Update to Java commit 06d4508 (2024.03.07): CLJ2839 Infinite seq class hashCode() is infinite loop -- also disable all BinaryFormatter serialization tests

Author: dmiller

Clojure/Clojure.Source/clojure/core.clj

@@ -3034,7 +3034,8 @@
   [n x] (take n (repeat x)))
 
 (defn iterate
-  "Returns a lazy sequence of x, (f x), (f (f x)) etc. f must be free of side-effects"
+  "Returns a lazy sequence of x, (f x), (f (f x)) etc. 
+  f must be free of side-effects"
   {:added "1.0"
    :static true}
   [f x] (clojure.lang.Iterate/create f x) )

Clojure/Clojure.Tests/clojure/test_clojure/java_interop.clj

@@ -236,7 +236,7 @@
   [^String s]
   (.GetString System.Text.Encoding/UTF8 (System.Convert/FromBase64String s)))     ;;; (.decode (Base64/getDecoder) s)
 
-(deftest test-proxy-non-serializable
+#_(deftest test-proxy-non-serializable
   (testing "That proxy classes refuse serialization and deserialization"
     ;; Serializable listed directly in interface list:
     (is (thrown? System.Runtime.Serialization.SerializationException                                                     ;;;  java.io.NotSerializableException

Clojure/Clojure.Tests/clojure/test_clojure/sequences.clj

@@ -1586,6 +1586,17 @@
     (range 0)   0 100
     (range 1 2) 1 101
     (range 1 3) 3 103))
+
+(deftest infinite-seq-hash
+  (are [e] (thrown? Exception (.GetHashCode ^Object e))                       ;;; .hashCode
+    (iterate identity nil)
+    (cycle [1])
+    (repeat 1))
+  (are [e] (thrown? Exception (.hasheq ^clojure.lang.IHashEq e))
+    (iterate identity nil)
+    (cycle [1])
+    (repeat 1)))
+
 (compile-when (>= (.CompareTo dotnet-version "6") 0)
 (defspec iteration-seq-equals-reduce 1000
   (prop/for-all [initk gen/int

Clojure/Clojure.Tests/clojure/test_clojure/serialization.clj

@@ -48,7 +48,7 @@
       (= (hash v) (hash rt))
       (= (.GetHashCode v) (.GetHashCode rt)))))          ;;; .hashCode .hashCode
 
-(deftest sequable-serialization
+#_(deftest sequable-serialization
   (are [val] (roundtrip val)
     ; lists and related
     ;;; (list)                          <--- We cannot handle seq of this, which is nil.  Cannot serialize nil.
@@ -123,14 +123,14 @@
       (nth r 35)
       r)))
 
-(deftest misc-serialization
+#_(deftest misc-serialization
   (are [v] (= v (-> v serialize deserialize))
     25/3
     :keyword
     ::namespaced-keyword
     'symbol))
 
-(deftest tostringed-bytes
+#_(deftest tostringed-bytes
   (let [rt #(-> % serialize seq)
         s1 (rt 'sym123)
         k1 (rt :kw123)
@@ -141,7 +141,7 @@
     (is (= s1 s2))
     (is (= k1 k2))))
 
-(deftest interned-serializations
+#_(deftest interned-serializations
   (are [v] (identical? v (-> v serialize deserialize))
     clojure.lang.RT/DefaultComparerInstance                                       ;;; clojure.lang.RT/DEFAULT_COMPARATOR
 
@@ -152,7 +152,7 @@
      ; vars get serialized back into the same var in the present runtime
     #'clojure.core/conj))
 
- (deftest new-var-unbound-on-read
+ #_(deftest new-var-unbound-on-read
   (let [v (intern 'user 'foobarbaz 10)
         sv (serialize v)]
     (ns-unmap 'user 'foobarbaz) ;; unmap #'user.V
@@ -170,7 +170,7 @@
 ;;;      (fn [] capture)                                      <--- TODO: unable to find assembly eval
 )))  ;;;      #(do capture))))                                <--- TODO: unable to find assembly eval
 
-(deftest check-unserializable-objects
+#_(deftest check-unserializable-objects
   (are [t] (thrown?  System.Runtime.Serialization.SerializationException (serialize t))              ;;; java.io.NotSerializableException
     ;; transients
     (transient [])
@@ -186,4 +186,9 @@
     (enumeration-seq (.GetEnumerator (range 50)))              ;;; (java.util.Collections/enumeration (range 50)))
     (iterator-seq (.GetEnumerator (range 50)))))               ;;; (.iterator (range 50)))))
 
-    
+;; necessary for CVE-2024-22871
+#_(deftest CLJ-2839
+  (are [e] (thrown? Exception (.GetHashCode ^Object (-> e serialize deserialize)))              ;;; .hashCode
+    (repeat 1)
+    (iterate identity nil)
+    (cycle [1])))    

Clojure/Clojure/Lib/ASeq.cs

@@ -421,7 +421,7 @@ IEnumerator IEnumerable.GetEnumerator()
 
         #region IHashEq
 
-        public int hasheq()
+        public virtual int hasheq()
         {
             if (_hasheq == 0)
             {

Clojure/Clojure/Lib/Cycle.cs

@@ -57,6 +57,23 @@ public static ISeq create(ISeq vals)
 
         #endregion
 
+        #region Object overrides
+
+        public override int GetHashCode()
+        {
+            throw new NotSupportedException("Cycle: hash not supported");
+        }
+
+        #endregion
+
+        #region IHashEq methods
+        public override int hasheq()
+        {
+            throw new NotSupportedException("Cycle: hasheq not supported");
+        }
+
+        #endregion
+
         #region ISeq methods
 
         // realization for use of current

Clojure/Clojure/Lib/Iterate.cs

@@ -56,6 +56,23 @@ public static ISeq create(IFn f, Object seed)
 
         #endregion
 
+        #region Object overrides
+
+        public override int GetHashCode()
+        {
+            throw new NotSupportedException("Iterate: hash not supported");
+        }
+
+        #endregion
+
+        #region IHashEq methods
+        public override int hasheq()
+        {
+            throw new NotSupportedException("Iterate: hasheq not supported");
+        }
+
+        #endregion
+
         #region ISeq
 
         public override object first()

Clojure/Clojure/Lib/Repeat.cs

@@ -59,6 +59,28 @@ public static ISeq create(long count, Object val)
             return new Repeat(count, val);
         }
 
+        #endregion
+        #region Object overrides
+
+        public override int GetHashCode()
+        {
+            if ( _count <= 0 ) 
+                throw new NotSupportedException("Repeat: hash not supported");
+            else
+                return base.GetHashCode();
+        }
+
+        #endregion
+
+        #region IHashEq methods
+        public override int hasheq()
+        {
+            if (_count <= 0)
+                throw new NotSupportedException("Repeat: hasheq not supported");
+            else
+                return base.hasheq();
+        }
+
         #endregion
 
         #region ISeq methods