is assumed that eventually those features are
+   * added to the OpenType standard.
+   */
+/* #define TT_CONFIG_OPTION_NO_BORING_EXPANSION */
+
+
+  /**************************************************************************
    *
    * Define `TT_CONFIG_OPTION_BDF` if you want to include support for an
    * embedded 'BDF~' table within SFNT-based bitmap formats.
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/config/ftstdlib.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/ftstdlib.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/config/ftstdlib.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/ftstdlib.h	2023-10-06 05:33:33.000000000 +0000
@@ -5,7 +5,7 @@
  *   ANSI-specific library and header configuration file (specification
  *   only).
  *
- * Copyright (C) 2002-2022 by
+ * Copyright (C) 2002-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/config/integer-types.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/integer-types.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/config/integer-types.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/integer-types.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType integer types definitions.
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/config/mac-support.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/mac-support.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/config/mac-support.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/mac-support.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Mac/OS X support configuration header.
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/config/public-macros.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/public-macros.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/config/public-macros.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/config/public-macros.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Define a set of compiler macros used in public FreeType headers.
  *
- * Copyright (C) 2020-2022 by
+ * Copyright (C) 2020-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/freetype.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/freetype.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/freetype.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType high-level API and common types (specification only).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -215,7 +215,6 @@
    *   FT_Get_Char_Index
    *   FT_Get_First_Char
    *   FT_Get_Next_Char
-   *   FT_Get_Name_Index
    *   FT_Load_Char
    *
    *   FT_OPEN_MEMORY
@@ -254,14 +253,15 @@
    *   FT_Get_Kerning
    *   FT_Kerning_Mode
    *   FT_Get_Track_Kerning
-   *   FT_Get_Glyph_Name
-   *   FT_Get_Postscript_Name
    *
    *   FT_CharMapRec
    *   FT_Select_Charmap
    *   FT_Set_Charmap
    *   FT_Get_Charmap_Index
    *
+   *   FT_Get_Name_Index
+   *   FT_Get_Glyph_Name
+   *   FT_Get_Postscript_Name
    *   FT_Get_FSType_Flags
    *   FT_Get_SubGlyph_Info
    *
@@ -646,7 +646,7 @@
    *
    * @note:
    *   Despite the name, this enumeration lists specific character
-   *   repertories (i.e., charsets), and not text encoding methods (e.g.,
+   *   repertoires (i.e., charsets), and not text encoding methods (e.g.,
    *   UTF-8, UTF-16, etc.).
    *
    *   Other encodings might be defined in the future.
@@ -779,7 +779,7 @@
    *   `encoding_id`.  If, for example, `encoding_id` is `TT_MAC_ID_ROMAN`
    *   and the language ID (minus~1) is `TT_MAC_LANGID_GREEK`, it is the
    *   Greek encoding, not Roman.  `TT_MAC_ID_ARABIC` with
-   *   `TT_MAC_LANGID_FARSI` means the Farsi variant the Arabic encoding.
+   *   `TT_MAC_LANGID_FARSI` means the Farsi variant of the Arabic encoding.
    */
   typedef enum  FT_Encoding_
   {
@@ -1167,9 +1167,9 @@
    *   FT_FACE_FLAG_KERNING ::
    *     The face contains kerning information.  If set, the kerning distance
    *     can be retrieved using the function @FT_Get_Kerning.  Otherwise the
-   *     function always return the vector (0,0).  Note that FreeType doesn't
-   *     handle kerning data from the SFNT 'GPOS' table (as present in many
-   *     OpenType fonts).
+   *     function always returns the vector (0,0).  Note that FreeType
+   *     doesn't handle kerning data from the SFNT 'GPOS' table (as present
+   *     in many OpenType fonts).
    *
    *   FT_FACE_FLAG_FAST_GLYPHS ::
    *     THIS FLAG IS DEPRECATED.  DO NOT USE OR TEST IT.
@@ -1892,13 +1892,13 @@
    *     The advance width of the unhinted glyph.  Its value is expressed in
    *     16.16 fractional pixels, unless @FT_LOAD_LINEAR_DESIGN is set when
    *     loading the glyph.  This field can be important to perform correct
-   *     WYSIWYG layout.  Only relevant for outline glyphs.
+   *     WYSIWYG layout.  Only relevant for scalable glyphs.
    *
    *   linearVertAdvance ::
    *     The advance height of the unhinted glyph.  Its value is expressed in
    *     16.16 fractional pixels, unless @FT_LOAD_LINEAR_DESIGN is set when
    *     loading the glyph.  This field can be important to perform correct
-   *     WYSIWYG layout.  Only relevant for outline glyphs.
+   *     WYSIWYG layout.  Only relevant for scalable glyphs.
    *
    *   advance ::
    *     This shorthand is, depending on @FT_LOAD_IGNORE_TRANSFORM, the
@@ -2593,8 +2593,8 @@
    *   stream attachments.
    */
   FT_EXPORT( FT_Error )
-  FT_Attach_Stream( FT_Face        face,
-                    FT_Open_Args*  parameters );
+  FT_Attach_Stream( FT_Face              face,
+                    const FT_Open_Args*  parameters );
 
 
   /**************************************************************************
@@ -3077,7 +3077,7 @@
    *
    *   FT_LOAD_NO_HINTING ::
    *     Disable hinting.  This generally generates 'blurrier' bitmap glyphs
-   *     when the glyph are rendered in any of the anti-aliased modes.  See
+   *     when the glyphs are rendered in any of the anti-aliased modes.  See
    *     also the note below.
    *
    *     This flag is implied by @FT_LOAD_NO_SCALE.
@@ -3434,7 +3434,7 @@
    *     are not interested in the value.
    *
    *   delta ::
-   *     A pointer a translation vector.  Set this to NULL if you are not
+   *     A pointer to a translation vector.  Set this to NULL if you are not
    *     interested in the value.
    *
    * @since:
@@ -3559,9 +3559,10 @@
    *
    *   2. The `sdf` rasterizer has limited support for handling intersecting
    *      contours and *cannot* handle self-intersecting contours whatsoever.
-   *      Self-intersection happens when a single connected contour intersect
-   *      itself at some point; having these in your font definitely pose a
-   *      problem to the rasterizer and cause artifacts, too.
+   *      Self-intersection happens when a single connected contour
+   *      intersects itself at some point; having these in your font
+   *      definitely poses a problem to the rasterizer and cause artifacts,
+   *      too.
    *
    *   3. Generating SDF for really small glyphs may result in undesirable
    *      output; the pixel grid (which stores distance information) becomes
@@ -3843,89 +3844,6 @@
   /**************************************************************************
    *
    * @function:
-   *   FT_Get_Glyph_Name
-   *
-   * @description:
-   *   Retrieve the ASCII name of a given glyph in a face.  This only works
-   *   for those faces where @FT_HAS_GLYPH_NAMES(face) returns~1.
-   *
-   * @input:
-   *   face ::
-   *     A handle to a source face object.
-   *
-   *   glyph_index ::
-   *     The glyph index.
-   *
-   *   buffer_max ::
-   *     The maximum number of bytes available in the buffer.
-   *
-   * @output:
-   *   buffer ::
-   *     A pointer to a target buffer where the name is copied to.
-   *
-   * @return:
-   *   FreeType error code.  0~means success.
-   *
-   * @note:
-   *   An error is returned if the face doesn't provide glyph names or if the
-   *   glyph index is invalid.  In all cases of failure, the first byte of
-   *   `buffer` is set to~0 to indicate an empty name.
-   *
-   *   The glyph name is truncated to fit within the buffer if it is too
-   *   long.  The returned string is always zero-terminated.
-   *
-   *   Be aware that FreeType reorders glyph indices internally so that glyph
-   *   index~0 always corresponds to the 'missing glyph' (called '.notdef').
-   *
-   *   This function always returns an error if the config macro
-   *   `FT_CONFIG_OPTION_NO_GLYPH_NAMES` is not defined in `ftoption.h`.
-   */
-  FT_EXPORT( FT_Error )
-  FT_Get_Glyph_Name( FT_Face     face,
-                     FT_UInt     glyph_index,
-                     FT_Pointer  buffer,
-                     FT_UInt     buffer_max );
-
-
-  /**************************************************************************
-   *
-   * @function:
-   *   FT_Get_Postscript_Name
-   *
-   * @description:
-   *   Retrieve the ASCII PostScript name of a given face, if available.
-   *   This only works with PostScript, TrueType, and OpenType fonts.
-   *
-   * @input:
-   *   face ::
-   *     A handle to the source face object.
-   *
-   * @return:
-   *   A pointer to the face's PostScript name.  `NULL` if unavailable.
-   *
-   * @note:
-   *   The returned pointer is owned by the face and is destroyed with it.
-   *
-   *   For variation fonts, this string changes if you select a different
-   *   instance, and you have to call `FT_Get_PostScript_Name` again to
-   *   retrieve it.  FreeType follows Adobe TechNote #5902, 'Generating
-   *   PostScript Names for Fonts Using OpenType Font Variations'.
-   *
-   *     https://download.macromedia.com/pub/developer/opentype/tech-notes/5902.AdobePSNameGeneration.html
-   *
-   *   [Since 2.9] Special PostScript names for named instances are only
-   *   returned if the named instance is set with @FT_Set_Named_Instance (and
-   *   the font has corresponding entries in its 'fvar' table).  If
-   *   @FT_IS_VARIATION returns true, the algorithmically derived PostScript
-   *   name is provided, not looking up special entries for named instances.
-   */
-  FT_EXPORT( const char* )
-  FT_Get_Postscript_Name( FT_Face  face );
-
-
-  /**************************************************************************
-   *
-   * @function:
    *   FT_Select_Charmap
    *
    * @description:
@@ -4243,7 +4161,8 @@
    *   FT_Get_Name_Index
    *
    * @description:
-   *   Return the glyph index of a given glyph name.
+   *   Return the glyph index of a given glyph name.  This only works
+   *   for those faces where @FT_HAS_GLYPH_NAMES returns true.
    *
    * @input:
    *   face ::
@@ -4254,6 +4173,16 @@
    *
    * @return:
    *   The glyph index.  0~means 'undefined character code'.
+   *
+   * @note:
+   *   Acceptable glyph names might come from the [Adobe Glyph
+   *   List](https://github.com/adobe-type-tools/agl-aglfn).  See
+   *   @FT_Get_Glyph_Name for the inverse functionality.
+   *
+   *   This function has limited capabilities if the config macro
+   *   `FT_CONFIG_OPTION_POSTSCRIPT_NAMES` is not defined in `ftoption.h`:
+   *   It then works only for fonts that actually embed glyph names (which
+   *   many recent OpenType fonts do not).
    */
   FT_EXPORT( FT_UInt )
   FT_Get_Name_Index( FT_Face           face,
@@ -4262,6 +4191,91 @@
 
   /**************************************************************************
    *
+   * @function:
+   *   FT_Get_Glyph_Name
+   *
+   * @description:
+   *   Retrieve the ASCII name of a given glyph in a face.  This only works
+   *   for those faces where @FT_HAS_GLYPH_NAMES returns true.
+   *
+   * @input:
+   *   face ::
+   *     A handle to a source face object.
+   *
+   *   glyph_index ::
+   *     The glyph index.
+   *
+   *   buffer_max ::
+   *     The maximum number of bytes available in the buffer.
+   *
+   * @output:
+   *   buffer ::
+   *     A pointer to a target buffer where the name is copied to.
+   *
+   * @return:
+   *   FreeType error code.  0~means success.
+   *
+   * @note:
+   *   An error is returned if the face doesn't provide glyph names or if the
+   *   glyph index is invalid.  In all cases of failure, the first byte of
+   *   `buffer` is set to~0 to indicate an empty name.
+   *
+   *   The glyph name is truncated to fit within the buffer if it is too
+   *   long.  The returned string is always zero-terminated.
+   *
+   *   Be aware that FreeType reorders glyph indices internally so that glyph
+   *   index~0 always corresponds to the 'missing glyph' (called '.notdef').
+   *
+   *   This function has limited capabilities if the config macro
+   *   `FT_CONFIG_OPTION_POSTSCRIPT_NAMES` is not defined in `ftoption.h`:
+   *   It then works only for fonts that actually embed glyph names (which
+   *   many recent OpenType fonts do not).
+   */
+  FT_EXPORT( FT_Error )
+  FT_Get_Glyph_Name( FT_Face     face,
+                     FT_UInt     glyph_index,
+                     FT_Pointer  buffer,
+                     FT_UInt     buffer_max );
+
+
+  /**************************************************************************
+   *
+   * @function:
+   *   FT_Get_Postscript_Name
+   *
+   * @description:
+   *   Retrieve the ASCII PostScript name of a given face, if available.
+   *   This only works with PostScript, TrueType, and OpenType fonts.
+   *
+   * @input:
+   *   face ::
+   *     A handle to the source face object.
+   *
+   * @return:
+   *   A pointer to the face's PostScript name.  `NULL` if unavailable.
+   *
+   * @note:
+   *   The returned pointer is owned by the face and is destroyed with it.
+   *
+   *   For variation fonts, this string changes if you select a different
+   *   instance, and you have to call `FT_Get_PostScript_Name` again to
+   *   retrieve it.  FreeType follows Adobe TechNote #5902, 'Generating
+   *   PostScript Names for Fonts Using OpenType Font Variations'.
+   *
+   *     https://download.macromedia.com/pub/developer/opentype/tech-notes/5902.AdobePSNameGeneration.html
+   *
+   *   [Since 2.9] Special PostScript names for named instances are only
+   *   returned if the named instance is set with @FT_Set_Named_Instance (and
+   *   the font has corresponding entries in its 'fvar' table).  If
+   *   @FT_IS_VARIATION returns true, the algorithmically derived PostScript
+   *   name is provided, not looking up special entries for named instances.
+   */
+  FT_EXPORT( const char* )
+  FT_Get_Postscript_Name( FT_Face  face );
+
+
+  /**************************************************************************
+   *
    * @enum:
    *   FT_SUBGLYPH_FLAG_XXX
    *
@@ -4348,13 +4362,6 @@
 
   /**************************************************************************
    *
-   * @section:
-   *   base_interface
-   *
-   */
-
-  /**************************************************************************
-   *
    * @enum:
    *   FT_FSTYPE_XXX
    *
@@ -4688,7 +4695,8 @@
    *
    * @description:
    *   This section contains various functions used to perform computations
-   *   on 16.16 fixed-float numbers or 2d vectors.
+   *   on 16.16 fixed-point numbers or 2D vectors.  FreeType does not use
+   *   floating-point data types.
    *
    *   **Attention**: Most arithmetic functions take `FT_Long` as arguments.
    *   For historical reasons, FreeType was designed under the assumption
@@ -4941,8 +4949,8 @@
    *
    */
 #define FREETYPE_MAJOR  2
-#define FREETYPE_MINOR  12
-#define FREETYPE_PATCH  1
+#define FREETYPE_MINOR  13
+#define FREETYPE_PATCH  0
 
 
   /**************************************************************************
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftadvanc.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftadvanc.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftadvanc.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftadvanc.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Quick computation of advance widths (specification only).
  *
- * Copyright (C) 2008-2022 by
+ * Copyright (C) 2008-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftbbox.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftbbox.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftbbox.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftbbox.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType exact bbox computation (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftbdf.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftbdf.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftbdf.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftbdf.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType API for accessing BDF-specific strings (specification).
  *
- * Copyright (C) 2002-2022 by
+ * Copyright (C) 2002-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftbitmap.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftbitmap.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftbitmap.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftbitmap.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType utility functions for bitmaps (specification).
  *
- * Copyright (C) 2004-2022 by
+ * Copyright (C) 2004-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftcid.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftcid.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftcid.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftcid.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType API for accessing CID font information (specification).
  *
- * Copyright (C) 2007-2022 by
+ * Copyright (C) 2007-2023 by
  * Dereg Clegg and Michael Toftdal.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftcolor.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftcolor.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftcolor.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftcolor.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType's glyph color management (specification).
  *
- * Copyright (C) 2018-2022 by
+ * Copyright (C) 2018-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -456,6 +456,9 @@
    *                                           &iterator ) );
    *     }
    *   ```
+   *
+   * @since:
+   *   2.10
    */
   FT_EXPORT( FT_Bool )
   FT_Get_Color_Glyph_Layer( FT_Face            face,
@@ -475,7 +478,7 @@
    *   extensions to the 'COLR' table, see
    *   'https://github.com/googlefonts/colr-gradients-spec'.
    *
-   *   The enumeration values losely correspond with the format numbers of
+   *   The enumeration values loosely correspond with the format numbers of
    *   the specification: FreeType always returns a fully specified 'Paint'
    *   structure for the 'Transform', 'Translate', 'Scale', 'Rotate', and
    *   'Skew' table types even though the specification has different formats
@@ -489,9 +492,7 @@
    *   structures.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef enum  FT_PaintFormat_
   {
@@ -521,9 +522,10 @@
    *
    * @description:
    *   This iterator object is needed for @FT_Get_Colorline_Stops.  It keeps
-   *   state while iterating over the stops of an @FT_ColorLine,
-   *   representing the `ColorLine` struct of the v1 extensions to 'COLR',
-   *   see 'https://github.com/googlefonts/colr-gradients-spec'.
+   *   state while iterating over the stops of an @FT_ColorLine, representing
+   *   the `ColorLine` struct of the v1 extensions to 'COLR', see
+   *   'https://github.com/googlefonts/colr-gradients-spec'.  Do not manually
+   *   modify fields of this iterator.
    *
    * @fields:
    *   num_color_stops ::
@@ -537,10 +539,12 @@
    *     An opaque pointer into 'COLR' table data.  Set by @FT_Get_Paint.
    *     Updated by @FT_Get_Colorline_Stops.
    *
-   * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
+   *   read_variable ::
+   *     A boolean keeping track of whether variable color lines are to be
+   *     read.  Set by @FT_Get_Paint.
    *
+   * @since:
+   *   2.13
    */
   typedef struct  FT_ColorStopIterator_
   {
@@ -549,6 +553,8 @@
 
