gcjik

Tom Tromey tromey@redhat.com
Fri Sep 20 13:22:00 GMT 2002


>>>>> "Per" == Per Bothner <per@bothner.com> writes:

Per> This sounds like an interesting project, but be aware that
Per> neither the compile-time verifier (in gcj) or the run-time
Per> verifier (in libgcj) have been "vetted" for security.
Per> Specifically, I'm fairly sure we don't handle interface types in
Per> gcj securely.

Or in libgcj, as I found out this week to my dismay.  Running a recent
xerces through the libgcj verifier was an exercise in humility.

It looks like the best fix is to change the internal type
representation to keep track of the union of the interfaces.  I
remember you talking about this approach years ago...  Hopefully I can
find the time.

Tom



More information about the Java mailing list