/*

 * Copyright (c) 1996, 2021, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package java.io;

import java.io.ObjectInputFilter.Config;

import java.io.ObjectStreamClass.WeakClassKey;

import java.io.ObjectStreamClass.RecordSupport;

import java.lang.System.Logger;

import java.lang.invoke.MethodHandle;

import java.lang.ref.ReferenceQueue;

import java.lang.reflect.Array;

import java.lang.reflect.InvocationHandler;

import java.lang.reflect.Modifier;

import java.lang.reflect.Proxy;

import java.security.AccessControlContext;

import java.security.AccessController;

import java.security.PrivilegedAction;

import java.security.PrivilegedActionException;

import java.security.PrivilegedExceptionAction;

import java.util.Arrays;

import java.util.Map;

import java.util.Objects;

import java.util.concurrent.ConcurrentHashMap;

import java.util.concurrent.ConcurrentMap;

import static java.io.ObjectStreamClass.processQueue;

import jdk.internal.access.SharedSecrets;

import jdk.internal.event.DeserializationEvent;

import jdk.internal.misc.Unsafe;

import sun.reflect.misc.ReflectUtil;

import sun.security.action.GetBooleanAction;

import sun.security.action.GetIntegerAction;

/**

 * An ObjectInputStream deserializes primitive data and objects previously

 * written using an ObjectOutputStream.

 *

 * <p><strong>Warning: Deserialization of untrusted data is inherently dangerous

 * and should be avoided. Untrusted data should be carefully validated according to the

 * "Serialization and Deserialization" section of the

 * {@extLink secure_coding_guidelines_javase Secure Coding Guidelines for Java SE}.

 * {@extLink serialization_filter_guide Serialization Filtering} describes best

 * practices for defensive use of serial filters.

 * </strong></p>

 *

 * <p>The key to disabling deserialization attacks is to prevent instances of

 * arbitrary classes from being deserialized, thereby preventing the direct or

 * indirect execution of their methods.

 * {@link ObjectInputFilter} describes how to use filters and

 * {@link ObjectInputFilter.Config} describes how to configure the filter and filter factory.

 * Each stream has an optional deserialization filter

 * to check the classes and resource limits during deserialization.

 * The JVM-wide filter factory ensures that a filter can be set on every {@link ObjectInputStream}

 * and every object read from the stream can be checked.

 * The {@linkplain #ObjectInputStream() ObjectInputStream constructors} invoke the filter factory

 * to select the initial filter which may be updated or replaced by {@link #setObjectInputFilter}.

 * <p>

 * If an ObjectInputStream has a filter, the {@link ObjectInputFilter} can check that

 * the classes, array lengths, number of references in the stream, depth, and

 * number of bytes consumed from the input stream are allowed and

 * if not, can terminate deserialization.

 *

 * <p>ObjectOutputStream and ObjectInputStream can provide an application with

 * persistent storage for graphs of objects when used with a FileOutputStream

 * and FileInputStream respectively.  ObjectInputStream is used to recover

 * those objects previously serialized. Other uses include passing objects

 * between hosts using a socket stream or for marshaling and unmarshaling

 * arguments and parameters in a remote communication system.

 *

 * <p>ObjectInputStream ensures that the types of all objects in the graph

 * created from the stream match the classes present in the Java Virtual

 * Machine.  Classes are loaded as required using the standard mechanisms.

 *

 * <p>Only objects that support the java.io.Serializable or

 * java.io.Externalizable interface can be read from streams.

 *

 * <p>The method {@code readObject} is used to read an object from the

 * stream.  Java's safe casting should be used to get the desired type.  In

 * Java, strings and arrays are objects and are treated as objects during

 * serialization. When read they need to be cast to the expected type.

 *

 * <p>Primitive data types can be read from the stream using the appropriate

 * method on DataInput.

 *

 * <p>The default deserialization mechanism for objects restores the contents

 * of each field to the value and type it had when it was written.  Fields

 * declared as transient or static are ignored by the deserialization process.

 * References to other objects cause those objects to be read from the stream

 * as necessary.  Graphs of objects are restored correctly using a reference

 * sharing mechanism.  New objects are always allocated when deserializing,

 * which prevents existing objects from being overwritten.

 *

 * <p>Reading an object is analogous to running the constructors of a new

 * object.  Memory is allocated for the object and initialized to zero (NULL).

 * No-arg constructors are invoked for the non-serializable classes and then

 * the fields of the serializable classes are restored from the stream starting

 * with the serializable class closest to java.lang.object and finishing with

 * the object's most specific class.

 *

 * <p>For example to read from a stream as written by the example in

 * ObjectOutputStream:

 * <br>

 * <pre>

 *      FileInputStream fis = new FileInputStream("t.tmp");

 *      ObjectInputStream ois = new ObjectInputStream(fis);

 *

 *      int i = ois.readInt();

 *      String today = (String) ois.readObject();

 *      Date date = (Date) ois.readObject();

 *

 *      ois.close();

 * </pre>

 *

 * <p>Classes control how they are serialized by implementing either the

 * java.io.Serializable or java.io.Externalizable interfaces.

 *

 * <p>Implementing the Serializable interface allows object serialization to

 * save and restore the entire state of the object and it allows classes to

 * evolve between the time the stream is written and the time it is read.  It

 * automatically traverses references between objects, saving and restoring

 * entire graphs.

