/*

* Copyright (c) 1996, 2010, Oracle and/or its affiliates. All rights reserved.

* ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms.

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*/

package java.io;

import java.io.ObjectStreamClass.WeakClassKey;

import java.lang.ref.ReferenceQueue;

import java.lang.reflect.Array;

import java.lang.reflect.Modifier;

import java.lang.reflect.Proxy;

import java.security.AccessControlContext;

import java.security.AccessController;

import java.security.PrivilegedAction;

import java.security.PrivilegedActionException;

import java.security.PrivilegedExceptionAction;

import java.util.Arrays;

import java.util.HashMap;

import java.util.concurrent.ConcurrentHashMap;

import java.util.concurrent.ConcurrentMap;

import java.util.concurrent.atomic.AtomicBoolean;

import static java.io.ObjectStreamClass.processQueue;

import sun.reflect.misc.ReflectUtil;

/**

* An ObjectInputStream deserializes primitive data and objects previously

* written using an ObjectOutputStream.

*

* <p>ObjectOutputStream and ObjectInputStream can provide an application with

* persistent storage for graphs of objects when used with a FileOutputStream

* and FileInputStream respectively. ObjectInputStream is used to recover

* those objects previously serialized. Other uses include passing objects

* between hosts using a socket stream or for marshaling and unmarshaling

* arguments and parameters in a remote communication system.

*

* <p>ObjectInputStream ensures that the types of all objects in the graph

* created from the stream match the classes present in the Java Virtual

* Machine. Classes are loaded as required using the standard mechanisms.

*

* <p>Only objects that support the java.io.Serializable or

* java.io.Externalizable interface can be read from streams.

*

* <p>The method <code>readObject</code> is used to read an object from the

* stream. Java's safe casting should be used to get the desired type. In

* Java, strings and arrays are objects and are treated as objects during

* serialization. When read they need to be cast to the expected type.

*

* <p>Primitive data types can be read from the stream using the appropriate

* method on DataInput.

*

* <p>The default deserialization mechanism for objects restores the contents

* of each field to the value and type it had when it was written. Fields

* declared as transient or static are ignored by the deserialization process.

* References to other objects cause those objects to be read from the stream

* as necessary. Graphs of objects are restored correctly using a reference

* sharing mechanism. New objects are always allocated when deserializing,

* which prevents existing objects from being overwritten.

*

* <p>Reading an object is analogous to running the constructors of a new

* object. Memory is allocated for the object and initialized to zero (NULL).

* No-arg constructors are invoked for the non-serializable classes and then

* the fields of the serializable classes are restored from the stream starting

* with the serializable class closest to java.lang.object and finishing with

* the object's most specific class.

*

* <p>For example to read from a stream as written by the example in

* ObjectOutputStream:

* <br>

* <pre>

* FileInputStream fis = new FileInputStream("t.tmp");

* ObjectInputStream ois = new ObjectInputStream(fis);

*

* int i = ois.readInt();

* String today = (String) ois.readObject();

* Date date = (Date) ois.readObject();

*

* ois.close();

* </pre>

*

* <p>Classes control how they are serialized by implementing either the

* java.io.Serializable or java.io.Externalizable interfaces.

*

* <p>Implementing the Serializable interface allows object serialization to

* save and restore the entire state of the object and it allows classes to

* evolve between the time the stream is written and the time it is read. It

* automatically traverses references between objects, saving and restoring

* entire graphs.

*

* <p>Serializable classes that require special handling during the

* serialization and deserialization process should implement the following

* methods:<p>

*

* <pre>

* private void writeObject(java.io.ObjectOutputStream stream)

* throws IOException;

* private void readObject(java.io.ObjectInputStream stream)

* throws IOException, ClassNotFoundException;

* private void readObjectNoData()

* throws ObjectStreamException;

* </pre>

*

* <p>The readObject method is responsible for reading and restoring the state

* of the object for its particular class using data written to the stream by

* the corresponding writeObject method. The method does not need to concern

* itself with the state belonging to its superclasses or subclasses. State is

* restored by reading data from the ObjectInputStream for the individual

* fields and making assignments to the appropriate fields of the object.

* Reading primitive data types is supported by DataInput.

*

* <p>Any attempt to read object data which exceeds the boundaries of the

* custom data written by the corresponding writeObject method will cause an

* OptionalDataException to be thrown with an eof field value of true.

* Non-object reads which exceed the end of the allotted data will reflect the

* end of data in the same way that they would indicate the end of the stream:

* bytewise reads will return -1 as the byte read or number of bytes read, and

* primitive reads will throw EOFExceptions. If there is no corresponding

* writeObject method, then the end of default serialized data marks the end of

* the allotted data.

*

* <p>Primitive and object read calls issued from within a readExternal method

* behave in the same manner--if the stream is already positioned at the end of

* data written by the corresponding writeExternal method, object reads will

* throw OptionalDataExceptions with eof set to true, bytewise reads will

* return -1, and primitive reads will throw EOFExceptions. Note that this

* behavior does not hold for streams written with the old

* <code>ObjectStreamConstants.PROTOCOL_VERSION_1</code> protocol, in which the

* end of data written by writeExternal methods is not demarcated, and hence

* cannot be detected.