     FT_Byte*  p;
 
+    FT_Bool  read_variable;
+
   } FT_ColorStopIterator;
 
 
@@ -569,9 +575,7 @@
    *     Alpha transparency value multiplied with the value from 'CPAL'.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_ColorIndex_
   {
@@ -592,19 +596,18 @@
    *
    * @fields:
    *   stop_offset ::
-   *     The stop offset between 0 and 1 along the gradient.
+   *     The stop offset along the gradient, expressed as a 16.16 fixed-point
+   *     coordinate.
    *
    *   color ::
    *     The color information for this stop, see @FT_ColorIndex.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_ColorStop_
   {
-    FT_F2Dot14     stop_offset;
+    FT_Fixed       stop_offset;
     FT_ColorIndex  color;
 
   } FT_ColorStop;
@@ -621,9 +624,7 @@
    *   It describes how the gradient fill continues at the other boundaries.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef enum  FT_PaintExtend_
   {
@@ -653,9 +654,7 @@
    *     actual @FT_ColorStop's.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_ColorLine_
   {
@@ -699,9 +698,7 @@
    *     y translation.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_Affine_23_
   {
@@ -722,9 +719,7 @@
    *   'https://www.w3.org/TR/compositing-1/#porterduffcompositingoperators'.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef enum  FT_Composite_Mode_
   {
@@ -786,9 +781,7 @@
    *     to be provided.  Do not set this value.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_Opaque_Paint_
   {
@@ -815,9 +808,7 @@
    *     The layer iterator that describes the layers of this paint.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_PaintColrLayers_
   {
@@ -842,9 +833,7 @@
    *     The color information for this solid paint, see @FT_ColorIndex.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_PaintSolid_
   {
@@ -883,9 +872,7 @@
    *     Otherwise equal to~p0.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_PaintLinearGradient_
   {
@@ -908,8 +895,7 @@
    *   A structure representing a `PaintRadialGradient` value of the 'COLR'
    *   v1 extensions, see
    *   'https://github.com/googlefonts/colr-gradients-spec'.  The glyph
-   *   layer filled with this paint is drawn filled filled with a radial
-   *   gradient.
+   *   layer filled with this paint is drawn filled with a radial gradient.
    *
    * @fields:
    *   colorline ::
@@ -933,9 +919,7 @@
    *     units represented as a 16.16 fixed-point value.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_PaintRadialGradient_
   {
@@ -983,9 +967,7 @@
    *     given counter-clockwise, starting from the (positive) y~axis.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_PaintSweepGradient_
   {
@@ -1016,9 +998,7 @@
    *     information that is filled with paint.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_PaintGlyph_
   {
@@ -1042,9 +1022,7 @@
    *     this paint.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_PaintColrGlyph_
   {
@@ -1070,9 +1048,7 @@
    *     16.16 fixed-point values.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_PaintTransform_
   {
@@ -1105,9 +1081,7 @@
    *     16.16 fixed-point value.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_PaintTranslate_
   {
@@ -1156,9 +1130,7 @@
    *     16.16 fixed-point value.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward-compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_PaintScale_
   {
@@ -1194,16 +1166,14 @@
    *
    *   center_x ::
    *     The x~coordinate of the pivot point of the rotation in font
-   *     units) represented as a 16.16 fixed-point value.
+   *     units represented as a 16.16 fixed-point value.
    *
    *   center_y ::
    *     The y~coordinate of the pivot point of the rotation in font
    *     units represented as a 16.16 fixed-point value.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
 
   typedef struct  FT_PaintRotate_
@@ -1252,9 +1222,7 @@
    *     represented as a 16.16 fixed-point value.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_PaintSkew_
   {
@@ -1275,9 +1243,8 @@
    *   FT_PaintComposite
    *
    * @description:
-   *   A structure representing a 'COLR'v1 `PaintComposite` paint table.
-   *   Used for compositing two paints in a 'COLR' v1 directed acycling
-   *   graph.
+   *   A structure representing a 'COLR' v1 `PaintComposite` paint table.
+   *   Used for compositing two paints in a 'COLR' v1 directed acyclic graph.
    *
    * @fields:
    *   source_paint ::
@@ -1293,9 +1260,7 @@
    *     `source_paint` is composited onto.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_PaintComposite_
   {
@@ -1339,9 +1304,7 @@
    *       * @FT_PaintColrGlyph
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_COLR_Paint_
   {
@@ -1386,9 +1349,7 @@
    *     Do not output an initial root transform.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef enum  FT_Color_Root_Transform_
   {
@@ -1429,9 +1390,7 @@
    *     fixed-point coordinates in 26.6 format.
    *
    * @since:
-   *   2.12 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   typedef struct  FT_ClipBox_
   {
@@ -1524,9 +1483,7 @@
    *   error, value~0 is returned also.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   FT_EXPORT( FT_Bool )
   FT_Get_Color_Glyph_Paint( FT_Face                  face,
@@ -1568,9 +1525,7 @@
    *   and remove transforms configured using @FT_Set_Transform.
    *
    * @since:
-   *   2.12 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   FT_EXPORT( FT_Bool )
   FT_Get_Color_Glyph_ClipBox( FT_Face      face,
@@ -1617,9 +1572,7 @@
    *   object can not be retrieved or any other error occurs.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   FT_EXPORT( FT_Bool )
   FT_Get_Paint_Layers( FT_Face            face,
@@ -1660,9 +1613,7 @@
    *   also.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   FT_EXPORT( FT_Bool )
   FT_Get_Colorline_Stops( FT_Face                face,
@@ -1698,9 +1649,7 @@
    *   this paint or any other error occured.
    *
    * @since:
-   *   2.11 -- **currently experimental only!**  There might be changes
-   *   without retaining backward compatibility of both the API and ABI.
-   *
+   *   2.13
    */
   FT_EXPORT( FT_Bool )
   FT_Get_Paint( FT_Face         face,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftdriver.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftdriver.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftdriver.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftdriver.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType API for controlling driver modules (specification only).
  *
- * Copyright (C) 2017-2022 by
+ * Copyright (C) 2017-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -820,7 +820,6 @@
    *   2.5
    */
 
-
   /**************************************************************************
    *
    * @property:
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/fterrdef.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/fterrdef.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/fterrdef.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/fterrdef.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType error codes (specification).
  *
- * Copyright (C) 2002-2022 by
+ * Copyright (C) 2002-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/fterrors.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/fterrors.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/fterrors.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/fterrors.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType error code handling (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -29,7 +29,7 @@
    *
    * @description:
    *   The header file `fterrors.h` (which is automatically included by
-   *   `freetype.h` defines the handling of FreeType's enumeration
+   *   `freetype.h`) defines the handling of FreeType's enumeration
    *   constants.  It can also be used to generate error message strings
    *   with a small macro trick explained below.
    *
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftfntfmt.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftfntfmt.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftfntfmt.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftfntfmt.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Support functions for font formats.
  *
- * Copyright (C) 2002-2022 by
+ * Copyright (C) 2002-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftgasp.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftgasp.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftgasp.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftgasp.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Access of TrueType's 'gasp' table (specification).
  *
- * Copyright (C) 2007-2022 by
+ * Copyright (C) 2007-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftglyph.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftglyph.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftglyph.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftglyph.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType convenience functions to handle glyphs (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -355,7 +355,7 @@
    *
    * @output:
    *   aglyph ::
-   *     A handle to the glyph object.
+   *     A handle to the glyph object.  `NULL` in case of error.
    *
    * @return:
    *   FreeType error code.  0~means success.
@@ -385,7 +385,7 @@
    *
    * @output:
    *   target ::
-   *     A handle to the target glyph object.  0~in case of error.
+   *     A handle to the target glyph object.  `NULL` in case of error.
    *
    * @return:
    *   FreeType error code.  0~means success.
@@ -413,7 +413,7 @@
    *
    *   delta ::
    *     A pointer to a 2d vector to apply.  Coordinates are expressed in
-   *     1/64th of a pixel.
+   *     1/64 of a pixel.
    *
    * @return:
    *   FreeType error code (if not 0, the glyph format is not scalable).
@@ -500,7 +500,7 @@
    * @output:
    *   acbox ::
    *     The glyph coordinate bounding box.  Coordinates are expressed in
-   *     1/64th of pixels if it is grid-fitted.
+   *     1/64 of pixels if it is grid-fitted.
    *
    * @note:
    *   Coordinates are relative to the glyph origin, using the y~upwards
@@ -671,7 +671,7 @@
    *
    * @input:
    *   glyph ::
-   *     A handle to the target glyph object.
+   *     A handle to the target glyph object.  Can be `NULL`.
    */
   FT_EXPORT( void )
   FT_Done_Glyph( FT_Glyph  glyph );
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftgzip.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftgzip.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftgzip.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftgzip.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Gzip-compressed stream support.
  *
- * Copyright (C) 2002-2022 by
+ * Copyright (C) 2002-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftimage.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftimage.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftimage.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftimage.h	2023-10-06 05:33:33.000000000 +0000
@@ -5,7 +5,7 @@
  *   FreeType glyph image formats and default raster interface
  *   (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftincrem.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftincrem.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftincrem.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftincrem.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType incremental loading (specification).
  *
- * Copyright (C) 2002-2022 by
+ * Copyright (C) 2002-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftlcdfil.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftlcdfil.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftlcdfil.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftlcdfil.h	2023-10-06 05:33:33.000000000 +0000
@@ -5,7 +5,7 @@
  *   FreeType API for color filtering of subpixel bitmap glyphs
  *   (specification).
  *
- * Copyright (C) 2006-2022 by
+ * Copyright (C) 2006-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -137,11 +137,11 @@
    *
    *   FT_LCD_FILTER_DEFAULT ::
    *     This is a beveled, normalized, and color-balanced five-tap filter
-   *     with weights of [0x08 0x4D 0x56 0x4D 0x08] in 1/256th units.
+   *     with weights of [0x08 0x4D 0x56 0x4D 0x08] in 1/256 units.
    *
    *   FT_LCD_FILTER_LIGHT ::
    *     this is a boxy, normalized, and color-balanced three-tap filter with
-   *     weights of [0x00 0x55 0x56 0x55 0x00] in 1/256th units.
+   *     weights of [0x00 0x55 0x56 0x55 0x00] in 1/256 units.
    *
    *   FT_LCD_FILTER_LEGACY ::
    *   FT_LCD_FILTER_LEGACY1 ::
@@ -226,7 +226,7 @@
    *
    *   weights ::
    *     A pointer to an array; the function copies the first five bytes and
-   *     uses them to specify the filter weights in 1/256th units.
+   *     uses them to specify the filter weights in 1/256 units.
    *
    * @return:
    *   FreeType error code.  0~means success.
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftlist.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftlist.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftlist.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftlist.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Generic list support for FreeType (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftlogging.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftlogging.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftlogging.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftlogging.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Additional debugging APIs.
  *
- * Copyright (C) 2020-2022 by
+ * Copyright (C) 2020-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftmac.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftmac.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftmac.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftmac.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Additional Mac-specific API.
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * Just van Rossum, David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftmm.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftmm.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftmm.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftmm.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType Multiple Master font interface (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -398,6 +398,10 @@
    *   FreeType error code.  0~means success.
    *
    * @note:
+   *   The design coordinates are 16.16 fractional values for TrueType GX and
+   *   OpenType variation fonts.  For Adobe MM fonts, the values are
+   *   integers.
+   *
    *   [Since 2.8.1] To reset all axes to the default values, call the
    *   function with `num_coords` set to zero and `coords` set to `NULL`.
    *   [Since 2.9] 'Default values' means the currently selected named
@@ -440,6 +444,11 @@
    * @return:
    *   FreeType error code.  0~means success.
    *
+   * @note:
+   *   The design coordinates are 16.16 fractional values for TrueType GX and
+   *   OpenType variation fonts.  For Adobe MM fonts, the values are
+   *   integers.
+   *
    * @since:
    *   2.7.1
    */
@@ -471,9 +480,9 @@
    *     the number of axes, use default values for the remaining axes.
    *
    *   coords ::
-   *     The design coordinates array (each element must be between 0 and 1.0
-   *     for Adobe MM fonts, and between -1.0 and 1.0 for TrueType GX and
-   *     OpenType variation fonts).
+   *     The design coordinates array.  Each element is a 16.16 fractional
+   *     value and must be between 0 and 1.0 for Adobe MM fonts, and between
+   *     -1.0 and 1.0 for TrueType GX and OpenType variation fonts.
    *
    * @return:
    *   FreeType error code.  0~means success.
@@ -518,7 +527,7 @@
    *
    * @output:
    *   coords ::
-   *     The normalized blend coordinates array.
+   *     The normalized blend coordinates array (as 16.16 fractional values).
    *
    * @return:
    *   FreeType error code.  0~means success.
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftmodapi.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftmodapi.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftmodapi.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftmodapi.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType modules public interface (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftmoderr.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftmoderr.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftmoderr.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftmoderr.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType module error offsets (specification).
  *
- * Copyright (C) 2001-2022 by
+ * Copyright (C) 2001-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftoutln.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftoutln.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftoutln.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftoutln.h	2023-10-06 05:33:33.000000000 +0000
@@ -5,7 +5,7 @@
  *   Support for the FT_Outline type used to store glyph shapes of
  *   most scalable font formats (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftparams.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftparams.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftparams.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftparams.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType API for possible FT_Parameter tags (specification only).
  *
- * Copyright (C) 2017-2022 by
+ * Copyright (C) 2017-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftrender.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftrender.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftrender.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftrender.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType renderer modules public interface (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftsizes.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftsizes.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftsizes.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftsizes.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType size objects management (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftsnames.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftsnames.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftsnames.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftsnames.h	2023-10-06 05:33:33.000000000 +0000
@@ -7,7 +7,7 @@
  *
  *   This is _not_ used to retrieve glyph names!
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftstroke.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftstroke.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftstroke.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftstroke.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType path stroker (specification).
  *
- * Copyright (C) 2002-2022 by
+ * Copyright (C) 2002-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -293,7 +293,7 @@
    *
    *   miter_limit ::
    *     The maximum reciprocal sine of half-angle at the miter join,
-   *     expressed as 16.16 fixed point value.
+   *     expressed as 16.16 fixed-point value.
    *
    * @note:
    *   The `radius` is expressed in the same units as the outline
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftsynth.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftsynth.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftsynth.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftsynth.h	2023-10-06 05:33:33.000000000 +0000
@@ -5,7 +5,7 @@
  *   FreeType synthesizing code for emboldening and slanting
  *   (specification).
  *
- * Copyright (C) 2000-2022 by
+ * Copyright (C) 2000-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -68,10 +68,19 @@
   FT_EXPORT( void )
   FT_GlyphSlot_Embolden( FT_GlyphSlot  slot );
 
-  /* Slant an outline glyph to the right by about 12 degrees. */
+  /* Slant an outline glyph to the right by about 12 degrees.              */
   FT_EXPORT( void )
   FT_GlyphSlot_Oblique( FT_GlyphSlot  slot );
 
+  /* Slant an outline glyph by a given sine of an angle.  You can apply    */
+  /* slant along either x- or y-axis by choosing a corresponding non-zero  */
+  /* argument.  If both slants are non-zero, some affine transformation    */
+  /* will result.                                                          */
+  FT_EXPORT( void )
+  FT_GlyphSlot_Slant( FT_GlyphSlot  slot,
+                      FT_Fixed      xslant,
+                      FT_Fixed      yslant );
+
   /* */
 