 *

 * <p>Serializable classes that require special handling during the

 * serialization and deserialization process should implement the following

 * methods:

 *

 * <pre>

 * private void writeObject(java.io.ObjectOutputStream stream)

 *     throws IOException;

 * private void readObject(java.io.ObjectInputStream stream)

 *     throws IOException, ClassNotFoundException;

 * private void readObjectNoData()

 *     throws ObjectStreamException;

 * </pre>

 *

 * <p>The readObject method is responsible for reading and restoring the state

 * of the object for its particular class using data written to the stream by

 * the corresponding writeObject method.  The method does not need to concern

 * itself with the state belonging to its superclasses or subclasses.  State is

 * restored by reading data from the ObjectInputStream for the individual

 * fields and making assignments to the appropriate fields of the object.

 * Reading primitive data types is supported by DataInput.

 *

 * <p>Any attempt to read object data which exceeds the boundaries of the

 * custom data written by the corresponding writeObject method will cause an

 * OptionalDataException to be thrown with an eof field value of true.

 * Non-object reads which exceed the end of the allotted data will reflect the

 * end of data in the same way that they would indicate the end of the stream:

 * bytewise reads will return -1 as the byte read or number of bytes read, and

 * primitive reads will throw EOFExceptions.  If there is no corresponding

 * writeObject method, then the end of default serialized data marks the end of

 * the allotted data.

 *

 * <p>Primitive and object read calls issued from within a readExternal method

 * behave in the same manner--if the stream is already positioned at the end of

 * data written by the corresponding writeExternal method, object reads will

 * throw OptionalDataExceptions with eof set to true, bytewise reads will

 * return -1, and primitive reads will throw EOFExceptions.  Note that this

 * behavior does not hold for streams written with the old

 * {@code ObjectStreamConstants.PROTOCOL_VERSION_1} protocol, in which the

 * end of data written by writeExternal methods is not demarcated, and hence

 * cannot be detected.

 *

 * <p>The readObjectNoData method is responsible for initializing the state of

 * the object for its particular class in the event that the serialization

 * stream does not list the given class as a superclass of the object being

 * deserialized.  This may occur in cases where the receiving party uses a

 * different version of the deserialized instance's class than the sending

 * party, and the receiver's version extends classes that are not extended by

 * the sender's version.  This may also occur if the serialization stream has

 * been tampered; hence, readObjectNoData is useful for initializing

 * deserialized objects properly despite a "hostile" or incomplete source

 * stream.

 *

 * <p>Serialization does not read or assign values to the fields of any object

 * that does not implement the java.io.Serializable interface.  Subclasses of

 * Objects that are not serializable can be serializable. In this case the

 * non-serializable class must have a no-arg constructor to allow its fields to

 * be initialized.  In this case it is the responsibility of the subclass to

 * save and restore the state of the non-serializable class. It is frequently

 * the case that the fields of that class are accessible (public, package, or

 * protected) or that there are get and set methods that can be used to restore

 * the state.

 *

 * <p>Any exception that occurs while deserializing an object will be caught by

 * the ObjectInputStream and abort the reading process.

 *

 * <p>Implementing the Externalizable interface allows the object to assume

 * complete control over the contents and format of the object's serialized

 * form.  The methods of the Externalizable interface, writeExternal and

 * readExternal, are called to save and restore the objects state.  When

 * implemented by a class they can write and read their own state using all of

 * the methods of ObjectOutput and ObjectInput.  It is the responsibility of

 * the objects to handle any versioning that occurs.

 *

 * <p>Enum constants are deserialized differently than ordinary serializable or

 * externalizable objects.  The serialized form of an enum constant consists

 * solely of its name; field values of the constant are not transmitted.  To

 * deserialize an enum constant, ObjectInputStream reads the constant name from

 * the stream; the deserialized constant is then obtained by calling the static

 * method {@code Enum.valueOf(Class, String)} with the enum constant's

 * base type and the received constant name as arguments.  Like other

 * serializable or externalizable objects, enum constants can function as the

 * targets of back references appearing subsequently in the serialization

 * stream.  The process by which enum constants are deserialized cannot be

 * customized: any class-specific readObject, readObjectNoData, and readResolve

 * methods defined by enum types are ignored during deserialization.

 * Similarly, any serialPersistentFields or serialVersionUID field declarations

 * are also ignored--all enum types have a fixed serialVersionUID of 0L.

 *

 * <a id="record-serialization"></a>

 * <p>Records are serialized differently than ordinary serializable or externalizable

 * objects. During deserialization the record's canonical constructor is invoked

 * to construct the record object. Certain serialization-related methods, such

 * as readObject and writeObject, are ignored for serializable records. See

 * <a href="{@docRoot}/../specs/serialization/serial-arch.html#serialization-of-records">

 * <cite>Java Object Serialization Specification,</cite> Section 1.13,

 * "Serialization of Records"</a> for additional information.

 *

 * @author      Mike Warres

 * @author      Roger Riggs

 * @see java.io.DataInput

 * @see java.io.ObjectOutputStream

 * @see java.io.Serializable

 * @see <a href="{@docRoot}/../specs/serialization/input.html">

 *      <cite>Java Object Serialization Specification,</cite> Section 3, "Object Input Classes"</a>

 * @since   1.1

 */

public class ObjectInputStream

    extends InputStream implements ObjectInput, ObjectStreamConstants

{

    /** handle value representing null */

    private static final int NULL_HANDLE = -1;

    /** marker for unshared objects in internal handle table */

    private static final Object unsharedMarker = new Object();

    /**

     * immutable table mapping primitive type names to corresponding

     * class objects

     */

    private static final Map<String, Class<?>> primClasses =

        Map.of("boolean", boolean.class,

               "byte", byte.class,

               "char", char.class,

               "short", short.class,

               "int", int.class,

               "long", long.class,

               "float", float.class,

               "double", double.class,

               "void", void.class);

    private static class Caches {

        /** cache of subclass security audit results */

        static final ConcurrentMap<WeakClassKey,Boolean> subclassAudits =

            new ConcurrentHashMap<>();

        /** queue for WeakReferences to audited subclasses */

        static final ReferenceQueue<Class<?>> subclassAuditsQueue =

            new ReferenceQueue<>();

        /**

         * Property to permit setting a filter after objects

         * have been read.

