JDK 9 RFR of 8148023: File.createTempFile is not adhering to the contract regarding file name lengths
brian.burkhalter at oracle.com
Mon Dec 19 20:54:59 UTC 2016
Thanks for your suggestions. An updated version of the patch is here:
On Dec 19, 2016, at 11:04 AM, Roger Riggs <Roger.Riggs at Oracle.com> wrote:
> - 1906: shortenSubName might reasonably return the new length without
> creating the intermediate string and save on the allocation.
> - generateFile() line 1922 + -- I assume this slow path is infrequently used.
> Otherwise, the computations involving excess could be done arithmetically without actually creating the string
> and only create the name when the final length(s) are decided.
> - line 1952: appending the generated name to the exception is ok but it should omit the directory name;
> its not salient to the error and might expose a sensitive directory name.
> - getNameMax; the length could reasonably be just an int. Long seems a bit excessive
> and raises suspicion that something clever is going on when its just a normal value.
> (Though I see the native code uses jlong)
Changed to an int except for the native Unix call. The invoking Java code clamps a highly unlikely out-of-range long to Integer.MAX_VALUE.
More information about the core-libs-dev