 
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftsystem.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftsystem.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ftsystem.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ftsystem.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType low-level system interface definition (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -229,7 +229,8 @@
    *     A handle to the source stream.
    *
    *   offset ::
-   *     The offset of read in stream (always from start).
+   *     The offset from the start of the stream to seek to if this is a seek
+   *     operation (see note).
    *
    *   buffer ::
    *     The address of the read buffer.
@@ -241,8 +242,13 @@
    *   The number of bytes effectively read by the stream.
    *
    * @note:
-   *   This function might be called to perform a seek or skip operation with
-   *   a `count` of~0.  A non-zero return value then indicates an error.
+   *   This function performs a seek *or* a read operation depending on the
+   *   argument values.  If `count` is zero, the operation is a seek to
+   *   `offset` bytes.  If `count` is >~0, the operation is a read of `count`
+   *   bytes from the current position in the stream, and the `offset` value
+   *   should be ignored.
+   *
+   *   For seek operations, a non-zero return value indicates an error.
    *
    */
   typedef unsigned long
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/fttrigon.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/fttrigon.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/fttrigon.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/fttrigon.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType trigonometric functions (specification).
  *
- * Copyright (C) 2001-2022 by
+ * Copyright (C) 2001-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/fttypes.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/fttypes.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/fttypes.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/fttypes.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType simple types definitions (specification only).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -45,7 +45,10 @@
    * @description:
    *   This section contains the basic data types defined by FreeType~2,
    *   ranging from simple scalar types to bitmap descriptors.  More
-   *   font-specific structures are defined in a different section.
+   *   font-specific structures are defined in a different section.  Note
+   *   that FreeType does not use floating-point data types.  Fractional
+   *   values are represented by fixed-point integers, with lower bits
+   *   storing the fractional part.
    *
    * @order:
    *   FT_Byte
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/autohint.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/autohint.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/autohint.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/autohint.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   High-level 'autohint' module-specific interface (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/cffotypes.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/cffotypes.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/cffotypes.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/cffotypes.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Basic OpenType/CFF object type definitions (specification).
  *
- * Copyright (C) 2017-2022 by
+ * Copyright (C) 2017-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/cfftypes.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/cfftypes.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/cfftypes.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/cfftypes.h	2023-10-06 05:33:33.000000000 +0000
@@ -5,7 +5,7 @@
  *   Basic OpenType/CFF type definitions and interface (specification
  *   only).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -315,7 +315,7 @@
     /* The normal stack then points to these values instead of the DICT   */
     /* because all other operators in Private DICT clear the stack.       */
     /* `blend_stack' could be cleared at each operator other than blend.  */
-    /* Blended values are stored as 5-byte fixed point values.            */
+    /* Blended values are stored as 5-byte fixed-point values.            */
 
     FT_Byte*  blend_stack;    /* base of stack allocation     */
     FT_Byte*  blend_top;      /* first empty slot             */
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/compiler-macros.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/compiler-macros.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/compiler-macros.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/compiler-macros.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Compiler-specific macro definitions used internally by FreeType.
  *
- * Copyright (C) 2020-2022 by
+ * Copyright (C) 2020-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -36,6 +36,19 @@
 #  endif
 #endif
 
+  /* Newer compilers warn for fall-through case statements. */
+#ifndef FALL_THROUGH
+#  if ( defined( __STDC_VERSION__ ) && __STDC_VERSION__ > 201710L ) || \
+      ( defined( __cplusplus ) && __cplusplus > 201402L )
+#    define FALL_THROUGH  [[__fallthrough__]]
+#  elif ( defined( __GNUC__ ) && __GNUC__ >= 7 )          || \
+        ( defined( __clang__ ) && __clang_major__ >= 10 )
+#    define FALL_THROUGH  __attribute__(( __fallthrough__ ))
+#  else
+#    define FALL_THROUGH  ( (void)0 )
+#  endif
+#endif
+
   /*
    * When defining a macro that expands to a non-trivial C statement, use
    * FT_BEGIN_STMNT and FT_END_STMNT to enclose the macro's body.  This
@@ -258,7 +271,7 @@
    * To export a variable, use `FT_EXPORT_VAR`.
    */
 
-  /* See `freetype/config/compiler_macros.h` for the `FT_EXPORT` definition */
+  /* See `freetype/config/public-macros.h` for the `FT_EXPORT` definition */
 #define FT_EXPORT_DEF( x )  FT_FUNCTION_DEFINITION( x )
 
   /*
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftcalc.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftcalc.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftcalc.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftcalc.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Arithmetic computations (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -278,6 +278,40 @@
                       FT_Long  c );
 
 
+  /**************************************************************************
+   *
+   * @function:
+   *   FT_MulAddFix
+   *
+   * @description:
+   *   Compute `(s[0] * f[0] + s[1] * f[1] + ...) / 0x10000`, where `s[n]` is
+   *   usually a 16.16 scalar.
+   *
+   * @input:
+   *   s ::
+   *     The array of scalars.
+   *   f ::
+   *     The array of factors.
+   *   count ::
+   *     The number of entries in the array.
+   *
+   * @return:
+   *   The result of `(s[0] * f[0] + s[1] * f[1] + ...) / 0x10000`.
+   *
+   * @note:
+   *   This function is currently used for the scaled delta computation of
+   *   variation stores.  It internally uses 64-bit data types when
+   *   available, otherwise it emulates 64-bit math by using 32-bit
+   *   operations, which produce a correct result but most likely at a slower
+   *   performance in comparison to the implementation base on `int64_t`.
+   *
+   */
+  FT_BASE( FT_Int32 )
+  FT_MulAddFix( FT_Fixed*  s,
+                FT_Int32*  f,
+                FT_UInt    count );
+
+
   /*
    * A variant of FT_Matrix_Multiply which scales its result afterwards.  The
    * idea is that both `a' and `b' are scaled by factors of 10 so that the
@@ -413,11 +447,11 @@
   extern __inline FT_Int32
   FT_MSB_i386( FT_UInt32  x );
 
-#pragma aux FT_MSB_i386 =     \
-  "bsr eax, eax"              \
-  parm [eax] nomemory         \
-  value [eax]                 \
-  modify exact [eax] nomemory;
+#pragma aux FT_MSB_i386 =             \
+  "bsr eax, eax"                      \
+  __parm [__eax] __nomemory           \
+  __value [__eax]                     \
+  __modify __exact [__eax] __nomemory;
 
 #define FT_MSB( x )  FT_MSB_i386( x )
 
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftdebug.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftdebug.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftdebug.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftdebug.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Debugging and logging component (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftdrv.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftdrv.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftdrv.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftdrv.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType internal font driver interface (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftgloadr.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftgloadr.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftgloadr.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftgloadr.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType glyph loader (specification).
  *
- * Copyright (C) 2002-2022 by
+ * Copyright (C) 2002-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftmemory.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftmemory.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftmemory.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftmemory.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType memory management macros (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg
  *
  * This file is part of the FreeType project, and may only be used,
@@ -96,15 +96,15 @@
 
 #ifdef FT_DEBUG_MEMORY
 
-  FT_BASE( const char* )  _ft_debug_file;
-  FT_BASE( long )         _ft_debug_lineno;
+  FT_BASE( const char* )  ft_debug_file_;
+  FT_BASE( long )         ft_debug_lineno_;
 
-#define FT_DEBUG_INNER( exp )  ( _ft_debug_file   = __FILE__, \
-                                 _ft_debug_lineno = __LINE__, \
+#define FT_DEBUG_INNER( exp )  ( ft_debug_file_   = __FILE__, \
+                                 ft_debug_lineno_ = __LINE__, \
                                  (exp) )
 
-#define FT_ASSIGNP_INNER( p, exp )  ( _ft_debug_file   = __FILE__, \
-                                      _ft_debug_lineno = __LINE__, \
+#define FT_ASSIGNP_INNER( p, exp )  ( ft_debug_file_   = __FILE__, \
+                                      ft_debug_lineno_ = __LINE__, \
                                       FT_ASSIGNP( p, exp ) )
 
 #else /* !FT_DEBUG_MEMORY */
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftmmtypes.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftmmtypes.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftmmtypes.h	1970-01-01 00:00:00.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftmmtypes.h	2023-10-06 05:33:33.000000000 +0000
@@ -0,0 +1,85 @@
+/****************************************************************************
+ *
+ * ftmmtypes.h
+ *
+ *   OpenType Variations type definitions for internal use
+ *   with the multi-masters service (specification).
+ *
+ * Copyright (C) 2022-2023 by
+ * David Turner, Robert Wilhelm, Werner Lemberg, George Williams, and
+ * Dominik Röttsches.
+ *
+ * This file is part of the FreeType project, and may only be used,
+ * modified, and distributed under the terms of the FreeType project
+ * license, LICENSE.TXT.  By continuing to use, modify, or distribute
+ * this file you indicate that you have read the license and
+ * understand and accept it fully.
+ *
+ */
+
+
+#ifndef FTMMTYPES_H_
+#define FTMMTYPES_H_
+
+FT_BEGIN_HEADER
+
+
+  typedef FT_Int32  FT_ItemVarDelta;
+
+  typedef struct  GX_ItemVarDataRec_
+  {
+    FT_UInt            itemCount;       /* number of delta sets per item    */
+    FT_UInt            regionIdxCount;  /* number of region indices         */
+    FT_UInt*           regionIndices;   /* array of `regionCount' indices;  */
+                                        /* these index `varRegionList'      */
+    FT_ItemVarDelta*   deltaSet;        /* array of `itemCount' deltas      */
+                                        /* use `innerIndex' for this array  */
+
+  } GX_ItemVarDataRec, *GX_ItemVarData;
+
+
+  /* contribution of one axis to a region */
+  typedef struct  GX_AxisCoordsRec_
+  {
+    FT_Fixed  startCoord;
+    FT_Fixed  peakCoord;      /* zero means no effect (factor = 1) */
+    FT_Fixed  endCoord;
+
+  } GX_AxisCoordsRec, *GX_AxisCoords;
+
+
+  typedef struct  GX_VarRegionRec_
+  {
+    GX_AxisCoords  axisList;               /* array of axisCount records */
+
+  } GX_VarRegionRec, *GX_VarRegion;
+
+
+  /* item variation store */
+  typedef struct  GX_ItemVarStoreRec_
+  {
+    FT_UInt         dataCount;
+    GX_ItemVarData  varData;            /* array of dataCount records;     */
+                                        /* use `outerIndex' for this array */
+    FT_UShort     axisCount;
+    FT_UInt       regionCount;          /* total number of regions defined */
+    GX_VarRegion  varRegionList;
+
+  } GX_ItemVarStoreRec, *GX_ItemVarStore;
+
+
+  typedef struct  GX_DeltaSetIdxMapRec_
+  {
+    FT_ULong  mapCount;
+    FT_UInt*  outerIndex;               /* indices to item var data */
+    FT_UInt*  innerIndex;               /* indices to delta set     */
+
+  } GX_DeltaSetIdxMapRec, *GX_DeltaSetIdxMap;
+
+
+FT_END_HEADER
+
+#endif /* FTMMTYPES_H_ */
+
+
+/* END */
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftobjs.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftobjs.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftobjs.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftobjs.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType private base classes (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftpsprop.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftpsprop.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftpsprop.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftpsprop.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Get and set properties of PostScript drivers (specification).
  *
- * Copyright (C) 2017-2022 by
+ * Copyright (C) 2017-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftrfork.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftrfork.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftrfork.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftrfork.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Embedded resource forks accessor (specification).
  *
- * Copyright (C) 2004-2022 by
+ * Copyright (C) 2004-2023 by
  * Masatake YAMATO and Redhat K.K.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftserv.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftserv.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftserv.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftserv.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType services (specification only).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftstream.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftstream.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftstream.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftstream.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Stream handling (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -238,42 +238,42 @@
 #define FT_NEXT_BYTE( buffer )         \
           ( (unsigned char)*buffer++ )
 
-#define FT_NEXT_SHORT( buffer )                                   \
-          ( (short)( buffer += 2, FT_PEEK_SHORT( buffer - 2 ) ) )
+#define FT_NEXT_SHORT( buffer )                        \
+          ( buffer += 2, FT_PEEK_SHORT( buffer - 2 ) )
 
-#define FT_NEXT_USHORT( buffer )                                            \
-          ( (unsigned short)( buffer += 2, FT_PEEK_USHORT( buffer - 2 ) ) )
+#define FT_NEXT_USHORT( buffer )                        \
+          ( buffer += 2, FT_PEEK_USHORT( buffer - 2 ) )
 
-#define FT_NEXT_OFF3( buffer )                                  \
-          ( (long)( buffer += 3, FT_PEEK_OFF3( buffer - 3 ) ) )
+#define FT_NEXT_OFF3( buffer )                        \
+          ( buffer += 3, FT_PEEK_OFF3( buffer - 3 ) )
 
-#define FT_NEXT_UOFF3( buffer )                                           \
-          ( (unsigned long)( buffer += 3, FT_PEEK_UOFF3( buffer - 3 ) ) )
+#define FT_NEXT_UOFF3( buffer )                        \
+          ( buffer += 3, FT_PEEK_UOFF3( buffer - 3 ) )
 
-#define FT_NEXT_LONG( buffer )                                  \
-          ( (long)( buffer += 4, FT_PEEK_LONG( buffer - 4 ) ) )
+#define FT_NEXT_LONG( buffer )                        \
+          ( buffer += 4, FT_PEEK_LONG( buffer - 4 ) )
 
-#define FT_NEXT_ULONG( buffer )                                           \
-          ( (unsigned long)( buffer += 4, FT_PEEK_ULONG( buffer - 4 ) ) )
+#define FT_NEXT_ULONG( buffer )                        \
+          ( buffer += 4, FT_PEEK_ULONG( buffer - 4 ) )
 
 
-#define FT_NEXT_SHORT_LE( buffer )                                   \
-          ( (short)( buffer += 2, FT_PEEK_SHORT_LE( buffer - 2 ) ) )
+#define FT_NEXT_SHORT_LE( buffer )                        \
+          ( buffer += 2, FT_PEEK_SHORT_LE( buffer - 2 ) )
 
-#define FT_NEXT_USHORT_LE( buffer )                                            \
-          ( (unsigned short)( buffer += 2, FT_PEEK_USHORT_LE( buffer - 2 ) ) )
+#define FT_NEXT_USHORT_LE( buffer )                        \
+          ( buffer += 2, FT_PEEK_USHORT_LE( buffer - 2 ) )
 
-#define FT_NEXT_OFF3_LE( buffer )                                  \
-          ( (long)( buffer += 3, FT_PEEK_OFF3_LE( buffer - 3 ) ) )
+#define FT_NEXT_OFF3_LE( buffer )                        \
+          ( buffer += 3, FT_PEEK_OFF3_LE( buffer - 3 ) )
 
-#define FT_NEXT_UOFF3_LE( buffer )                                           \
-          ( (unsigned long)( buffer += 3, FT_PEEK_UOFF3_LE( buffer - 3 ) ) )
+#define FT_NEXT_UOFF3_LE( buffer )                        \
+          ( buffer += 3, FT_PEEK_UOFF3_LE( buffer - 3 ) )
 
-#define FT_NEXT_LONG_LE( buffer )                                  \
-          ( (long)( buffer += 4, FT_PEEK_LONG_LE( buffer - 4 ) ) )
+#define FT_NEXT_LONG_LE( buffer )                        \
+          ( buffer += 4, FT_PEEK_LONG_LE( buffer - 4 ) )
 
-#define FT_NEXT_ULONG_LE( buffer )                                           \
-          ( (unsigned long)( buffer += 4, FT_PEEK_ULONG_LE( buffer - 4 ) ) )
+#define FT_NEXT_ULONG_LE( buffer )                        \
+          ( buffer += 4, FT_PEEK_ULONG_LE( buffer - 4 ) )
 
 
   /**************************************************************************
@@ -307,17 +307,17 @@
 