         * See {@link #setObjectInputFilter(ObjectInputFilter)}

         */

        static final boolean SET_FILTER_AFTER_READ = GetBooleanAction

                .privilegedGetProperty("jdk.serialSetFilterAfterRead");

        /**

         * Property to override the implementation limit on the number

         * of interfaces allowed for Proxies. The property value is clamped to 0..65535.

         * The maximum number of interfaces allowed for a proxy is limited to 65535 by

         * {@link java.lang.reflect.Proxy#newProxyInstance(ClassLoader, Class[], InvocationHandler)}.

         */

        static final int PROXY_INTERFACE_LIMIT = Math.max(0, Math.min(65535, GetIntegerAction

                .privilegedGetProperty("jdk.serialProxyInterfaceLimit", 65535)));

    }

    /*

     * Separate class to defer initialization of logging until needed.

     */

    private static class Logging {

        /*

         * Logger for ObjectInputFilter results.

         * Setup the filter logger if it is set to DEBUG or TRACE.

         * (Assuming it will not change).

         */

        static final System.Logger filterLogger;

        static {

            Logger filterLog = System.getLogger("java.io.serialization");

            filterLogger = (filterLog.isLoggable(Logger.Level.DEBUG)

                    || filterLog.isLoggable(Logger.Level.TRACE)) ? filterLog : null;

        }

    }

    /** filter stream for handling block data conversion */

    private final BlockDataInputStream bin;

    /** validation callback list */

    private final ValidationList vlist;

    /** recursion depth */

    private long depth;

    /** Total number of references to any type of object, class, enum, proxy, etc. */

    private long totalObjectRefs;

    /** whether stream is closed */

    private boolean closed;

    /** wire handle -> obj/exception map */

    private final HandleTable handles;

    /** scratch field for passing handle values up/down call stack */

    private int passHandle = NULL_HANDLE;

    /** flag set when at end of field value block with no TC_ENDBLOCKDATA */

    private boolean defaultDataEnd = false;

    /** if true, invoke readObjectOverride() instead of readObject() */

    private final boolean enableOverride;

    /** if true, invoke resolveObject() */

    private boolean enableResolve;

    /**

     * Context during upcalls to class-defined readObject methods; holds

     * object currently being deserialized and descriptor for current class.

     * Null when not during readObject upcall.

     */

    private SerialCallbackContext curContext;

    /**

     * Filter of class descriptors and classes read from the stream;

     * may be null.

     */

    private ObjectInputFilter serialFilter;

    /**

     * True if the stream-specific filter has been set; initially false.

     */

    private boolean streamFilterSet;

    /**

     * Creates an ObjectInputStream that reads from the specified InputStream.

     * A serialization stream header is read from the stream and verified.

     * This constructor will block until the corresponding ObjectOutputStream

     * has written and flushed the header.

     *

     * <p>The constructor initializes the deserialization filter to the filter returned

     * by invoking the {@link Config#getSerialFilterFactory()} with {@code null} for the current filter

     * and the {@linkplain Config#getSerialFilter() static JVM-wide filter} for the requested filter.

     *

     * <p>If a security manager is installed, this constructor will check for

     * the "enableSubclassImplementation" SerializablePermission when invoked

     * directly or indirectly by the constructor of a subclass which overrides

     * the ObjectInputStream.readFields or ObjectInputStream.readUnshared

     * methods.

     *

     * @param   in input stream to read from

     * @throws  StreamCorruptedException if the stream header is incorrect

     * @throws  IOException if an I/O error occurs while reading stream header

     * @throws  SecurityException if untrusted subclass illegally overrides

     *          security-sensitive methods

     * @throws  NullPointerException if {@code in} is {@code null}

     * @see     ObjectInputStream#ObjectInputStream()

     * @see     ObjectInputStream#readFields()

     * @see     ObjectOutputStream#ObjectOutputStream(OutputStream)

     */

    public ObjectInputStream(InputStream in) throws IOException {

        verifySubclass();

        bin = new BlockDataInputStream(in);

        handles = new HandleTable(10);

        vlist = new ValidationList();

        streamFilterSet = false;

        serialFilter = Config.getSerialFilterFactorySingleton().apply(null, Config.getSerialFilter());

        enableOverride = false;

        readStreamHeader();

        bin.setBlockDataMode(true);

    }

    /**

     * Provide a way for subclasses that are completely reimplementing

     * ObjectInputStream to not have to allocate private data just used by this

     * implementation of ObjectInputStream.

     *

     * <p>The constructor initializes the deserialization filter to the filter returned

     * by invoking the {@link Config#getSerialFilterFactory()} with {@code null} for the current filter

     * and the {@linkplain Config#getSerialFilter() static JVM-wide filter} for the requested filter.

     *

     * <p>If there is a security manager installed, this method first calls the

     * security manager's {@code checkPermission} method with the

     * {@code SerializablePermission("enableSubclassImplementation")}

     * permission to ensure it's ok to enable subclassing.

     *

     * @throws  SecurityException if a security manager exists and its

     *          {@code checkPermission} method denies enabling

     *          subclassing.