 #define FT_GET_CHAR()       FT_GET_MACRO( FT_Stream_GetByte, FT_Char )
 #define FT_GET_BYTE()       FT_GET_MACRO( FT_Stream_GetByte, FT_Byte )
-#define FT_GET_SHORT()      FT_GET_MACRO( FT_Stream_GetUShort, FT_Short )
-#define FT_GET_USHORT()     FT_GET_MACRO( FT_Stream_GetUShort, FT_UShort )
-#define FT_GET_UOFF3()      FT_GET_MACRO( FT_Stream_GetUOffset, FT_ULong )
-#define FT_GET_LONG()       FT_GET_MACRO( FT_Stream_GetULong, FT_Long )
-#define FT_GET_ULONG()      FT_GET_MACRO( FT_Stream_GetULong, FT_ULong )
-#define FT_GET_TAG4()       FT_GET_MACRO( FT_Stream_GetULong, FT_ULong )
-
-#define FT_GET_SHORT_LE()   FT_GET_MACRO( FT_Stream_GetUShortLE, FT_Short )
-#define FT_GET_USHORT_LE()  FT_GET_MACRO( FT_Stream_GetUShortLE, FT_UShort )
-#define FT_GET_LONG_LE()    FT_GET_MACRO( FT_Stream_GetULongLE, FT_Long )
-#define FT_GET_ULONG_LE()   FT_GET_MACRO( FT_Stream_GetULongLE, FT_ULong )
+#define FT_GET_SHORT()      FT_GET_MACRO( FT_Stream_GetUShort, FT_Int16 )
+#define FT_GET_USHORT()     FT_GET_MACRO( FT_Stream_GetUShort, FT_UInt16 )
+#define FT_GET_UOFF3()      FT_GET_MACRO( FT_Stream_GetUOffset, FT_UInt32 )
+#define FT_GET_LONG()       FT_GET_MACRO( FT_Stream_GetULong, FT_Int32 )
+#define FT_GET_ULONG()      FT_GET_MACRO( FT_Stream_GetULong, FT_UInt32 )
+#define FT_GET_TAG4()       FT_GET_MACRO( FT_Stream_GetULong, FT_UInt32 )
+
+#define FT_GET_SHORT_LE()   FT_GET_MACRO( FT_Stream_GetUShortLE, FT_Int16 )
+#define FT_GET_USHORT_LE()  FT_GET_MACRO( FT_Stream_GetUShortLE, FT_UInt16 )
+#define FT_GET_LONG_LE()    FT_GET_MACRO( FT_Stream_GetULongLE, FT_Int32 )
+#define FT_GET_ULONG_LE()   FT_GET_MACRO( FT_Stream_GetULongLE, FT_UInt32 )
 #endif
 
 
@@ -334,16 +334,16 @@
    */
 #define FT_READ_BYTE( var )       FT_READ_MACRO( FT_Stream_ReadByte, FT_Byte, var )
 #define FT_READ_CHAR( var )       FT_READ_MACRO( FT_Stream_ReadByte, FT_Char, var )
-#define FT_READ_SHORT( var )      FT_READ_MACRO( FT_Stream_ReadUShort, FT_Short, var )
-#define FT_READ_USHORT( var )     FT_READ_MACRO( FT_Stream_ReadUShort, FT_UShort, var )
-#define FT_READ_UOFF3( var )      FT_READ_MACRO( FT_Stream_ReadUOffset, FT_ULong, var )
-#define FT_READ_LONG( var )       FT_READ_MACRO( FT_Stream_ReadULong, FT_Long, var )
-#define FT_READ_ULONG( var )      FT_READ_MACRO( FT_Stream_ReadULong, FT_ULong, var )
-
-#define FT_READ_SHORT_LE( var )   FT_READ_MACRO( FT_Stream_ReadUShortLE, FT_Short, var )
-#define FT_READ_USHORT_LE( var )  FT_READ_MACRO( FT_Stream_ReadUShortLE, FT_UShort, var )
-#define FT_READ_LONG_LE( var )    FT_READ_MACRO( FT_Stream_ReadULongLE, FT_Long, var )
-#define FT_READ_ULONG_LE( var )   FT_READ_MACRO( FT_Stream_ReadULongLE, FT_ULong, var )
+#define FT_READ_SHORT( var )      FT_READ_MACRO( FT_Stream_ReadUShort, FT_Int16, var )
+#define FT_READ_USHORT( var )     FT_READ_MACRO( FT_Stream_ReadUShort, FT_UInt16, var )
+#define FT_READ_UOFF3( var )      FT_READ_MACRO( FT_Stream_ReadUOffset, FT_UInt32, var )
+#define FT_READ_LONG( var )       FT_READ_MACRO( FT_Stream_ReadULong, FT_Int32, var )
+#define FT_READ_ULONG( var )      FT_READ_MACRO( FT_Stream_ReadULong, FT_UInt32, var )
+
+#define FT_READ_SHORT_LE( var )   FT_READ_MACRO( FT_Stream_ReadUShortLE, FT_Int16, var )
+#define FT_READ_USHORT_LE( var )  FT_READ_MACRO( FT_Stream_ReadUShortLE, FT_UInt16, var )
+#define FT_READ_LONG_LE( var )    FT_READ_MACRO( FT_Stream_ReadULongLE, FT_Int32, var )
+#define FT_READ_ULONG_LE( var )   FT_READ_MACRO( FT_Stream_ReadULongLE, FT_UInt32, var )
 
 
 #ifndef FT_CONFIG_OPTION_NO_DEFAULT_SYSTEM
@@ -459,23 +459,23 @@
   FT_Stream_GetByte( FT_Stream  stream );
 
   /* read a 16-bit big-endian unsigned integer from an entered frame */
-  FT_BASE( FT_UShort )
+  FT_BASE( FT_UInt16 )
   FT_Stream_GetUShort( FT_Stream  stream );
 
   /* read a 24-bit big-endian unsigned integer from an entered frame */
-  FT_BASE( FT_ULong )
+  FT_BASE( FT_UInt32 )
   FT_Stream_GetUOffset( FT_Stream  stream );
 
   /* read a 32-bit big-endian unsigned integer from an entered frame */
-  FT_BASE( FT_ULong )
+  FT_BASE( FT_UInt32 )
   FT_Stream_GetULong( FT_Stream  stream );
 
   /* read a 16-bit little-endian unsigned integer from an entered frame */
-  FT_BASE( FT_UShort )
+  FT_BASE( FT_UInt16 )
   FT_Stream_GetUShortLE( FT_Stream  stream );
 
   /* read a 32-bit little-endian unsigned integer from an entered frame */
-  FT_BASE( FT_ULong )
+  FT_BASE( FT_UInt32 )
   FT_Stream_GetULongLE( FT_Stream  stream );
 
 
@@ -485,7 +485,7 @@
                       FT_Error*  error );
 
   /* read a 16-bit big-endian unsigned integer from a stream */
-  FT_BASE( FT_UShort )
+  FT_BASE( FT_UInt16 )
   FT_Stream_ReadUShort( FT_Stream  stream,
                         FT_Error*  error );
 
@@ -495,17 +495,17 @@
                          FT_Error*  error );
 
   /* read a 32-bit big-endian integer from a stream */
-  FT_BASE( FT_ULong )
+  FT_BASE( FT_UInt32 )
   FT_Stream_ReadULong( FT_Stream  stream,
                        FT_Error*  error );
 
   /* read a 16-bit little-endian unsigned integer from a stream */
-  FT_BASE( FT_UShort )
+  FT_BASE( FT_UInt16 )
   FT_Stream_ReadUShortLE( FT_Stream  stream,
                           FT_Error*  error );
 
   /* read a 32-bit little-endian unsigned integer from a stream */
-  FT_BASE( FT_ULong )
+  FT_BASE( FT_UInt32 )
   FT_Stream_ReadULongLE( FT_Stream  stream,
                          FT_Error*  error );
 
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/fttrace.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/fttrace.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/fttrace.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/fttrace.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Tracing handling (specification only).
  *
- * Copyright (C) 2002-2022 by
+ * Copyright (C) 2002-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftvalid.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftvalid.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftvalid.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/ftvalid.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType validation support (specification).
  *
- * Copyright (C) 2004-2022 by
+ * Copyright (C) 2004-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/psaux.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/psaux.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/psaux.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/psaux.h	2023-10-06 05:33:33.000000000 +0000
@@ -5,7 +5,7 @@
  *   Auxiliary functions and data structures related to PostScript fonts
  *   (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -132,9 +132,6 @@
    *   max_elems ::
    *     The maximum number of elements in table.
    *
-   *   num_elems ::
-   *     The current number of elements in table.
-   *
    *   elements ::
    *     A table of element addresses within the block.
    *
@@ -155,7 +152,6 @@
     FT_ULong           init;
 
     FT_Int             max_elems;
-    FT_Int             num_elems;
     FT_Byte**          elements;       /* addresses of table elements */
     FT_UInt*           lengths;        /* lengths of table elements   */
 
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/pshints.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/pshints.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/pshints.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/pshints.h	2023-10-06 05:33:33.000000000 +0000
@@ -6,7 +6,7 @@
  *   recorders (specification only).  These are used to support native
  *   T1/T2 hints in the 'type1', 'cid', and 'cff' font drivers.
  *
- * Copyright (C) 2001-2022 by
+ * Copyright (C) 2001-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -294,7 +294,7 @@
    *
    * @note:
    *   On input, all points within the outline are in font coordinates. On
-   *   output, they are in 1/64th of pixels.
+   *   output, they are in 1/64 of pixels.
    *
    *   The scaling transformation is taken from the 'globals' object which
    *   must correspond to the same font as the glyph.
@@ -607,7 +607,7 @@
    *
    * @note:
    *   On input, all points within the outline are in font coordinates. On
-   *   output, they are in 1/64th of pixels.
+   *   output, they are in 1/64 of pixels.
    *
    *   The scaling transformation is taken from the 'globals' object which
    *   must correspond to the same font than the glyph.
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svbdf.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svbdf.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svbdf.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svbdf.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType BDF services (specification).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svcfftl.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svcfftl.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svcfftl.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svcfftl.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType CFF tables loader service (specification).
  *
- * Copyright (C) 2017-2022 by
+ * Copyright (C) 2017-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svcid.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svcid.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svcid.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svcid.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType CID font services (specification).
  *
- * Copyright (C) 2007-2022 by
+ * Copyright (C) 2007-2023 by
  * Derek Clegg and Michael Toftdal.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svfntfmt.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svfntfmt.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svfntfmt.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svfntfmt.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType font format service (specification only).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svgldict.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svgldict.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svgldict.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svgldict.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType glyph dictionary services (specification).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svgxval.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svgxval.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svgxval.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svgxval.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType API for validating TrueTypeGX/AAT tables (specification).
  *
- * Copyright (C) 2004-2022 by
+ * Copyright (C) 2004-2023 by
  * Masatake YAMATO, Red Hat K.K.,
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svkern.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svkern.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svkern.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svkern.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType Kerning service (specification).
  *
- * Copyright (C) 2006-2022 by
+ * Copyright (C) 2006-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svmetric.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svmetric.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svmetric.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svmetric.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType services for metrics variations (specification).
  *
- * Copyright (C) 2016-2022 by
+ * Copyright (C) 2016-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svmm.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svmm.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svmm.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svmm.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,8 +4,8 @@
  *
  *   The FreeType Multiple Masters and GX var services (specification).
  *
- * Copyright (C) 2003-2022 by
- * David Turner, Robert Wilhelm, and Werner Lemberg.
+ * Copyright (C) 2003-2023 by
+ * David Turner, Robert Wilhelm, Werner Lemberg, and Dominik Röttsches.
  *
  * This file is part of the FreeType project, and may only be used,
  * modified, and distributed under the terms of the FreeType project
@@ -19,7 +19,9 @@
 #ifndef SVMM_H_
 #define SVMM_H_
 
+#include 
 #include 
+#include 
 
 
 FT_BEGIN_HEADER
@@ -96,53 +98,94 @@
                                   FT_UInt*   len,
                                   FT_Fixed*  weight_vector );
 
+  typedef FT_Error
+  (*FT_Var_Load_Delta_Set_Idx_Map_Func)( FT_Face            face,
+                                         FT_ULong           offset,
+                                         GX_DeltaSetIdxMap  map,
+                                         GX_ItemVarStore    itemStore,
+                                         FT_ULong           table_len );
+
+  typedef FT_Error
+  (*FT_Var_Load_Item_Var_Store_Func)( FT_Face          face,
+                                      FT_ULong         offset,
+                                      GX_ItemVarStore  itemStore );
+
+  typedef FT_ItemVarDelta
+  (*FT_Var_Get_Item_Delta_Func)( FT_Face          face,
+                                 GX_ItemVarStore  itemStore,
+                                 FT_UInt          outerIndex,
+                                 FT_UInt          innerIndex );
+
+  typedef void
+  (*FT_Var_Done_Item_Var_Store_Func)( FT_Face          face,
+                                      GX_ItemVarStore  itemStore );
+
+  typedef void
+  (*FT_Var_Done_Delta_Set_Idx_Map_Func)( FT_Face            face,
+                                         GX_DeltaSetIdxMap  deltaSetIdxMap );
+
 
   FT_DEFINE_SERVICE( MultiMasters )
   {
-    FT_Get_MM_Func               get_mm;
-    FT_Set_MM_Design_Func        set_mm_design;
-    FT_Set_MM_Blend_Func         set_mm_blend;
-    FT_Get_MM_Blend_Func         get_mm_blend;
-    FT_Get_MM_Var_Func           get_mm_var;
-    FT_Set_Var_Design_Func       set_var_design;
-    FT_Get_Var_Design_Func       get_var_design;
-    FT_Set_Instance_Func         set_instance;
-    FT_Set_MM_WeightVector_Func  set_mm_weightvector;
-    FT_Get_MM_WeightVector_Func  get_mm_weightvector;
+    FT_Get_MM_Func                        get_mm;
+    FT_Set_MM_Design_Func                 set_mm_design;
+    FT_Set_MM_Blend_Func                  set_mm_blend;
+    FT_Get_MM_Blend_Func                  get_mm_blend;
+    FT_Get_MM_Var_Func                    get_mm_var;
+    FT_Set_Var_Design_Func                set_var_design;
+    FT_Get_Var_Design_Func                get_var_design;
+    FT_Set_Instance_Func                  set_instance;
+    FT_Set_MM_WeightVector_Func           set_mm_weightvector;
+    FT_Get_MM_WeightVector_Func           get_mm_weightvector;
 
     /* for internal use; only needed for code sharing between modules */
-    FT_Get_Var_Blend_Func  get_var_blend;
-    FT_Done_Blend_Func     done_blend;
+    FT_Var_Load_Delta_Set_Idx_Map_Func    load_delta_set_idx_map;
+    FT_Var_Load_Item_Var_Store_Func       load_item_var_store;
+    FT_Var_Get_Item_Delta_Func            get_item_delta;
+    FT_Var_Done_Item_Var_Store_Func       done_item_var_store;
+    FT_Var_Done_Delta_Set_Idx_Map_Func    done_delta_set_idx_map;
+    FT_Get_Var_Blend_Func                 get_var_blend;
+    FT_Done_Blend_Func                    done_blend;
   };
 
 
-#define FT_DEFINE_SERVICE_MULTIMASTERSREC( class_,            \
-                                           get_mm_,           \
-                                           set_mm_design_,    \
-                                           set_mm_blend_,     \
-                                           get_mm_blend_,     \
-                                           get_mm_var_,       \
-                                           set_var_design_,   \
-                                           get_var_design_,   \
-                                           set_instance_,     \
-                                           set_weightvector_, \
-                                           get_weightvector_, \
-                                           get_var_blend_,    \
-                                           done_blend_ )      \
-  static const FT_Service_MultiMastersRec  class_ =           \
-  {                                                           \
-    get_mm_,                                                  \
-    set_mm_design_,                                           \
-    set_mm_blend_,                                            \
-    get_mm_blend_,                                            \
-    get_mm_var_,                                              \
-    set_var_design_,                                          \
-    get_var_design_,                                          \
-    set_instance_,                                            \
-    set_weightvector_,                                        \
-    get_weightvector_,                                        \
-    get_var_blend_,                                           \
-    done_blend_                                               \
+#define FT_DEFINE_SERVICE_MULTIMASTERSREC( class_,                  \
+                                           get_mm_,                 \
+                                           set_mm_design_,          \
+                                           set_mm_blend_,           \
+                                           get_mm_blend_,           \
+                                           get_mm_var_,             \
+                                           set_var_design_,         \
+                                           get_var_design_,         \
+                                           set_instance_,           \
+                                           set_weightvector_,       \
+                                           get_weightvector_,       \
+                                           load_delta_set_idx_map_, \
+                                           load_item_var_store_,    \
+                                           get_item_delta_,         \
+                                           done_item_var_store_,    \
+                                           done_delta_set_idx_map_, \
+                                           get_var_blend_,          \
+                                           done_blend_ )            \
+  static const FT_Service_MultiMastersRec  class_ =                 \
+  {                                                                 \
+    get_mm_,                                                        \
+    set_mm_design_,                                                 \
+    set_mm_blend_,                                                  \
+    get_mm_blend_,                                                  \
+    get_mm_var_,                                                    \
+    set_var_design_,                                                \
+    get_var_design_,                                                \
+    set_instance_,                                                  \
+    set_weightvector_,                                              \
+    get_weightvector_,                                              \
+    load_delta_set_idx_map_,                                        \
+    load_item_var_store_,                                           \
+    get_item_delta_,                                                \
+    done_item_var_store_,                                           \
+    done_delta_set_idx_map_,                                        \
+    get_var_blend_,                                                 \
+    done_blend_                                                     \
   };
 