     * @throws  IOException if an I/O error occurs while creating this stream

     * @see SecurityManager#checkPermission

     * @see java.io.SerializablePermission

     */

    protected ObjectInputStream() throws IOException, SecurityException {

        @SuppressWarnings("removal")

        SecurityManager sm = System.getSecurityManager();

        if (sm != null) {

            sm.checkPermission(SUBCLASS_IMPLEMENTATION_PERMISSION);

        }

        bin = null;

        handles = null;

        vlist = null;

        streamFilterSet = false;

        serialFilter = Config.getSerialFilterFactorySingleton().apply(null, Config.getSerialFilter());

        enableOverride = true;

    }

    /**

     * Read an object from the ObjectInputStream.  The class of the object, the

     * signature of the class, and the values of the non-transient and

     * non-static fields of the class and all of its supertypes are read.

     * Default deserializing for a class can be overridden using the writeObject

     * and readObject methods.  Objects referenced by this object are read

     * transitively so that a complete equivalent graph of objects is

     * reconstructed by readObject.

     *

     * <p>The root object is completely restored when all of its fields and the

     * objects it references are completely restored.  At this point the object

     * validation callbacks are executed in order based on their registered

     * priorities. The callbacks are registered by objects (in the readObject

     * special methods) as they are individually restored.

     *

     * <p>The deserialization filter, when not {@code null}, is invoked for

     * each object (regular or class) read to reconstruct the root object.

     * See {@link #setObjectInputFilter(ObjectInputFilter) setObjectInputFilter} for details.

     *

     * <p>Exceptions are thrown for problems with the InputStream and for

     * classes that should not be deserialized.  All exceptions are fatal to

     * the InputStream and leave it in an indeterminate state; it is up to the

     * caller to ignore or recover the stream state.

     *

     * @throws  ClassNotFoundException Class of a serialized object cannot be

     *          found.

     * @throws  InvalidClassException Something is wrong with a class used by

     *          deserialization.

     * @throws  StreamCorruptedException Control information in the

     *          stream is inconsistent.

     * @throws  OptionalDataException Primitive data was found in the

     *          stream instead of objects.

     * @throws  IOException Any of the usual Input/Output related exceptions.

     */

    public final Object readObject()

        throws IOException, ClassNotFoundException {

        return readObject(Object.class);

    }

    /**

     * Reads a String and only a string.

     *

     * @return  the String read

     * @throws  EOFException If end of file is reached.

     * @throws  IOException If other I/O error has occurred.

     */

    private String readString() throws IOException {

        try {

            return (String) readObject(String.class);

        } catch (ClassNotFoundException cnf) {

            throw new IllegalStateException(cnf);

        }

    }

    /**

     * Internal method to read an object from the ObjectInputStream of the expected type.

     * Called only from {@code readObject()} and {@code readString()}.

     * Only {@code Object.class} and {@code String.class} are supported.

     *

     * @param type the type expected; either Object.class or String.class

     * @return an object of the type

     * @throws  IOException Any of the usual Input/Output related exceptions.

     * @throws  ClassNotFoundException Class of a serialized object cannot be

     *          found.

     */

    private final Object readObject(Class<?> type)

        throws IOException, ClassNotFoundException

    {

        if (enableOverride) {

            return readObjectOverride();

        }

        if (! (type == Object.class || type == String.class))

            throw new AssertionError("internal error");

        // if nested read, passHandle contains handle of enclosing object

        int outerHandle = passHandle;

        try {

            Object obj = readObject0(type, false);

            handles.markDependency(outerHandle, passHandle);

            ClassNotFoundException ex = handles.lookupException(passHandle);

            if (ex != null) {

                throw ex;

            }

            if (depth == 0) {

                vlist.doCallbacks();

                freeze();

            }

            return obj;

        } finally {

            passHandle = outerHandle;

            if (closed && depth == 0) {

                clear();

            }

        }

    }

    /**

     * This method is called by trusted subclasses of ObjectInputStream that

     * constructed ObjectInputStream using the protected no-arg constructor.

     * The subclass is expected to provide an override method with the modifier

     * "final".

     *

     * @return  the Object read from the stream.

     * @throws  ClassNotFoundException Class definition of a serialized object

     *          cannot be found.

     * @throws  OptionalDataException Primitive data was found in the stream

     *          instead of objects.

     * @throws  IOException if I/O errors occurred while reading from the

     *          underlying stream

     * @see #ObjectInputStream()

     * @see #readObject()

     * @since 1.2

     */

    protected Object readObjectOverride()

        throws IOException, ClassNotFoundException

    {

        return null;

    }

    /**

     * Reads an "unshared" object from the ObjectInputStream.  This method is

     * identical to readObject, except that it prevents subsequent calls to

     * readObject and readUnshared from returning additional references to the

     * deserialized instance obtained via this call.  Specifically:

     * <ul>

     *   <li>If readUnshared is called to deserialize a back-reference (the

     *       stream representation of an object which has been written

     *       previously to the stream), an ObjectStreamException will be

     *       thrown.

     *

     *   <li>If readUnshared returns successfully, then any subsequent attempts

     *       to deserialize back-references to the stream handle deserialized

     *       by readUnshared will cause an ObjectStreamException to be thrown.

     * </ul>

     * Deserializing an object via readUnshared invalidates the stream handle

     * associated with the returned object.  Note that this in itself does not

     * always guarantee that the reference returned by readUnshared is unique;

     * the deserialized object may define a readResolve method which returns an

     * object visible to other parties, or readUnshared may return a Class

     * object or enum constant obtainable elsewhere in the stream or through

     * external means. If the deserialized object defines a readResolve method

     * and the invocation of that method returns an array, then readUnshared

     * returns a shallow clone of that array; this guarantees that the returned

     * array object is unique and cannot be obtained a second time from an

     * invocation of readObject or readUnshared on the ObjectInputStream,

     * even if the underlying data stream has been manipulated.

     *

     * <p>The deserialization filter, when not {@code null}, is invoked for

     * each object (regular or class) read to reconstruct the root object.

     * See {@link #setObjectInputFilter(ObjectInputFilter) setObjectInputFilter} for details.

     *

     * <p>ObjectInputStream subclasses which override this method can only be

     * constructed in security contexts possessing the

     * "enableSubclassImplementation" SerializablePermission; any attempt to

     * instantiate such a subclass without this permission will cause a

     * SecurityException to be thrown.

     *

     * @return  reference to deserialized object

     * @throws  ClassNotFoundException if class of an object to deserialize

     *          cannot be found

     * @throws  StreamCorruptedException if control information in the stream

     *          is inconsistent

     * @throws  ObjectStreamException if object to deserialize has already

     *          appeared in stream

     * @throws  OptionalDataException if primitive data is next in stream

     * @throws  IOException if an I/O error occurs during deserialization

     * @since   1.4

     */

    public Object readUnshared() throws IOException, ClassNotFoundException {

        // if nested read, passHandle contains handle of enclosing object

        int outerHandle = passHandle;

        try {

            Object obj = readObject0(Object.class, true);

            handles.markDependency(outerHandle, passHandle);

            ClassNotFoundException ex = handles.lookupException(passHandle);

            if (ex != null) {

                throw ex;

            }

            if (depth == 0) {

                vlist.doCallbacks();

                freeze();

            }

            return obj;

        } finally {

            passHandle = outerHandle;

            if (closed && depth == 0) {

                clear();

            }

        }

    }

    /**

     * Read the non-static and non-transient fields of the current class from

     * this stream.  This may only be called from the readObject method of the

     * class being deserialized. It will throw the NotActiveException if it is

     * called otherwise.

     *

     * @throws  ClassNotFoundException if the class of a serialized object

     *          could not be found.

     * @throws  IOException if an I/O error occurs.

     * @throws  NotActiveException if the stream is not currently reading

     *          objects.

     */

    public void defaultReadObject()

        throws IOException, ClassNotFoundException

    {

        SerialCallbackContext ctx = curContext;

        if (ctx == null) {

            throw new NotActiveException("not in call to readObject");

        }

        Object curObj = ctx.getObj();

        ObjectStreamClass curDesc = ctx.getDesc();

        bin.setBlockDataMode(false);

        // Read fields of the current descriptor into a new FieldValues

        FieldValues values = new FieldValues(curDesc, true);

        if (curObj != null) {

            values.defaultCheckFieldValues(curObj);

            values.defaultSetFieldValues(curObj);

        }

        bin.setBlockDataMode(true);

        if (!curDesc.hasWriteObjectData()) {

            /*

             * Fix for 4360508: since stream does not contain terminating

             * TC_ENDBLOCKDATA tag, set flag so that reading code elsewhere

             * knows to simulate end-of-custom-data behavior.

             */

            defaultDataEnd = true;

        }

        ClassNotFoundException ex = handles.lookupException(passHandle);

        if (ex != null) {

            throw ex;

        }

    }

    /**

     * Reads the persistent fields from the stream and makes them available by

     * name.

     *

     * @return  the {@code GetField} object representing the persistent

     *          fields of the object being deserialized

     * @throws  ClassNotFoundException if the class of a serialized object

     *          could not be found.

     * @throws  IOException if an I/O error occurs.

     * @throws  NotActiveException if the stream is not currently reading

     *          objects.

     * @since 1.2

     */

    public ObjectInputStream.GetField readFields()

        throws IOException, ClassNotFoundException

    {

        SerialCallbackContext ctx = curContext;

        if (ctx == null) {

            throw new NotActiveException("not in call to readObject");

        }

        ctx.checkAndSetUsed();

        ObjectStreamClass curDesc = ctx.getDesc();

        bin.setBlockDataMode(false);

        // Read fields of the current descriptor into a new FieldValues

        FieldValues values = new FieldValues(curDesc, false);

        bin.setBlockDataMode(true);

        if (!curDesc.hasWriteObjectData()) {

            /*

             * Fix for 4360508: since stream does not contain terminating

             * TC_ENDBLOCKDATA tag, set flag so that reading code elsewhere

             * knows to simulate end-of-custom-data behavior.

             */

            defaultDataEnd = true;

        }

        return values;

    }

    /**

     * Register an object to be validated before the graph is returned.  While

     * similar to resolveObject these validations are called after the entire

     * graph has been reconstituted.  Typically, a readObject method will

     * register the object with the stream so that when all of the objects are

     * restored a final set of validations can be performed.

     *

     * @param   obj the object to receive the validation callback.

     * @param   prio controls the order of callbacks;zero is a good default.

     *          Use higher numbers to be called back earlier, lower numbers for

     *          later callbacks. Within a priority, callbacks are processed in

     *          no particular order.

     * @throws  NotActiveException The stream is not currently reading objects

     *          so it is invalid to register a callback.

     * @throws  InvalidObjectException The validation object is null.

     */

    public void registerValidation(ObjectInputValidation obj, int prio)

        throws NotActiveException, InvalidObjectException

    {

        if (depth == 0) {

            throw new NotActiveException("stream inactive");

        }

        vlist.register(obj, prio);

    }

    /**

     * Load the local class equivalent of the specified stream class

     * description.  Subclasses may implement this method to allow classes to

     * be fetched from an alternate source.