   /* */
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svotval.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svotval.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svotval.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svotval.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType OpenType validation service (specification).
  *
- * Copyright (C) 2004-2022 by
+ * Copyright (C) 2004-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpfr.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpfr.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpfr.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpfr.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Internal PFR service functions (specification).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpostnm.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpostnm.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpostnm.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpostnm.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType PostScript name services (specification).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svprop.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svprop.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svprop.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svprop.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType property service (specification).
  *
- * Copyright (C) 2012-2022 by
+ * Copyright (C) 2012-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpscmap.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpscmap.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpscmap.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpscmap.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType PostScript charmap service (specification).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpsinfo.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpsinfo.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpsinfo.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svpsinfo.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType PostScript info service (specification).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svsfnt.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svsfnt.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svsfnt.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svsfnt.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType SFNT table loading service (specification).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svttcmap.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svttcmap.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svttcmap.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svttcmap.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType TrueType/sfnt cmap extra information service.
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * Masatake YAMATO, Redhat K.K.,
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svtteng.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svtteng.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svtteng.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svtteng.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType TrueType engine query service (specification).
  *
- * Copyright (C) 2006-2022 by
+ * Copyright (C) 2006-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svttglyf.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svttglyf.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svttglyf.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svttglyf.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType TrueType glyph service.
  *
- * Copyright (C) 2007-2022 by
+ * Copyright (C) 2007-2023 by
  * David Turner.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svwinfnt.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svwinfnt.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svwinfnt.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/services/svwinfnt.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType Windows FNT/FONT service (specification).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/sfnt.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/sfnt.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/sfnt.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/sfnt.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   High-level 'sfnt' driver interface (specification).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/svginterface.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/svginterface.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/svginterface.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/svginterface.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Interface of ot-svg module (specification only).
  *
- * Copyright (C) 2022 by
+ * Copyright (C) 2022-2023 by
  * David Turner, Robert Wilhelm, Werner Lemberg, and Moazin Khatti.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/t1types.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/t1types.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/t1types.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/t1types.h	2023-10-06 05:33:33.000000000 +0000
@@ -5,7 +5,7 @@
  *   Basic Type1/Type2 type definitions and interface (specification
  *   only).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -172,8 +172,8 @@
   {
     FT_Bool        IsCIDFont;
     FT_BBox        FontBBox;
-    FT_Fixed       Ascender;
-    FT_Fixed       Descender;
+    FT_Fixed       Ascender;     /* optional, mind the zero */
+    FT_Fixed       Descender;    /* optional, mind the zero */
     AFM_TrackKern  TrackKerns;   /* free if non-NULL */
     FT_UInt        NumTrackKern;
     AFM_KernPair   KernPairs;    /* free if non-NULL */
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/tttypes.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/tttypes.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/tttypes.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/tttypes.h	2023-10-06 05:33:33.000000000 +0000
@@ -5,7 +5,7 @@
  *   Basic SFNT/TrueType type definitions and interface (specification
  *   only).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/wofftypes.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/wofftypes.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/internal/wofftypes.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/internal/wofftypes.h	2023-10-06 05:33:33.000000000 +0000
@@ -5,7 +5,7 @@
  *   Basic WOFF/WOFF2 type definitions and interface (specification
  *   only).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/otsvg.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/otsvg.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/otsvg.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/otsvg.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Interface for OT-SVG support related things (specification).
  *
- * Copyright (C) 2022 by
+ * Copyright (C) 2022-2023 by
  * David Turner, Robert Wilhelm, Werner Lemberg, and Moazin Khatti.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/t1tables.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/t1tables.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/t1tables.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/t1tables.h	2023-10-06 05:33:33.000000000 +0000
@@ -5,7 +5,7 @@
  *   Basic Type 1/Type 2 tables definitions and interface (specification
  *   only).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ttnameid.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ttnameid.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/ttnameid.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/ttnameid.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   TrueType name ID definitions (specification only).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/tttables.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/tttables.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/tttables.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/tttables.h	2023-10-06 05:33:33.000000000 +0000
@@ -5,7 +5,7 @@
  *   Basic SFNT/TrueType tables definitions and interface
  *   (specification only).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -424,8 +424,8 @@
 
     /* only version 5 and higher: */
 
-    FT_UShort  usLowerOpticalPointSize;       /* in twips (1/20th points) */
-    FT_UShort  usUpperOpticalPointSize;       /* in twips (1/20th points) */
+    FT_UShort  usLowerOpticalPointSize;       /* in twips (1/20 points) */
+    FT_UShort  usUpperOpticalPointSize;       /* in twips (1/20 points) */
 
   } TT_OS2;
 
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/tttags.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/tttags.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/freetype/tttags.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/freetype/tttags.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Tags for TrueType and OpenType tables (specification only).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/ft2build.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/ft2build.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/include/ft2build.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/include/ft2build.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType 2 build and setup macros.
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afblue.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afblue.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afblue.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afblue.c	2023-10-06 05:33:33.000000000 +0000
@@ -7,7 +7,7 @@
  *
  *   Auto-fitter data for blue strings (body).
  *
- * Copyright (C) 2013-2022 by
+ * Copyright (C) 2013-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afblue.cin openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afblue.cin
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afblue.cin	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afblue.cin	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter data for blue strings (body).
  *
- * Copyright (C) 2013-2022 by
+ * Copyright (C) 2013-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afblue.dat openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afblue.dat
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afblue.dat	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afblue.dat	2023-10-06 05:33:33.000000000 +0000
@@ -2,7 +2,7 @@
 //
 //   Auto-fitter data for blue strings.
 //
-// Copyright (C) 2013-2022 by
+// Copyright (C) 2013-2023 by
 // David Turner, Robert Wilhelm, and Werner Lemberg.
 //
 // This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afblue.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afblue.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afblue.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afblue.h	2023-10-06 05:33:33.000000000 +0000
@@ -7,7 +7,7 @@
  *
  *   Auto-fitter data for blue strings (specification).
  *
- * Copyright (C) 2013-2022 by
+ * Copyright (C) 2013-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afblue.hin openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afblue.hin
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afblue.hin	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afblue.hin	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter data for blue strings (specification).
  *
- * Copyright (C) 2013-2022 by
+ * Copyright (C) 2013-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afcjk.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afcjk.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afcjk.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afcjk.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter hinting routines for CJK writing system (body).
  *
- * Copyright (C) 2006-2022 by
+ * Copyright (C) 2006-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -650,7 +650,7 @@
       af_cjk_metrics_check_digits( metrics, face );
     }
 
-    FT_Set_Charmap( face, oldmap );
+    face->charmap = oldmap;
     return FT_Err_Ok;
   }
 
@@ -741,9 +741,11 @@
                     ( dim == AF_DIMENSION_HORZ ) ? 'H' : 'V',
                     nn, blue->ref.org, blue->shoot.org ));
         FT_TRACE5(( "     ref:   cur=%.2f fit=%.2f\n",
-                    blue->ref.cur / 64.0, blue->ref.fit / 64.0 ));
+                    (double)blue->ref.cur / 64,
+                    (double)blue->ref.fit / 64 ));
         FT_TRACE5(( "     shoot: cur=%.2f fit=%.2f\n",
-                    blue->shoot.cur / 64.0, blue->shoot.fit / 64.0 ));
+                    (double)blue->shoot.cur / 64,
+                    (double)blue->shoot.fit / 64 ));
 
         blue->flags |= AF_CJK_BLUE_ACTIVE;
       }
@@ -1044,7 +1046,7 @@
     {
       AF_Edge  found = NULL;
       FT_Pos   best  = 0xFFFFU;
-      FT_Int   ee;
+      FT_UInt  ee;
 
 
       /* look for an edge corresponding to the segment */
@@ -1629,8 +1631,10 @@
     FT_TRACE5(( "  CJKLINK: edge %ld @%d (opos=%.2f) linked to %.2f,"
                 " dist was %.2f, now %.2f\n",
                 stem_edge - hints->axis[dim].edges, stem_edge->fpos,
-                stem_edge->opos / 64.0, stem_edge->pos / 64.0,
-                dist / 64.0, fitted_width / 64.0 ));
+                (double)stem_edge->opos / 64,
+                (double)stem_edge->pos / 64,
+                (double)dist / 64,
+                (double)fitted_width / 64 ));
   }
 
 
@@ -1850,8 +1854,8 @@
 #ifdef FT_DEBUG_LEVEL_TRACE
         FT_TRACE5(( "  CJKBLUE: edge %ld @%d (opos=%.2f) snapped to %.2f,"
                     " was %.2f\n",
-                    edge1 - edges, edge1->fpos, edge1->opos / 64.0,
-                    blue->fit / 64.0, edge1->pos / 64.0 ));
+                    edge1 - edges, edge1->fpos, (double)edge1->opos / 64,
+                    (double)blue->fit / 64, (double)edge1->pos / 64 ));
 
         num_actions++;
 #endif
@@ -2024,8 +2028,8 @@
 #if 0
       printf( "stem (%d,%d) adjusted (%.1f,%.1f)\n",
                edge - edges, edge2 - edges,
-               ( edge->pos - edge->opos ) / 64.0,
-               ( edge2->pos - edge2->opos ) / 64.0 );
+               (double)( edge->pos - edge->opos ) / 64,
+               (double)( edge2->pos - edge2->opos ) / 64 );
 #endif
 
       anchor = edge;
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afcjk.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afcjk.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afcjk.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afcjk.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter hinting routines for CJK writing system (specification).
  *
- * Copyright (C) 2006-2022 by
+ * Copyright (C) 2006-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afcover.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afcover.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afcover.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afcover.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter coverages (specification only).
  *
- * Copyright (C) 2013-2022 by
+ * Copyright (C) 2013-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afdummy.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afdummy.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afdummy.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afdummy.c	2023-10-06 05:33:33.000000000 +0000
@@ -5,7 +5,7 @@
  *   Auto-fitter dummy routines to be used if no hinting should be
  *   performed (body).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afdummy.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afdummy.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afdummy.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afdummy.h	2023-10-06 05:33:33.000000000 +0000
@@ -5,7 +5,7 @@
  *   Auto-fitter dummy routines to be used if no hinting should be
  *   performed (specification).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/aferrors.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/aferrors.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/aferrors.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/aferrors.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Autofitter error codes (specification only).
  *
- * Copyright (C) 2005-2022 by
+ * Copyright (C) 2005-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afglobal.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afglobal.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afglobal.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afglobal.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter routines to compute global hinting values (body).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -129,13 +129,13 @@
     FT_Face     face        = globals->face;
     FT_CharMap  old_charmap = face->charmap;
     FT_UShort*  gstyles     = globals->glyph_styles;
-    FT_UInt     ss;
+    FT_UShort   ss;
+    FT_UShort   dflt        = 0xFFFFU; /* a non-valid value */
     FT_UInt     i;
-    FT_UInt     dflt        = ~0U; /* a non-valid value */
 
 
     /* the value AF_STYLE_UNASSIGNED means `uncovered glyph' */
-    for ( i = 0; i < (FT_UInt)globals->glyph_count; i++ )
+    for ( i = 0; i < globals->glyph_count; i++ )
       gstyles[i] = AF_STYLE_UNASSIGNED;
 
     error = FT_Select_Charmap( face, FT_ENCODING_UNICODE );
@@ -168,8 +168,7 @@
        */
       if ( style_class->coverage == AF_COVERAGE_DEFAULT )
       {
-        if ( (FT_UInt)style_class->script ==
-             globals->module->default_script )
+        if ( style_class->script == globals->module->default_script )
           dflt = ss;
 
         for ( range = script_class->script_uni_ranges;
@@ -183,9 +182,9 @@
           gindex = FT_Get_Char_Index( face, charcode );
 
           if ( gindex != 0                                                &&
-               gindex < (FT_ULong)globals->glyph_count                    &&
+               gindex < globals->glyph_count                              &&
                ( gstyles[gindex] & AF_STYLE_MASK ) == AF_STYLE_UNASSIGNED )
-            gstyles[gindex] = (FT_UShort)ss;
+            gstyles[gindex] = ss;
 
           for (;;)
           {
@@ -194,9 +193,9 @@
             if ( gindex == 0 || charcode > range->last )
               break;
 
-            if ( gindex < (FT_ULong)globals->glyph_count                    &&
+            if ( gindex < globals->glyph_count                              &&
                  ( gstyles[gindex] & AF_STYLE_MASK ) == AF_STYLE_UNASSIGNED )
-              gstyles[gindex] = (FT_UShort)ss;
+              gstyles[gindex] = ss;
           }
         }
 
@@ -211,9 +210,9 @@
 
           gindex = FT_Get_Char_Index( face, charcode );
 
-          if ( gindex != 0                                          &&
-               gindex < (FT_ULong)globals->glyph_count              &&
-               ( gstyles[gindex] & AF_STYLE_MASK ) == (FT_UShort)ss )
+          if ( gindex != 0                               &&
+               gindex < globals->glyph_count             &&
+               ( gstyles[gindex] & AF_STYLE_MASK ) == ss )
             gstyles[gindex] |= AF_NONBASE;
 
           for (;;)
@@ -223,8 +222,8 @@
             if ( gindex == 0 || charcode > range->last )
               break;
 
-            if ( gindex < (FT_ULong)globals->glyph_count              &&
-                 ( gstyles[gindex] & AF_STYLE_MASK ) == (FT_UShort)ss )
+            if ( gindex < globals->glyph_count             &&
+                 ( gstyles[gindex] & AF_STYLE_MASK ) == ss )
               gstyles[gindex] |= AF_NONBASE;
           }
         }
@@ -255,7 +254,7 @@
       FT_UInt  gindex = FT_Get_Char_Index( face, i );
 
 
-      if ( gindex != 0 && gindex < (FT_ULong)globals->glyph_count )
+      if ( gindex != 0 && gindex < globals->glyph_count )
         gstyles[gindex] |= AF_DIGIT;
     }
 
@@ -266,7 +265,7 @@
      */
     if ( globals->module->fallback_style != AF_STYLE_UNASSIGNED )
     {
-      FT_Long  nn;
+      FT_UInt  nn;
 
 
       for ( nn = 0; nn < globals->glyph_count; nn++ )
@@ -290,7 +289,7 @@
     {
       AF_StyleClass  style_class = af_style_classes[ss];
       FT_UInt        count       = 0;
-      FT_Long        idx;
+      FT_UInt        idx;
 
 
       FT_TRACE4(( "%s:\n", af_style_names[style_class->style] ));
@@ -302,7 +301,7 @@
           if ( !( count % 10 ) )
             FT_TRACE4(( " " ));
 
-          FT_TRACE4(( " %ld", idx ));
+          FT_TRACE4(( " %d", idx ));
           count++;
 
           if ( !( count % 10 ) )
@@ -318,7 +317,7 @@
 
 #endif /* FT_DEBUG_LEVEL_TRACE */
 
-    FT_Set_Charmap( face, old_charmap );
+    face->charmap = old_charmap;
     return error;
   }
 
@@ -345,7 +344,7 @@
     FT_ZERO( &globals->metrics );
 
     globals->face                      = face;
-    globals->glyph_count               = face->num_glyphs;
+    globals->glyph_count               = (FT_UInt)face->num_glyphs;
     /* right after the globals structure come the glyph styles */
     globals->glyph_styles              = (FT_UShort*)( globals + 1 );
     globals->module                    = module;
@@ -357,7 +356,7 @@
     globals->scale_down_factor         = 0;
 
 #ifdef FT_CONFIG_OPTION_USE_HARFBUZZ
-    globals->hb_font = hb_ft_font_create( face, NULL );
+    globals->hb_font = hb_ft_font_create_( face, NULL );
     globals->hb_buf  = hb_buffer_create();
 #endif
 
@@ -429,7 +428,7 @@
     FT_Error  error = FT_Err_Ok;
 
 
-    if ( gindex >= (FT_ULong)globals->glyph_count )
+    if ( gindex >= globals->glyph_count )
     {
       error = FT_THROW( Invalid_Argument );
       goto Exit;
@@ -501,7 +500,7 @@
   af_face_globals_is_digit( AF_FaceGlobals  globals,
                             FT_UInt         gindex )
   {
-    if ( gindex < (FT_ULong)globals->glyph_count )
+    if ( gindex < globals->glyph_count )
       return FT_BOOL( globals->glyph_styles[gindex] & AF_DIGIT );
 
     return FT_BOOL( 0 );
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afglobal.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afglobal.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afglobal.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afglobal.h	2023-10-06 05:33:33.000000000 +0000
@@ -5,7 +5,7 @@
  *   Auto-fitter routines to compute global hinting values
  *   (specification).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -105,7 +105,7 @@
   typedef struct  AF_FaceGlobalsRec_
   {
     FT_Face          face;
-    FT_Long          glyph_count;    /* same as face->num_glyphs */
+    FT_UInt          glyph_count;    /* unsigned face->num_glyphs */
     FT_UShort*       glyph_styles;
 