     *

     * <p>The corresponding method in {@code ObjectOutputStream} is

     * {@code annotateClass}.  This method will be invoked only once for

     * each unique class in the stream.  This method can be implemented by

     * subclasses to use an alternate loading mechanism but must return a

     * {@code Class} object. Once returned, if the class is not an array

     * class, its serialVersionUID is compared to the serialVersionUID of the

     * serialized class, and if there is a mismatch, the deserialization fails

     * and an {@link InvalidClassException} is thrown.

     *

     * <p>The default implementation of this method in

     * {@code ObjectInputStream} returns the result of calling

     * <pre>

     *     Class.forName(desc.getName(), false, loader)

     * </pre>

     * where {@code loader} is the first class loader on the current

     * thread's stack (starting from the currently executing method) that is

     * neither the {@linkplain ClassLoader#getPlatformClassLoader() platform

     * class loader} nor its ancestor; otherwise, {@code loader} is the

     * <em>platform class loader</em>. If this call results in a

     * {@code ClassNotFoundException} and the name of the passed

     * {@code ObjectStreamClass} instance is the Java language keyword

     * for a primitive type or void, then the {@code Class} object

     * representing that primitive type or void will be returned

     * (e.g., an {@code ObjectStreamClass} with the name

     * {@code "int"} will be resolved to {@code Integer.TYPE}).

     * Otherwise, the {@code ClassNotFoundException} will be thrown to

     * the caller of this method.

     *

     * @param   desc an instance of class {@code ObjectStreamClass}

     * @return  a {@code Class} object corresponding to {@code desc}

     * @throws  IOException any of the usual Input/Output exceptions.

     * @throws  ClassNotFoundException if class of a serialized object cannot

     *          be found.

     */

    protected Class<?> resolveClass(ObjectStreamClass desc)

        throws IOException, ClassNotFoundException

    {

        String name = desc.getName();

        try {

            return Class.forName(name, false, latestUserDefinedLoader());

        } catch (ClassNotFoundException ex) {

            Class<?> cl = primClasses.get(name);

            if (cl != null) {

                return cl;

            } else {

                throw ex;

            }

        }

    }

    /**

     * Returns a proxy class that implements the interfaces named in a proxy

     * class descriptor; subclasses may implement this method to read custom

     * data from the stream along with the descriptors for dynamic proxy

     * classes, allowing them to use an alternate loading mechanism for the

     * interfaces and the proxy class.

     *

     * <p>This method is called exactly once for each unique proxy class

     * descriptor in the stream.

     *

     * <p>The corresponding method in {@code ObjectOutputStream} is

     * {@code annotateProxyClass}.  For a given subclass of

     * {@code ObjectInputStream} that overrides this method, the

     * {@code annotateProxyClass} method in the corresponding subclass of

     * {@code ObjectOutputStream} must write any data or objects read by

     * this method.

     *

     * <p>The default implementation of this method in

     * {@code ObjectInputStream} returns the result of calling

     * {@code Proxy.getProxyClass} with the list of {@code Class}

     * objects for the interfaces that are named in the {@code interfaces}

     * parameter.  The {@code Class} object for each interface name

     * {@code i} is the value returned by calling

     * <pre>

     *     Class.forName(i, false, loader)

     * </pre>

     * where {@code loader} is the first class loader on the current

     * thread's stack (starting from the currently executing method) that is

     * neither the {@linkplain ClassLoader#getPlatformClassLoader() platform

     * class loader} nor its ancestor; otherwise, {@code loader} is the

     * <em>platform class loader</em>.

     * Unless any of the resolved interfaces are non-public, this same value

     * of {@code loader} is also the class loader passed to

     * {@code Proxy.getProxyClass}; if non-public interfaces are present,

     * their class loader is passed instead (if more than one non-public

     * interface class loader is encountered, an

     * {@code IllegalAccessError} is thrown).

     * If {@code Proxy.getProxyClass} throws an

     * {@code IllegalArgumentException}, {@code resolveProxyClass}

     * will throw a {@code ClassNotFoundException} containing the

     * {@code IllegalArgumentException}.

     *

     * @param interfaces the list of interface names that were

     *                deserialized in the proxy class descriptor

     * @return  a proxy class for the specified interfaces

     * @throws        IOException any exception thrown by the underlying

     *                {@code InputStream}

     * @throws        ClassNotFoundException if the proxy class or any of the

     *                named interfaces could not be found

     * @see ObjectOutputStream#annotateProxyClass(Class)

     * @since 1.3

     */

    protected Class<?> resolveProxyClass(String[] interfaces)

        throws IOException, ClassNotFoundException

    {

        ClassLoader latestLoader = latestUserDefinedLoader();

        ClassLoader nonPublicLoader = null;

        boolean hasNonPublicInterface = false;

        // define proxy in class loader of non-public interface(s), if any

        Class<?>[] classObjs = new Class<?>[interfaces.length];

        for (int i = 0; i < interfaces.length; i++) {

            Class<?> cl = Class.forName(interfaces[i], false, latestLoader);

            if ((cl.getModifiers() & Modifier.PUBLIC) == 0) {

                if (hasNonPublicInterface) {

                    if (nonPublicLoader != cl.getClassLoader()) {

                        throw new IllegalAccessError(

                            "conflicting non-public interface class loaders");

                    }

                } else {

                    nonPublicLoader = cl.getClassLoader();

                    hasNonPublicInterface = true;

                }

            }

            classObjs[i] = cl;

        }

        try {

            @SuppressWarnings("deprecation")

            Class<?> proxyClass = Proxy.getProxyClass(

                hasNonPublicInterface ? nonPublicLoader : latestLoader,

                classObjs);

            return proxyClass;

        } catch (IllegalArgumentException e) {

            throw new ClassNotFoundException(null, e);

        }

    }

    /**

     * This method will allow trusted subclasses of ObjectInputStream to

     * substitute one object for another during deserialization. Replacing

     * objects is disabled until enableResolveObject is called. The

     * enableResolveObject method checks that the stream requesting to resolve

     * object can be trusted. Every reference to serializable objects is passed

     * to resolveObject.  To insure that the private state of objects is not

     * unintentionally exposed only trusted streams may use resolveObject.

     *

     * <p>This method is called after an object has been read but before it is

     * returned from readObject.  The default resolveObject method just returns

     * the same object.

     *

     * <p>When a subclass is replacing objects it must insure that the

     * substituted object is compatible with every field where the reference

     * will be stored.  Objects whose type is not a subclass of the type of the

     * field or array element abort the deserialization by raising an exception

     * and the object is not be stored.

     *

     * <p>This method is called only once when each object is first

     * encountered.  All subsequent references to the object will be redirected

     * to the new object.

     *

     * @param   obj object to be substituted

     * @return  the substituted object

     * @throws  IOException Any of the usual Input/Output exceptions.

     */

    protected Object resolveObject(Object obj) throws IOException {

        return obj;

    }

    /**

     * Enables the stream to do replacement of objects read from the stream. When

     * enabled, the {@link #resolveObject} method is called for every object being

     * deserialized.

     *

     * <p>If object replacement is currently not enabled, and

     * {@code enable} is true, and there is a security manager installed,

     * this method first calls the security manager's

     * {@code checkPermission} method with the

     * {@code SerializablePermission("enableSubstitution")} permission to

     * ensure that the caller is permitted to enable the stream to do replacement

     * of objects read from the stream.

     *

     * @param   enable true for enabling use of {@code resolveObject} for

     *          every object being deserialized

     * @return  the previous setting before this method was invoked

     * @throws  SecurityException if a security manager exists and its

     *          {@code checkPermission} method denies enabling the stream

     *          to do replacement of objects read from the stream.

     * @see SecurityManager#checkPermission

     * @see java.io.SerializablePermission

     */

    protected boolean enableResolveObject(boolean enable)

        throws SecurityException

    {

        if (enable == enableResolve) {

            return enable;

        }

        if (enable) {

            @SuppressWarnings("removal")

            SecurityManager sm = System.getSecurityManager();

            if (sm != null) {

                sm.checkPermission(SUBSTITUTION_PERMISSION);

            }

        }

        enableResolve = enable;

        return !enableResolve;

    }

    /**

     * The readStreamHeader method is provided to allow subclasses to read and

     * verify their own stream headers. It reads and verifies the magic number

     * and version number.

     *

     * @throws  IOException if there are I/O errors while reading from the

     *          underlying {@code InputStream}

     * @throws  StreamCorruptedException if control information in the stream

     *          is inconsistent

     */

    protected void readStreamHeader()

        throws IOException, StreamCorruptedException

    {

        short s0 = bin.readShort();

        short s1 = bin.readShort();

        if (s0 != STREAM_MAGIC || s1 != STREAM_VERSION) {

            throw new StreamCorruptedException(

                String.format("invalid stream header: %04X%04X", s0, s1));

        }

    }

    /**

     * Read a class descriptor from the serialization stream.  This method is

     * called when the ObjectInputStream expects a class descriptor as the next

     * item in the serialization stream.  Subclasses of ObjectInputStream may

     * override this method to read in class descriptors that have been written

     * in non-standard formats (by subclasses of ObjectOutputStream which have

     * overridden the {@code writeClassDescriptor} method).  By default,

     * this method reads class descriptors according to the format defined in

     * the Object Serialization specification.

     *

     * @return  the class descriptor read

     * @throws  IOException If an I/O error has occurred.

     * @throws  ClassNotFoundException If the Class of a serialized object used

     *          in the class descriptor representation cannot be found

     * @see java.io.ObjectOutputStream#writeClassDescriptor(java.io.ObjectStreamClass)

     * @since 1.3

     */

    protected ObjectStreamClass readClassDescriptor()

        throws IOException, ClassNotFoundException

    {

        ObjectStreamClass desc = new ObjectStreamClass();

        desc.readNonProxy(this);

        return desc;

    }

    /**

     * Reads a byte of data. This method will block if no input is available.

     *

     * @return  the byte read, or -1 if the end of the stream is reached.

     * @throws  IOException If an I/O error has occurred.

     */

    public int read() throws IOException {

        return bin.read();

    }

    /**

     * Reads into an array of bytes.  This method will block until some input

     * is available. Consider using java.io.DataInputStream.readFully to read

     * exactly 'length' bytes.

     *

     * @param   buf the buffer into which the data is read

     * @param   off the start offset in the destination array {@code buf}

     * @param   len the maximum number of bytes read

     * @return  the actual number of bytes read, -1 is returned when the end of

     *          the stream is reached.

     * @throws  NullPointerException if {@code buf} is {@code null}.

     * @throws  IndexOutOfBoundsException if {@code off} is negative,

     *          {@code len} is negative, or {@code len} is greater than

     *          {@code buf.length - off}.

     * @throws  IOException If an I/O error has occurred.

     * @see java.io.DataInputStream#readFully(byte[],int,int)

     */

    public int read(byte[] buf, int off, int len) throws IOException {

        if (buf == null) {

            throw new NullPointerException();

        }

        int endoff = off + len;

        if (off < 0 || len < 0 || endoff > buf.length || endoff < 0) {

            throw new IndexOutOfBoundsException();

        }

        return bin.read(buf, off, len, false);

    }

    /**

     * Returns the number of bytes that can be read without blocking.