 #ifdef FT_CONFIG_OPTION_USE_HARFBUZZ
@@ -158,7 +158,7 @@
   FT_LOCAL( void )
   af_face_globals_free( AF_FaceGlobals  globals );
 
-  FT_LOCAL_DEF( FT_Bool )
+  FT_LOCAL( FT_Bool )
   af_face_globals_is_digit( AF_FaceGlobals  globals,
                             FT_UInt         gindex );
 
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afhints.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afhints.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afhints.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afhints.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter hinting routines (body).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -151,9 +151,9 @@
     }
     else if ( axis->num_segments >= axis->max_segments )
     {
-      FT_Int  old_max = axis->max_segments;
-      FT_Int  new_max = old_max;
-      FT_Int  big_max = (FT_Int)( FT_INT_MAX / sizeof ( *segment ) );
+      FT_UInt  old_max = axis->max_segments;
+      FT_UInt  new_max = old_max;
+      FT_UInt  big_max = FT_INT_MAX / sizeof ( *segment );
 
 
       if ( old_max >= big_max )
@@ -193,7 +193,7 @@
   /* Get new edge for given axis, direction, and position, */
   /* without initializing the edge itself.                 */
 
-  FT_LOCAL( FT_Error )
+  FT_LOCAL_DEF( FT_Error )
   af_axis_hints_new_edge( AF_AxisHints  axis,
                           FT_Int        fpos,
                           AF_Direction  dir,
@@ -216,9 +216,9 @@
     }
     else if ( axis->num_edges >= axis->max_edges )
     {
-      FT_Int  old_max = axis->max_edges;
-      FT_Int  new_max = old_max;
-      FT_Int  big_max = (FT_Int)( FT_INT_MAX / sizeof ( *edge ) );
+      FT_UInt  old_max = axis->max_edges;
+      FT_UInt  new_max = old_max;
+      FT_UInt  big_max = FT_INT_MAX / sizeof ( *edge );
 
 
       if ( old_max >= big_max )
@@ -471,10 +471,10 @@
 
                 point->fx,
                 point->fy,
-                point->ox / 64.0,
-                point->oy / 64.0,
-                point->x / 64.0,
-                point->y / 64.0,
+                (double)point->ox / 64,
+                (double)point->oy / 64,
+                (double)point->x / 64,
+                (double)point->y / 64,
 
                 af_print_idx( buf5, af_get_strong_edge_index( hints,
                                                               point->before,
@@ -597,7 +597,7 @@
   FT_Error
   af_glyph_hints_get_num_segments( AF_GlyphHints  hints,
                                    FT_Int         dimension,
-                                   FT_Int*        num_segments )
+                                   FT_UInt*       num_segments )
   {
     AF_Dimension  dim;
     AF_AxisHints  axis;
@@ -623,7 +623,7 @@
   FT_Error
   af_glyph_hints_get_segment_offset( AF_GlyphHints  hints,
                                      FT_Int         dimension,
-                                     FT_Int         idx,
+                                     FT_UInt        idx,
                                      FT_Pos        *offset,
                                      FT_Bool       *is_blue,
                                      FT_Pos        *blue_offset )
@@ -640,7 +640,7 @@
 
     axis = &hints->axis[dim];
 
-    if ( idx < 0 || idx >= axis->num_segments )
+    if ( idx >= axis->num_segments )
       return FT_THROW( Invalid_Argument );
 
     seg      = &axis->segments[idx];
@@ -692,13 +692,13 @@
       if ( dimension == AF_DIMENSION_HORZ )
         AF_DUMP(( "Table of %s edges (1px=%.2fu, 10u=%.2fpx):\n",
                   "vertical",
-                  65536.0 * 64.0 / hints->x_scale,
-                  10.0 * hints->x_scale / 65536.0 / 64.0 ));
+                  65536 * 64 / (double)hints->x_scale,
+                  10 * (double)hints->x_scale / 65536 / 64 ));
       else
         AF_DUMP(( "Table of %s edges (1px=%.2fu, 10u=%.2fpx):\n",
                   "horizontal",
-                  65536.0 * 64.0 / hints->y_scale,
-                  10.0 * hints->y_scale / 65536.0 / 64.0 ));
+                  65536 * 64 / (double)hints->y_scale,
+                  10 * (double)hints->y_scale / 65536 / 64 ));
 
       if ( axis->num_edges )
       {
@@ -714,14 +714,14 @@
         AF_DUMP(( "  %5d  %7.2f  %5s  %4s  %5s"
                   "    %c   %7.2f  %7.2f  %11s\n",
                   AF_INDEX_NUM( edge, edges ),
-                  (int)edge->opos / 64.0,
+                  (double)(int)edge->opos / 64,
                   af_dir_str( (AF_Direction)edge->dir ),
                   af_print_idx( buf1, AF_INDEX_NUM( edge->link, edges ) ),
                   af_print_idx( buf2, AF_INDEX_NUM( edge->serif, edges ) ),
 
                   edge->blue_edge ? 'y' : 'n',
-                  edge->opos / 64.0,
-                  edge->pos / 64.0,
+                  (double)edge->opos / 64,
+                  (double)edge->pos / 64,
                   af_edge_flags_to_string( edge->flags ) ));
       AF_DUMP(( "\n" ));
     }
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afhints.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afhints.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afhints.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afhints.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter hinting routines (specification).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -21,8 +21,6 @@
 
 #include "aftypes.h"
 
-#define xxAF_SORT_SEGMENTS
-
 FT_BEGIN_HEADER
 
   /*
@@ -310,15 +308,12 @@
 
   typedef struct  AF_AxisHintsRec_
   {
-    FT_Int        num_segments; /* number of used segments      */
-    FT_Int        max_segments; /* number of allocated segments */
+    FT_UInt       num_segments; /* number of used segments      */
+    FT_UInt       max_segments; /* number of allocated segments */
     AF_Segment    segments;     /* segments array               */
-#ifdef AF_SORT_SEGMENTS
-    FT_Int        mid_segments;
-#endif
 
-    FT_Int        num_edges;    /* number of used edges      */
-    FT_Int        max_edges;    /* number of allocated edges */
+    FT_UInt       num_edges;    /* number of used edges      */
+    FT_UInt       max_edges;    /* number of allocated edges */
     AF_Edge       edges;        /* edges array               */
 
     AF_Direction  major_dir;    /* either vertical or horizontal */
@@ -380,14 +375,14 @@
 #ifdef FT_DEBUG_AUTOFIT
 
 #define AF_HINTS_DO_HORIZONTAL( h )                                     \
-          ( !_af_debug_disable_horz_hints                            && \
+          ( !af_debug_disable_horz_hints_                            && \
             !AF_HINTS_TEST_SCALER( h, AF_SCALER_FLAG_NO_HORIZONTAL ) )
 
 #define AF_HINTS_DO_VERTICAL( h )                                     \
-          ( !_af_debug_disable_vert_hints                          && \
+          ( !af_debug_disable_vert_hints_                          && \
             !AF_HINTS_TEST_SCALER( h, AF_SCALER_FLAG_NO_VERTICAL ) )
 
-#define AF_HINTS_DO_BLUES( h )  ( !_af_debug_disable_blue_hints )
+#define AF_HINTS_DO_BLUES( h )  ( !af_debug_disable_blue_hints_ )
 
 #else /* !FT_DEBUG_AUTOFIT */
 
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afindic.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afindic.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afindic.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afindic.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter hinting routines for Indic writing system (body).
  *
- * Copyright (C) 2007-2022 by
+ * Copyright (C) 2007-2023 by
  * Rahul Bhalerao , .
  *
  * This file is part of the FreeType project, and may only be used,
@@ -49,8 +49,7 @@
       af_cjk_metrics_check_digits( metrics, face );
     }
 
-    FT_Set_Charmap( face, oldmap );
-
+    face->charmap = oldmap;
     return FT_Err_Ok;
   }
 
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afindic.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afindic.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afindic.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afindic.h	2023-10-06 05:33:33.000000000 +0000
@@ -5,7 +5,7 @@
  *   Auto-fitter hinting routines for Indic writing system
  *   (specification).
  *
- * Copyright (C) 2007-2022 by
+ * Copyright (C) 2007-2023 by
  * Rahul Bhalerao , .
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/aflatin.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/aflatin.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/aflatin.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/aflatin.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter hinting routines for latin writing system (body).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -1043,7 +1043,7 @@
       AF_FaceGlobals  globals = metrics->root.globals;
       FT_UShort*      gstyles = globals->glyph_styles;
 
-      FT_Long  i;
+      FT_UInt  i;
 
 
       FT_TRACE5(( "no blue zones found:"
@@ -1157,7 +1157,7 @@
     }
 
   Exit:
-    FT_Set_Charmap( face, oldmap );
+    face->charmap = oldmap;
     return error;
   }
 
@@ -1275,8 +1275,8 @@
               FT_TRACE5(( "                           "
                           " vertical scaling changed"
                           " from %.5f to %.5f (by %ld%%)\n",
-                          scale / 65536.0,
-                          new_scale / 65536.0,
+                          (double)scale / 65536,
+                          (double)new_scale / 65536,
                           ( fitted - scaled ) * 100 / scaled ));
               FT_TRACE5(( "\n" ));
 
@@ -1327,7 +1327,7 @@
 
       FT_TRACE5(( "  %ld scaled to %.2f\n",
                   width->org,
-                  width->cur / 64.0 ));
+                  (double)width->cur / 64 ));
     }
 
     FT_TRACE5(( "\n" ));
@@ -1471,13 +1471,13 @@
         FT_TRACE5(( "  reference %d: %ld scaled to %.2f%s\n",
                     nn,
                     blue->ref.org,
-                    blue->ref.fit / 64.0,
+                    (double)blue->ref.fit / 64,
                     ( blue->flags & AF_LATIN_BLUE_ACTIVE ) ? ""
                                                            : " (inactive)" ));
         FT_TRACE5(( "  overshoot %d: %ld scaled to %.2f%s\n",
                     nn,
                     blue->shoot.org,
-                    blue->shoot.fit / 64.0,
+                    (double)blue->shoot.fit / 64,
                     ( blue->flags & AF_LATIN_BLUE_ACTIVE ) ? ""
                                                            : " (inactive)" ));
       }
@@ -2203,7 +2203,7 @@
     for ( seg = segments; seg < segment_limit; seg++ )
     {
       AF_Edge  found = NULL;
-      FT_Int   ee;
+      FT_UInt  ee;
 
 
       /* ignore too short segments, too wide ones, and, in this loop, */
@@ -2277,7 +2277,7 @@
     for ( seg = segments; seg < segment_limit; seg++ )
     {
       AF_Edge  found = NULL;
-      FT_Int   ee;
+      FT_UInt  ee;
 
 
       if ( seg->dir != AF_DIR_NONE )
@@ -2955,8 +2955,9 @@
 
     FT_TRACE5(( "  LINK: edge %ld (opos=%.2f) linked to %.2f,"
                 " dist was %.2f, now %.2f\n",
-                stem_edge - hints->axis[dim].edges, stem_edge->opos / 64.0,
-                stem_edge->pos / 64.0, dist / 64.0, fitted_width / 64.0 ));
+                stem_edge - hints->axis[dim].edges,
+                (double)stem_edge->opos / 64, (double)stem_edge->pos / 64,
+                (double)dist / 64, (double)fitted_width / 64 ));
   }
 
 
@@ -3079,13 +3080,15 @@
         if ( !anchor )
           FT_TRACE5(( "  BLUE_ANCHOR: edge %ld (opos=%.2f) snapped to %.2f,"
                       " was %.2f (anchor=edge %ld)\n",
-                      edge1 - edges, edge1->opos / 64.0, blue->fit / 64.0,
-                      edge1->pos / 64.0, edge - edges ));
+                      edge1 - edges,
+                      (double)edge1->opos / 64, (double)blue->fit / 64,
+                      (double)edge1->pos / 64, edge - edges ));
         else
           FT_TRACE5(( "  BLUE: edge %ld (opos=%.2f) snapped to %.2f,"
                       " was %.2f\n",
-                      edge1 - edges, edge1->opos / 64.0, blue->fit / 64.0,
-                      edge1->pos / 64.0 ));
+                      edge1 - edges,
+                      (double)edge1->opos / 64, (double)blue->fit / 64,
+                      (double)edge1->pos / 64 ));
 
         num_actions++;
 #endif
@@ -3201,9 +3204,9 @@
 
         FT_TRACE5(( "  ANCHOR: edge %ld (opos=%.2f) and %ld (opos=%.2f)"
                     " snapped to %.2f and %.2f\n",
-                    edge - edges, edge->opos / 64.0,
-                    edge2 - edges, edge2->opos / 64.0,
-                    edge->pos / 64.0, edge2->pos / 64.0 ));
+                    edge - edges, (double)edge->opos / 64,
+                    edge2 - edges, (double)edge2->opos / 64,
+                    (double)edge->pos / 64, (double)edge2->pos / 64 ));
 
         af_latin_align_linked_edge( hints, dim, edge, edge2 );
 
@@ -3229,8 +3232,8 @@
         if ( edge2->flags & AF_EDGE_DONE )
         {
           FT_TRACE5(( "  ADJUST: edge %ld (pos=%.2f) moved to %.2f\n",
-                      edge - edges, edge->pos / 64.0,
-                      ( edge2->pos - cur_len ) / 64.0 ));
+                      edge - edges, (double)edge->pos / 64,
+                      (double)( edge2->pos - cur_len ) / 64 ));
 
           edge->pos = edge2->pos - cur_len;
         }
@@ -3271,9 +3274,9 @@
 
           FT_TRACE5(( "  STEM: edge %ld (opos=%.2f) linked to %ld (opos=%.2f)"
                       " snapped to %.2f and %.2f\n",
-                      edge - edges, edge->opos / 64.0,
-                      edge2 - edges, edge2->opos / 64.0,
-                      edge->pos / 64.0, edge2->pos / 64.0 ));
+                      edge - edges, (double)edge->opos / 64,
+                      edge2 - edges, (double)edge2->opos / 64,
+                      (double)edge->pos / 64, (double)edge2->pos / 64 ));
         }
 
         else
@@ -3302,9 +3305,9 @@
 
           FT_TRACE5(( "  STEM: edge %ld (opos=%.2f) linked to %ld (opos=%.2f)"
                       " snapped to %.2f and %.2f\n",
-                      edge - edges, edge->opos / 64.0,
-                      edge2 - edges, edge2->opos / 64.0,
-                      edge->pos / 64.0, edge2->pos / 64.0 ));
+                      edge - edges, (double)edge->opos / 64,
+                      edge2 - edges, (double)edge2->opos / 64,
+                      (double)edge->pos / 64, (double)edge2->pos / 64 ));
         }
 
 #ifdef FT_DEBUG_LEVEL_TRACE
@@ -3325,8 +3328,8 @@
 #ifdef FT_DEBUG_LEVEL_TRACE
             FT_TRACE5(( "  BOUND: edge %ld (pos=%.2f) moved to %.2f\n",
                         edge - edges,
-                        edge->pos / 64.0,
-                        edge[-1].pos / 64.0 ));
+                        (double)edge->pos / 64,
+                        (double)edge[-1].pos / 64 ));
 
             num_actions++;
 #endif
@@ -3427,9 +3430,9 @@
           af_latin_align_serif_edge( hints, edge->serif, edge );
           FT_TRACE5(( "  SERIF: edge %ld (opos=%.2f) serif to %ld (opos=%.2f)"
                       " aligned to %.2f\n",
-                      edge - edges, edge->opos / 64.0,
-                      edge->serif - edges, edge->serif->opos / 64.0,
-                      edge->pos / 64.0 ));
+                      edge - edges, (double)edge->opos / 64,
+                      edge->serif - edges, (double)edge->serif->opos / 64,
+                      (double)edge->pos / 64 ));
         }
         else if ( !anchor )
         {
@@ -3437,7 +3440,8 @@
           anchor    = edge;
           FT_TRACE5(( "  SERIF_ANCHOR: edge %ld (opos=%.2f)"
                       " snapped to %.2f\n",
-                      edge-edges, edge->opos / 64.0, edge->pos / 64.0 ));
+                      edge-edges,
+                      (double)edge->opos / 64, (double)edge->pos / 64 ));
         }
         else
         {
@@ -3465,9 +3469,9 @@
 
             FT_TRACE5(( "  SERIF_LINK1: edge %ld (opos=%.2f) snapped to %.2f"
                         " from %ld (opos=%.2f)\n",
-                        edge - edges, edge->opos / 64.0,
-                        edge->pos / 64.0,
-                        before - edges, before->opos / 64.0 ));
+                        edge - edges, (double)edge->opos / 64,
+                        (double)edge->pos / 64,
+                        before - edges, (double)before->opos / 64 ));
           }
           else
           {
@@ -3475,7 +3479,8 @@
                         ( ( edge->opos - anchor->opos + 16 ) & ~31 );
             FT_TRACE5(( "  SERIF_LINK2: edge %ld (opos=%.2f)"
                         " snapped to %.2f\n",
-                        edge - edges, edge->opos / 64.0, edge->pos / 64.0 ));
+                        edge - edges,
+                        (double)edge->opos / 64, (double)edge->pos / 64 ));
           }
         }
 