     *

     * @return  the number of available bytes.

     * @throws  IOException if there are I/O errors while reading from the

     *          underlying {@code InputStream}

     */

    public int available() throws IOException {

        return bin.available();

    }

    /**

     * Closes the input stream. Must be called to release any resources

     * associated with the stream.

     *

     * @throws  IOException If an I/O error has occurred.

     */

    public void close() throws IOException {

        /*

         * Even if stream already closed, propagate redundant close to

         * underlying stream to stay consistent with previous implementations.

         */

        closed = true;

        if (depth == 0) {

            clear();

        }

        bin.close();

    }

    /**

     * Reads in a boolean.

     *

     * @return  the boolean read.

     * @throws  EOFException If end of file is reached.

     * @throws  IOException If other I/O error has occurred.

     */

    public boolean readBoolean() throws IOException {

        return bin.readBoolean();

    }

    /**

     * Reads an 8 bit byte.

     *

     * @return  the 8 bit byte read.

     * @throws  EOFException If end of file is reached.

     * @throws  IOException If other I/O error has occurred.

     */

    public byte readByte() throws IOException  {

        return bin.readByte();

    }

    /**

     * Reads an unsigned 8 bit byte.

     *

     * @return  the 8 bit byte read.

     * @throws  EOFException If end of file is reached.

     * @throws  IOException If other I/O error has occurred.

     */

    public int readUnsignedByte()  throws IOException {

        return bin.readUnsignedByte();

    }

    /**

     * Reads a 16 bit char.

     *

     * @return  the 16 bit char read.

     * @throws  EOFException If end of file is reached.

     * @throws  IOException If other I/O error has occurred.

     */

    public char readChar()  throws IOException {

        return bin.readChar();

    }

    /**

     * Reads a 16 bit short.

     *

     * @return  the 16 bit short read.

     * @throws  EOFException If end of file is reached.

     * @throws  IOException If other I/O error has occurred.

     */

    public short readShort()  throws IOException {

        return bin.readShort();

    }

    /**

     * Reads an unsigned 16 bit short.

     *

     * @return  the 16 bit short read.

     * @throws  EOFException If end of file is reached.

     * @throws  IOException If other I/O error has occurred.

     */

    public int readUnsignedShort() throws IOException {

        return bin.readUnsignedShort();

    }

    /**

     * Reads a 32 bit int.

     *

     * @return  the 32 bit integer read.

     * @throws  EOFException If end of file is reached.

     * @throws  IOException If other I/O error has occurred.

     */

    public int readInt()  throws IOException {

        return bin.readInt();

    }

    /**

     * Reads a 64 bit long.

     *

     * @return  the read 64 bit long.

     * @throws  EOFException If end of file is reached.

     * @throws  IOException If other I/O error has occurred.

     */

    public long readLong()  throws IOException {

        return bin.readLong();

    }

    /**

     * Reads a 32 bit float.

     *

     * @return  the 32 bit float read.

     * @throws  EOFException If end of file is reached.

     * @throws  IOException If other I/O error has occurred.

     */

    public float readFloat() throws IOException {

        return bin.readFloat();

    }

    /**

     * Reads a 64 bit double.

     *

     * @return  the 64 bit double read.

     * @throws  EOFException If end of file is reached.

     * @throws  IOException If other I/O error has occurred.

     */

    public double readDouble() throws IOException {

        return bin.readDouble();

    }

    /**

     * Reads bytes, blocking until all bytes are read.

     *

     * @param   buf the buffer into which the data is read

     * @throws  NullPointerException If {@code buf} is {@code null}.

     * @throws  EOFException If end of file is reached.

     * @throws  IOException If other I/O error has occurred.

     */

    public void readFully(byte[] buf) throws IOException {

        bin.readFully(buf, 0, buf.length, false);

    }

    /**

     * Reads bytes, blocking until all bytes are read.

     *

     * @param   buf the buffer into which the data is read

     * @param   off the start offset into the data array {@code buf}

     * @param   len the maximum number of bytes to read

     * @throws  NullPointerException If {@code buf} is {@code null}.

     * @throws  IndexOutOfBoundsException If {@code off} is negative,

     *          {@code len} is negative, or {@code len} is greater than

     *          {@code buf.length - off}.

     * @throws  EOFException If end of file is reached.

     * @throws  IOException If other I/O error has occurred.

     */

    public void readFully(byte[] buf, int off, int len) throws IOException {

        int endoff = off + len;

        if (off < 0 || len < 0 || endoff > buf.length || endoff < 0) {

            throw new IndexOutOfBoundsException();

        }

        bin.readFully(buf, off, len, false);

    }

    /**

     * Skips bytes.

     *

     * @param   len the number of bytes to be skipped

     * @return  the actual number of bytes skipped.

     * @throws  IOException If an I/O error has occurred.

     */

    public int skipBytes(int len) throws IOException {

        return bin.skipBytes(len);

    }

    /**

     * Reads in a line that has been terminated by a \n, \r, \r\n or EOF.

     *

     * @return  a String copy of the line.

     * @throws  IOException if there are I/O errors while reading from the

     *          underlying {@code InputStream}

     * @deprecated This method does not properly convert bytes to characters.

     *          see DataInputStream for the details and alternatives.

     */

    @Deprecated

    public String readLine() throws IOException {

        return bin.readLine();

    }

    /**

     * Reads a String in

     * <a href="DataInput.html#modified-utf-8">modified UTF-8</a>

     * format.

     *

     * @return  the String.

     * @throws  IOException if there are I/O errors while reading from the

     *          underlying {@code InputStream}