@@ -3495,8 +3500,8 @@
 #ifdef FT_DEBUG_LEVEL_TRACE
             FT_TRACE5(( "  BOUND: edge %ld (pos=%.2f) moved to %.2f\n",
                         edge - edges,
-                        edge->pos / 64.0,
-                        edge[-1].pos / 64.0 ));
+                        (double)edge->pos / 64,
+                        (double)edge[-1].pos / 64 ));
 
             num_actions++;
 #endif
@@ -3516,8 +3521,8 @@
 #ifdef FT_DEBUG_LEVEL_TRACE
             FT_TRACE5(( "  BOUND: edge %ld (pos=%.2f) moved to %.2f\n",
                         edge - edges,
-                        edge->pos / 64.0,
-                        edge[1].pos / 64.0 ));
+                        (double)edge->pos / 64,
+                        (double)edge[1].pos / 64 ));
 
             num_actions++;
 #endif
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/aflatin.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/aflatin.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/aflatin.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/aflatin.h	2023-10-06 05:33:33.000000000 +0000
@@ -5,7 +5,7 @@
  *   Auto-fitter hinting routines for latin writing system
  *   (specification).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afloader.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afloader.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afloader.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afloader.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter glyph loading routines (body).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -229,9 +229,6 @@
     AF_WritingSystemClass  writing_system_class;
 
 
-    if ( !size )
-      return FT_THROW( Invalid_Size_Handle );
-
     FT_ZERO( &scaler );
 
     if ( !size_internal->autohint_metrics.x_scale                          ||
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afloader.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afloader.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afloader.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afloader.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter glyph loading routines (specification).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -75,7 +75,7 @@
                         FT_UInt    gindex,
                         FT_Int32   load_flags );
 
-  FT_LOCAL_DEF( FT_Fixed )
+  FT_LOCAL( FT_Fixed )
   af_loader_compute_darkening( AF_Loader  loader,
                                FT_Face    face,
                                FT_Pos     standard_width );
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afmodule.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afmodule.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afmodule.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afmodule.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter module implementation (body).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -43,14 +43,14 @@
 
 #endif
 
-  int  _af_debug_disable_horz_hints;
-  int  _af_debug_disable_vert_hints;
-  int  _af_debug_disable_blue_hints;
+  int  af_debug_disable_horz_hints_;
+  int  af_debug_disable_vert_hints_;
+  int  af_debug_disable_blue_hints_;
 
   /* we use a global object instead of a local one for debugging */
-  static AF_GlyphHintsRec  _af_debug_hints_rec[1];
+  static AF_GlyphHintsRec  af_debug_hints_rec_[1];
 
-  void*  _af_debug_hints = _af_debug_hints_rec;
+  void*  af_debug_hints_ = af_debug_hints_rec_;
 #endif
 
 #include 
@@ -119,8 +119,8 @@
 
     if ( !ft_strcmp( property_name, "fallback-script" ) )
     {
-      FT_UInt*  fallback_script;
-      FT_UInt   ss;
+      AF_Script*  fallback_script;
+      FT_UInt     ss;
 
 
 #ifdef FT_CONFIG_OPTION_ENVIRONMENT_PROPERTIES
@@ -128,7 +128,7 @@
         return FT_THROW( Invalid_Argument );
 #endif
 
-      fallback_script = (FT_UInt*)value;
+      fallback_script = (AF_Script*)value;
 
       /* We translate the fallback script to a fallback style that uses */
       /* `fallback-script' as its script and `AF_COVERAGE_NONE' as its  */
@@ -138,8 +138,8 @@
         AF_StyleClass  style_class = af_style_classes[ss];
 
 
-        if ( (FT_UInt)style_class->script == *fallback_script &&
-             style_class->coverage == AF_COVERAGE_DEFAULT     )
+        if ( style_class->script   == *fallback_script    &&
+             style_class->coverage == AF_COVERAGE_DEFAULT )
         {
           module->fallback_style = ss;
           break;
@@ -157,7 +157,7 @@
     }
     else if ( !ft_strcmp( property_name, "default-script" ) )
     {
-      FT_UInt*  default_script;
+      AF_Script*  default_script;
 
 
 #ifdef FT_CONFIG_OPTION_ENVIRONMENT_PROPERTIES
@@ -165,7 +165,7 @@
         return FT_THROW( Invalid_Argument );
 #endif
 
-      default_script = (FT_UInt*)value;
+      default_script = (AF_Script*)value;
 
       module->default_script = *default_script;
 
@@ -291,8 +291,6 @@
   {
     FT_Error   error          = FT_Err_Ok;
     AF_Module  module         = (AF_Module)ft_module;
-    FT_UInt    fallback_style = module->fallback_style;
-    FT_UInt    default_script = module->default_script;
 
 
     if ( !ft_strcmp( property_name, "glyph-to-script-map" ) )
@@ -309,9 +307,9 @@
     }
     else if ( !ft_strcmp( property_name, "fallback-script" ) )
     {
-      FT_UInt*  val = (FT_UInt*)value;
+      AF_Script*  val = (AF_Script*)value;
 
-      AF_StyleClass  style_class = af_style_classes[fallback_style];
+      AF_StyleClass  style_class = af_style_classes[module->fallback_style];
 
 
       *val = style_class->script;
@@ -320,10 +318,10 @@
     }
     else if ( !ft_strcmp( property_name, "default-script" ) )
     {
-      FT_UInt*  val = (FT_UInt*)value;
+      AF_Script*  val = (AF_Script*)value;
 
 
-      *val = default_script;
+      *val = module->default_script;
 
       return error;
     }
@@ -425,8 +423,8 @@
     FT_UNUSED( ft_module );
 
 #ifdef FT_DEBUG_AUTOFIT
-    if ( _af_debug_hints_rec->memory )
-      af_glyph_hints_done( _af_debug_hints_rec );
+    if ( af_debug_hints_rec_->memory )
+      af_glyph_hints_done( af_debug_hints_rec_ );
 #endif
   }
 
@@ -445,7 +443,7 @@
 
     /* in debug mode, we use a global object that survives this routine */
 
-    AF_GlyphHints  hints = _af_debug_hints_rec;
+    AF_GlyphHints  hints = af_debug_hints_rec_;
     AF_LoaderRec   loader[1];
 
     FT_UNUSED( size );
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afmodule.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afmodule.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afmodule.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afmodule.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter module implementation (specification).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -36,7 +36,7 @@
     FT_ModuleRec  root;
 
     FT_UInt       fallback_style;
-    FT_UInt       default_script;
+    AF_Script     default_script;
     FT_Bool       no_stem_darkening;
     FT_Int        darken_params[8];
 
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afranges.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afranges.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afranges.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afranges.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter Unicode script ranges (body).
  *
- * Copyright (C) 2013-2022 by
+ * Copyright (C) 2013-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afranges.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afranges.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afranges.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afranges.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter Unicode script ranges (specification).
  *
- * Copyright (C) 2013-2022 by
+ * Copyright (C) 2013-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afscript.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afscript.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afscript.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afscript.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter scripts (specification only).
  *
- * Copyright (C) 2013-2022 by
+ * Copyright (C) 2013-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afshaper.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afshaper.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afshaper.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afshaper.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   HarfBuzz interface for accessing OpenType features (body).
  *
- * Copyright (C) 2013-2022 by
+ * Copyright (C) 2013-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afshaper.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afshaper.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afshaper.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afshaper.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   HarfBuzz interface for accessing OpenType features (specification).
  *
- * Copyright (C) 2013-2022 by
+ * Copyright (C) 2013-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -27,7 +27,7 @@
 
 #include 
 #include 
-#include 
+#include "ft-hb.h"
 
 #endif
 
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afstyles.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afstyles.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afstyles.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afstyles.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter styles (specification only).
  *
- * Copyright (C) 2013-2022 by
+ * Copyright (C) 2013-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/aftypes.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/aftypes.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/aftypes.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/aftypes.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter types (specification only).
  *
- * Copyright (C) 2003-2022 by
+ * Copyright (C) 2003-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -57,10 +57,10 @@
 
 #ifdef FT_DEBUG_AUTOFIT
 
-extern int    _af_debug_disable_horz_hints;
-extern int    _af_debug_disable_vert_hints;
-extern int    _af_debug_disable_blue_hints;
-extern void*  _af_debug_hints;
+extern int    af_debug_disable_horz_hints_;
+extern int    af_debug_disable_vert_hints_;
+extern int    af_debug_disable_blue_hints_;
+extern void*  af_debug_hints_;
 
 #endif /* FT_DEBUG_AUTOFIT */
 
@@ -119,13 +119,13 @@
 
   typedef struct  AF_ScalerRec_
   {
-    FT_Face         face;        /* source font face                        */
-    FT_Fixed        x_scale;     /* from font units to 1/64th device pixels */
-    FT_Fixed        y_scale;     /* from font units to 1/64th device pixels */
-    FT_Pos          x_delta;     /* in 1/64th device pixels                 */
-    FT_Pos          y_delta;     /* in 1/64th device pixels                 */
-    FT_Render_Mode  render_mode; /* monochrome, anti-aliased, LCD, etc.     */
-    FT_UInt32       flags;       /* additional control flags, see above     */
+    FT_Face         face;        /* source font face                      */
+    FT_Fixed        x_scale;     /* from font units to 1/64 device pixels */
+    FT_Fixed        y_scale;     /* from font units to 1/64 device pixels */
+    FT_Pos          x_delta;     /* in 1/64 device pixels                 */
+    FT_Pos          y_delta;     /* in 1/64 device pixels                 */
+    FT_Render_Mode  render_mode; /* monochrome, anti-aliased, LCD, etc.   */
+    FT_UInt32       flags;       /* additional control flags, see above   */
 
   } AF_ScalerRec, *AF_Scaler;
 
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afws-decl.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afws-decl.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afws-decl.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afws-decl.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter writing system declarations (specification only).
  *
- * Copyright (C) 2013-2022 by
+ * Copyright (C) 2013-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afws-iter.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afws-iter.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/autofit/afws-iter.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/autofit/afws-iter.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Auto-fitter writing systems iterator (specification only).
  *
- * Copyright (C) 2013-2022 by
+ * Copyright (C) 2013-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftadvanc.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftadvanc.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftadvanc.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftadvanc.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Quick computation of advance widths (body).
  *
- * Copyright (C) 2008-2022 by
+ * Copyright (C) 2008-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -23,7 +23,7 @@
 
 
   static FT_Error
-  _ft_face_scale_advances( FT_Face    face,
+  ft_face_scale_advances_( FT_Face    face,
                            FT_Fixed*  advances,
                            FT_UInt    count,
                            FT_Int32   flags )
@@ -96,7 +96,7 @@
 
       error = func( face, gindex, 1, flags, padvance );
       if ( !error )
-        return _ft_face_scale_advances( face, padvance, 1, flags );
+        return ft_face_scale_advances_( face, padvance, 1, flags );
 
       if ( FT_ERR_NEQ( error, Unimplemented_Feature ) )
         return error;
@@ -142,7 +142,7 @@
     {
       error = func( face, start, count, flags, padvances );
       if ( !error )
-        return _ft_face_scale_advances( face, padvances, count, flags );
+        return ft_face_scale_advances_( face, padvances, count, flags );
 
       if ( FT_ERR_NEQ( error, Unimplemented_Feature ) )
         return error;
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftbase.h openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftbase.h
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftbase.h	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftbase.h	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Private functions used in the `base' module (specification).
  *
- * Copyright (C) 2008-2022 by
+ * Copyright (C) 2008-2023 by
  * David Turner, Robert Wilhelm, Werner Lemberg, and suzuki toshiya.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftbbox.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftbbox.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftbbox.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftbbox.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType bbox computation (body).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftbitmap.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftbitmap.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftbitmap.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftbitmap.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType utility functions for bitmaps (body).
  *
- * Copyright (C) 2004-2022 by
+ * Copyright (C) 2004-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -66,11 +66,8 @@
   {
     FT_Memory  memory;
     FT_Error   error  = FT_Err_Ok;
-
-    FT_Int    pitch;
-    FT_ULong  size;
-
-    FT_Int  source_pitch_sign, target_pitch_sign;
+    FT_Int     pitch;
+    FT_Int     flip;
 
 
     if ( !library )
@@ -82,53 +79,29 @@
     if ( source == target )
       return FT_Err_Ok;
 
-    source_pitch_sign = source->pitch < 0 ? -1 : 1;
-    target_pitch_sign = target->pitch < 0 ? -1 : 1;
+    flip = ( source->pitch < 0 && target->pitch > 0 ) ||
+           ( source->pitch > 0 && target->pitch < 0 );
 
-    if ( !source->buffer )
-    {
-      *target = *source;
-      if ( source_pitch_sign != target_pitch_sign )
-        target->pitch = -target->pitch;
+    memory = library->memory;
+    FT_FREE( target->buffer );
+
+    *target = *source;
+
+    if ( flip )
+      target->pitch = -target->pitch;
 
+    if ( !source->buffer )
       return FT_Err_Ok;
-    }
 
-    memory = library->memory;
     pitch  = source->pitch;
-
     if ( pitch < 0 )
       pitch = -pitch;
-    size = (FT_ULong)pitch * source->rows;
-
-    if ( target->buffer )
-    {
-      FT_Int    target_pitch = target->pitch;
-      FT_ULong  target_size;
 
-
-      if ( target_pitch < 0 )
-        target_pitch = -target_pitch;
-      target_size = (FT_ULong)target_pitch * target->rows;
-
-      if ( target_size != size )
-        FT_MEM_QREALLOC( target->buffer, target_size, size );
-    }
-    else
-      FT_MEM_QALLOC( target->buffer, size );
+    FT_MEM_QALLOC_MULT( target->buffer, target->rows, pitch );
 
     if ( !error )
     {
-      unsigned char *p;
-
-
-      p = target->buffer;
-      *target = *source;
-      target->buffer = p;
-
-      if ( source_pitch_sign == target_pitch_sign )
-        FT_MEM_COPY( target->buffer, source->buffer, size );
-      else
+      if ( flip )
       {
         /* take care of bitmap flow */
         FT_UInt   i;
@@ -146,6 +119,9 @@
           t -= pitch;
         }
       }
+      else
+        FT_MEM_COPY( target->buffer, source->buffer,
+                     (FT_Long)source->rows * pitch );
     }
 
     return error;
@@ -542,39 +518,31 @@
     case FT_PIXEL_MODE_LCD_V:
     case FT_PIXEL_MODE_BGRA:
       {
-        FT_Int    pad, old_target_pitch, target_pitch;
-        FT_ULong  old_size;
+        FT_Int  width = (FT_Int)source->width;
+        FT_Int  neg   = ( target->pitch == 0 && source->pitch < 0 ) ||
+                          target->pitch  < 0;
 
 
-        old_target_pitch = target->pitch;
-        if ( old_target_pitch < 0 )
-          old_target_pitch = -old_target_pitch;
-
-        old_size = target->rows * (FT_UInt)old_target_pitch;
+        FT_Bitmap_Done( library, target );
 
         target->pixel_mode = FT_PIXEL_MODE_GRAY;
         target->rows       = source->rows;
         target->width      = source->width;
 
-        pad = 0;
-        if ( alignment > 0 )
+        if ( alignment )
         {
-          pad = (FT_Int)source->width % alignment;
-          if ( pad != 0 )
-            pad = alignment - pad;
-        }
+          FT_Int  rem = width % alignment;
 
-        target_pitch = (FT_Int)source->width + pad;
 
-        if ( target_pitch > 0                                               &&
-             (FT_ULong)target->rows > FT_ULONG_MAX / (FT_ULong)target_pitch )
-          return FT_THROW( Invalid_Argument );
+          if ( rem )
+            width = alignment > 0 ? width - rem + alignment
+                                  : width - rem - alignment;
+        }
 
-        if ( FT_QREALLOC( target->buffer,
-                          old_size, target->rows * (FT_UInt)target_pitch ) )
+        if ( FT_QALLOC_MULT( target->buffer, target->rows, width ) )
           return error;
 
-        target->pitch = target->pitch < 0 ? -target_pitch : target_pitch;
+        target->pitch = neg ? -width : width;
       }
       break;
 
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftcalc.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftcalc.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftcalc.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftcalc.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Arithmetic computations (body).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -1085,4 +1085,71 @@
   }
 
 
+  FT_BASE_DEF( FT_Int32 )
+  FT_MulAddFix( FT_Fixed*  s,
+                FT_Int32*  f,
+                FT_UInt    count )
+  {
+    FT_UInt   i;
+    FT_Int64  temp;
+#ifndef FT_INT64
+    FT_Int64  halfUnit;
+#endif
+
+
+#ifdef FT_INT64
+    temp = 0;
+
+    for ( i = 0; i < count; ++i )
+      temp += (FT_Int64)s[i] * f[i];
+
+    return ( temp + 0x8000 ) >> 16;
+#else
+    temp.hi = 0;
+    temp.lo = 0;
+
+    for ( i = 0; i < count; ++i )
+    {
+      FT_Int64  multResult;
+
+      FT_Int     sign  = 1;
+      FT_UInt32  carry = 0;
+
+      FT_UInt32  scalar;
+      FT_UInt32  factor;
+
+
+      scalar = (FT_UInt32)s[i];
+      factor = (FT_UInt32)f[i];
+
+      FT_MOVE_SIGN( s[i], scalar, sign );
+      FT_MOVE_SIGN( f[i], factor, sign );
+
+      ft_multo64( scalar, factor, &multResult );
+
+      if ( sign < 0 )
+      {
+        /* Emulated `FT_Int64` negation. */
+        carry = ( multResult.lo == 0 );
+
+        multResult.lo = ~multResult.lo + 1;
+        multResult.hi = ~multResult.hi + carry;
+      }
+
+      FT_Add64( &temp, &multResult, &temp );
+    }
+
+    /* Round value. */
+    halfUnit.hi = 0;
+    halfUnit.lo = 0x8000;
+    FT_Add64( &temp, &halfUnit, &temp );
+
+    return (FT_Int32)( ( (FT_Int32)( temp.hi & 0xFFFF ) << 16 ) |
+                                   ( temp.lo >> 16 )            );
+
+#endif /* !FT_INT64 */
+
+  }
+
+
 /* END */
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftcid.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftcid.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftcid.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftcid.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType API for accessing CID font information.
  *
- * Copyright (C) 2007-2022 by
+ * Copyright (C) 2007-2023 by
  * Derek Clegg and Michael Toftdal.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftcolor.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftcolor.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftcolor.c	1970-01-01 00:00:00.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftcolor.c	2023-10-06 05:33:33.000000000 +0000
@@ -0,0 +1,156 @@
+/****************************************************************************
+ *
+ * ftcolor.c
+ *
+ *   FreeType's glyph color management (body).
+ *
+ * Copyright (C) 2018-2023 by
+ * David Turner, Robert Wilhelm, and Werner Lemberg.
+ *
+ * This file is part of the FreeType project, and may only be used,
+ * modified, and distributed under the terms of the FreeType project
+ * license, LICENSE.TXT.  By continuing to use, modify, or distribute
+ * this file you indicate that you have read the license and
+ * understand and accept it fully.
+ *
+ */
+
+
+#include 
+#include 
+#include 
+#include 
+
+
+#ifdef TT_CONFIG_OPTION_COLOR_LAYERS
+
+  static
+  const FT_Palette_Data  null_palette_data = { 0, NULL, NULL, 0, NULL };
+
+
+  /* documentation is in ftcolor.h */
+
+  FT_EXPORT_DEF( FT_Error )
+  FT_Palette_Data_Get( FT_Face           face,
+                       FT_Palette_Data  *apalette_data )
+  {
+    if ( !face )
+      return FT_THROW( Invalid_Face_Handle );
+    if ( !apalette_data)
+      return FT_THROW( Invalid_Argument );
+
+    if ( FT_IS_SFNT( face ) )
+      *apalette_data = ( (TT_Face)face )->palette_data;
+    else
+      *apalette_data = null_palette_data;
+
+    return FT_Err_Ok;
+  }
+
+
+  /* documentation is in ftcolor.h */
+
+  FT_EXPORT_DEF( FT_Error )
+  FT_Palette_Select( FT_Face     face,
+                     FT_UShort   palette_index,
+                     FT_Color*  *apalette )
+  {
+    FT_Error  error;
+
+    TT_Face       ttface;
+    SFNT_Service  sfnt;
+
+
+    if ( !face )
+      return FT_THROW( Invalid_Face_Handle );
+
+    if ( !FT_IS_SFNT( face ) )
+    {
+      if ( apalette )
+        *apalette = NULL;
+
+      return FT_Err_Ok;
+    }
+
+    ttface = (TT_Face)face;
+    sfnt   = (SFNT_Service)ttface->sfnt;
+
+    error = sfnt->set_palette( ttface, palette_index );
+    if ( error )
+      return error;
+
+    ttface->palette_index = palette_index;
+
+    if ( apalette )
+      *apalette = ttface->palette;
+
+    return FT_Err_Ok;
+  }
+
+
+  /* documentation is in ftcolor.h */
+
+  FT_EXPORT_DEF( FT_Error )
+  FT_Palette_Set_Foreground_Color( FT_Face   face,
+                                   FT_Color  foreground_color )
+  {
+    TT_Face  ttface;
+
+
+    if ( !face )
+      return FT_THROW( Invalid_Face_Handle );
+
+    if ( !FT_IS_SFNT( face ) )
+      return FT_Err_Ok;
+
+    ttface = (TT_Face)face;
+
+    ttface->foreground_color      = foreground_color;
+    ttface->have_foreground_color = 1;
+
+    return FT_Err_Ok;
+  }
+
+#else /* !TT_CONFIG_OPTION_COLOR_LAYERS */
+
+  FT_EXPORT_DEF( FT_Error )
+  FT_Palette_Data_Get( FT_Face           face,
+                       FT_Palette_Data  *apalette_data )
+  {
+    FT_UNUSED( face );
+    FT_UNUSED( apalette_data );
+
+
+    return FT_THROW( Unimplemented_Feature );
+  }
+
+
+  FT_EXPORT_DEF( FT_Error )
+  FT_Palette_Select( FT_Face     face,
+                     FT_UShort   palette_index,
+                     FT_Color*  *apalette )
+  {
+    FT_UNUSED( face );
+    FT_UNUSED( palette_index );
+    FT_UNUSED( apalette );
+
+
+    return FT_THROW( Unimplemented_Feature );
+  }
+
+
+  FT_EXPORT_DEF( FT_Error )
+  FT_Palette_Set_Foreground_Color( FT_Face   face,
+                                   FT_Color  foreground_color )
+  {
+    FT_UNUSED( face );
+    FT_UNUSED( foreground_color );
+
+
+    return FT_THROW( Unimplemented_Feature );
+  }
+
+#endif /* !TT_CONFIG_OPTION_COLOR_LAYERS */
+
+
+/* END */
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftdbgmem.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftdbgmem.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftdbgmem.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftdbgmem.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Memory debugger (body).
  *
- * Copyright (C) 2001-2022 by
+ * Copyright (C) 2001-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -35,8 +35,8 @@
 
 #include FT_CONFIG_STANDARD_LIBRARY_H
 
-  FT_BASE_DEF( const char* )  _ft_debug_file   = NULL;
-  FT_BASE_DEF( long )         _ft_debug_lineno = 0;
+  FT_BASE_DEF( const char* )  ft_debug_file_   = NULL;
+  FT_BASE_DEF( long )         ft_debug_lineno_ = 0;
 
   extern void
   FT_DumpMemory( FT_Memory  memory );
@@ -415,8 +415,8 @@
 
     /* cast to FT_PtrDist first since void* can be larger */
     /* than FT_UInt32 and GCC 4.1.1 emits a warning       */
-    hash  = (FT_UInt32)(FT_PtrDist)(void*)_ft_debug_file +
-              (FT_UInt32)( 5 * _ft_debug_lineno );
+    hash  = (FT_UInt32)(FT_PtrDist)(void*)ft_debug_file_ +
+              (FT_UInt32)( 5 * ft_debug_lineno_ );
     pnode = &table->sources[hash % FT_MEM_SOURCE_BUCKETS];
 
     for (;;)
@@ -425,8 +425,8 @@
       if ( !node )
         break;
 
-      if ( node->file_name == _ft_debug_file   &&
-           node->line_no   == _ft_debug_lineno )
+      if ( node->file_name == ft_debug_file_   &&
+           node->line_no   == ft_debug_lineno_ )
         goto Exit;
 
       pnode = &node->link;
@@ -437,8 +437,8 @@
       ft_mem_debug_panic(
         "not enough memory to perform memory debugging\n" );
 
-    node->file_name = _ft_debug_file;
-    node->line_no   = _ft_debug_lineno;
+    node->file_name = ft_debug_file_;
+    node->line_no   = ft_debug_lineno_;
 
     node->cur_blocks = 0;
     node->max_blocks = 0;
@@ -495,7 +495,7 @@
             "org=%s:%d new=%s:%d\n",
             node->address, node->size,
             FT_FILENAME( node->source->file_name ), node->source->line_no,
-            FT_FILENAME( _ft_debug_file ), _ft_debug_lineno );
+            FT_FILENAME( ft_debug_file_ ), ft_debug_lineno_ );
         }
       }
 
@@ -582,7 +582,7 @@
             "  Block was allocated at (%s:%ld)\n"
             "  and released at (%s:%ld).",
             address,
-            FT_FILENAME( _ft_debug_file ), _ft_debug_lineno,
+            FT_FILENAME( ft_debug_file_ ), ft_debug_lineno_,
             FT_FILENAME( node->source->file_name ), node->source->line_no,
             FT_FILENAME( node->free_file_name ), node->free_line_no );
 
@@ -604,8 +604,8 @@
           /* we simply invert the node's size to indicate that the node */
           /* was freed.                                                 */
           node->size           = -node->size;
-          node->free_file_name = _ft_debug_file;
-          node->free_line_no   = _ft_debug_lineno;
+          node->free_file_name = ft_debug_file_;
+          node->free_line_no   = ft_debug_lineno_;
         }
         else
         {
@@ -627,7 +627,7 @@
         ft_mem_debug_panic(
           "trying to free unknown block at %p in (%s:%ld)\n",
           address,
-          FT_FILENAME( _ft_debug_file ), _ft_debug_lineno );
+          FT_FILENAME( ft_debug_file_ ), ft_debug_lineno_ );
     }
   }
 
@@ -661,8 +661,8 @@
       table->alloc_count++;
     }
 
-    _ft_debug_file   = "";
-    _ft_debug_lineno = 0;
+    ft_debug_file_   = "";
+    ft_debug_lineno_ = 0;
 
     return (FT_Pointer)block;
   }
@@ -677,8 +677,8 @@
 
     if ( !block )
       ft_mem_debug_panic( "trying to free NULL in (%s:%ld)",
-                          FT_FILENAME( _ft_debug_file ),
-                          _ft_debug_lineno );
+                          FT_FILENAME( ft_debug_file_ ),
+                          ft_debug_lineno_ );
 
     ft_mem_table_remove( table, (FT_Byte*)block, 0 );
 
@@ -687,8 +687,8 @@
 
     table->alloc_count--;
 
-    _ft_debug_file   = "";
-    _ft_debug_lineno = 0;
+    ft_debug_file_   = "";
+    ft_debug_lineno_ = 0;
   }
 
 
@@ -703,8 +703,8 @@
     FT_Pointer   new_block;
     FT_Long      delta;
 
-    const char*  file_name = FT_FILENAME( _ft_debug_file );
-    FT_Long      line_no   = _ft_debug_lineno;
+    const char*  file_name = FT_FILENAME( ft_debug_file_ );
+    FT_Long      line_no   = ft_debug_lineno_;
 
 
     /* unlikely, but possible */
@@ -767,8 +767,8 @@
 
     ft_mem_table_remove( table, (FT_Byte*)block, delta );
 
-    _ft_debug_file   = "";
-    _ft_debug_lineno = 0;
+    ft_debug_file_   = "";
+    ft_debug_lineno_ = 0;
 
     if ( !table->keep_alive )
       ft_mem_table_free( table, block );
@@ -874,7 +874,7 @@
   }
 
 
-  static int
+  FT_COMPARE_DEF( int )
   ft_mem_source_compare( const void*  p1,
                          const void*  p2 )
   {
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftdebug.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftdebug.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftdebug.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftdebug.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Debugging and logging component (body).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftfntfmt.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftfntfmt.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftfntfmt.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftfntfmt.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType utility file for font formats (body).
  *
- * Copyright (C) 2002-2022 by
+ * Copyright (C) 2002-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftfstype.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftfstype.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftfstype.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftfstype.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType utility file to access FSType data (body).
  *
- * Copyright (C) 2008-2022 by
+ * Copyright (C) 2008-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftgasp.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftgasp.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftgasp.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftgasp.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Access of TrueType's `gasp' table (body).
  *
- * Copyright (C) 2007-2022 by
+ * Copyright (C) 2007-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftgloadr.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftgloadr.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftgloadr.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftgloadr.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   The FreeType glyph loader (body).
  *
- * Copyright (C) 2002-2022 by
+ * Copyright (C) 2002-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg
  *
  * This file is part of the FreeType project, and may only be used,
@@ -212,12 +212,12 @@
     FT_Outline*  current = &loader->current.outline;
     FT_Bool      adjust  = 0;
 
-    FT_UInt      new_max, old_max;
+    FT_UInt  new_max, old_max, min_new_max;
 
 
     error = FT_GlyphLoader_CreateExtra( loader );
     if ( error )
-      return error;
+      goto Exit;
 
     /* check points & tags */
     new_max = (FT_UInt)base->n_points + (FT_UInt)current->n_points +
@@ -226,10 +226,18 @@
 
     if ( new_max > old_max )
     {
-      new_max = FT_PAD_CEIL( new_max, 8 );
+      if ( new_max > FT_OUTLINE_POINTS_MAX )
+      {
+        error = FT_THROW( Array_Too_Large );
+        goto Exit;
+      }
 
+      min_new_max = old_max + ( old_max >> 1 );
+      if ( new_max < min_new_max )
+        new_max = min_new_max;
+      new_max = FT_PAD_CEIL( new_max, 8 );
       if ( new_max > FT_OUTLINE_POINTS_MAX )
-        return FT_THROW( Array_Too_Large );
+        new_max = FT_OUTLINE_POINTS_MAX;
 
       if ( FT_RENEW_ARRAY( base->points, old_max, new_max ) ||
            FT_RENEW_ARRAY( base->tags,   old_max, new_max ) )
@@ -254,7 +262,7 @@
 
     error = FT_GlyphLoader_CreateExtra( loader );
     if ( error )
-      return error;
+      goto Exit;
 
     /* check contours */
     old_max = loader->max_contours;
@@ -262,10 +270,18 @@
               n_contours;
     if ( new_max > old_max )
     {
-      new_max = FT_PAD_CEIL( new_max, 4 );
+      if ( new_max > FT_OUTLINE_CONTOURS_MAX )
+      {
+        error = FT_THROW( Array_Too_Large );
+        goto Exit;
+      }
 
+      min_new_max = old_max + ( old_max >> 1 );
+      if ( new_max < min_new_max )
+        new_max = min_new_max;
+      new_max = FT_PAD_CEIL( new_max, 4 );
       if ( new_max > FT_OUTLINE_CONTOURS_MAX )
-        return FT_THROW( Array_Too_Large );
+        new_max = FT_OUTLINE_CONTOURS_MAX;
 
       if ( FT_RENEW_ARRAY( base->contours, old_max, new_max ) )
         goto Exit;
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftglyph.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftglyph.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftglyph.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftglyph.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType convenience functions to handle glyphs (body).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -682,7 +682,10 @@
   Exit2:
     /* if an error occurred, destroy the glyph */
     if ( error )
+    {
       FT_Done_Glyph( glyph );
+      *aglyph = NULL;
+    }
     else
       *aglyph = glyph;
 
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftinit.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftinit.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftinit.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftinit.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType initialization layer (body).
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftlcdfil.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftlcdfil.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftlcdfil.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftlcdfil.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   FreeType API for color filtering of subpixel bitmap glyphs (body).
  *
- * Copyright (C) 2006-2022 by
+ * Copyright (C) 2006-2023 by
  * David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftmac.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftmac.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftmac.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftmac.c	2023-10-06 05:33:33.000000000 +0000
@@ -8,7 +8,7 @@
  * This file is for Mac OS X only; see builds/mac/ftoldmac.c for
  * classic platforms built by MPW.
  *
- * Copyright (C) 1996-2022 by
+ * Copyright (C) 1996-2023 by
  * Just van Rossum, David Turner, Robert Wilhelm, and Werner Lemberg.
  *
  * This file is part of the FreeType project, and may only be used,
@@ -67,6 +67,7 @@
 
 #include 
 #include 
+#include 
 #include 
 #include "ftbase.h"
 
diff -Nru openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftmm.c openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftmm.c
--- openjdk-11-11.0.20+8/src/java.desktop/share/native/libfreetype/src/base/ftmm.c	2023-07-05 07:22:24.000000000 +0000
+++ openjdk-11-11.0.21+9/src/java.desktop/share/native/libfreetype/src/base/ftmm.c	2023-10-06 05:33:33.000000000 +0000
@@ -4,7 +4,7 @@
  *
  *   Mu