*

* <p>The readObjectNoData method is responsible for initializing the state of

* the object for its particular class in the event that the serialization

* stream does not list the given class as a superclass of the object being

* deserialized. This may occur in cases where the receiving party uses a

* different version of the deserialized instance's class than the sending

* party, and the receiver's version extends classes that are not extended by

* the sender's version. This may also occur if the serialization stream has

* been tampered; hence, readObjectNoData is useful for initializing

* deserialized objects properly despite a "hostile" or incomplete source

* stream.

*

* <p>Serialization does not read or assign values to the fields of any object

* that does not implement the java.io.Serializable interface. Subclasses of

* Objects that are not serializable can be serializable. In this case the

* non-serializable class must have a no-arg constructor to allow its fields to

* be initialized. In this case it is the responsibility of the subclass to

* save and restore the state of the non-serializable class. It is frequently

* the case that the fields of that class are accessible (public, package, or

* protected) or that there are get and set methods that can be used to restore

* the state.

*

* <p>Any exception that occurs while deserializing an object will be caught by

* the ObjectInputStream and abort the reading process.

*

* <p>Implementing the Externalizable interface allows the object to assume

* complete control over the contents and format of the object's serialized

* form. The methods of the Externalizable interface, writeExternal and

* readExternal, are called to save and restore the objects state. When

* implemented by a class they can write and read their own state using all of

* the methods of ObjectOutput and ObjectInput. It is the responsibility of

* the objects to handle any versioning that occurs.

*

* <p>Enum constants are deserialized differently than ordinary serializable or

* externalizable objects. The serialized form of an enum constant consists

* solely of its name; field values of the constant are not transmitted. To

* deserialize an enum constant, ObjectInputStream reads the constant name from

* the stream; the deserialized constant is then obtained by calling the static

* method <code>Enum.valueOf(Class, String)</code> with the enum constant's

* base type and the received constant name as arguments. Like other

* serializable or externalizable objects, enum constants can function as the

* targets of back references appearing subsequently in the serialization

* stream. The process by which enum constants are deserialized cannot be

* customized: any class-specific readObject, readObjectNoData, and readResolve

* methods defined by enum types are ignored during deserialization.

* Similarly, any serialPersistentFields or serialVersionUID field declarations

* are also ignored--all enum types have a fixed serialVersionUID of 0L.

*

* @author Mike Warres

* @author Roger Riggs

* @see java.io.DataInput

* @see java.io.ObjectOutputStream

* @see java.io.Serializable

* @see <a href="../../../platform/serialization/spec/input.html"> Object Serialization Specification, Section 3, Object Input Classes</a>

* @since JDK1.1

*/

public class ObjectInputStream

extends InputStream implements ObjectInput, ObjectStreamConstants

{

/** handle value representing null */

private static final int NULL_HANDLE = -1;

/** marker for unshared objects in internal handle table */

private static final Object unsharedMarker = new Object();

/** table mapping primitive type names to corresponding class objects */

private static final HashMap<String, Class<?>> primClasses

= new HashMap<>(8, 1.0F);

static {

primClasses.put("boolean", boolean.class);

primClasses.put("byte", byte.class);

primClasses.put("char", char.class);

primClasses.put("short", short.class);

primClasses.put("int", int.class);

primClasses.put("long", long.class);

primClasses.put("float", float.class);

primClasses.put("double", double.class);

primClasses.put("void", void.class);

}

private static class Caches {

/** cache of subclass security audit results */

static final ConcurrentMap<WeakClassKey,Boolean> subclassAudits =

new ConcurrentHashMap<>();

/** queue for WeakReferences to audited subclasses */

static final ReferenceQueue<Class<?>> subclassAuditsQueue =

new ReferenceQueue<>();

}

/** filter stream for handling block data conversion */

private final BlockDataInputStream bin;

/** validation callback list */

private final ValidationList vlist;

/** recursion depth */

private int depth;

/** whether stream is closed */

private boolean closed;

/** wire handle -> obj/exception map */

private final HandleTable handles;

/** scratch field for passing handle values up/down call stack */

private int passHandle = NULL_HANDLE;

/** flag set when at end of field value block with no TC_ENDBLOCKDATA */

private boolean defaultDataEnd = false;

/** buffer for reading primitive field values */

private byte[] primVals;

/** if true, invoke readObjectOverride() instead of readObject() */

private final boolean enableOverride;

/** if true, invoke resolveObject() */

private boolean enableResolve;

/**

* Context during upcalls to class-defined readObject methods; holds

* object currently being deserialized and descriptor for current class.

* Null when not during readObject upcall.

*/

private SerialCallbackContext curContext;

/**

* Creates an ObjectInputStream that reads from the specified InputStream.

* A serialization stream header is read from the stream and verified.

* This constructor will block until the corresponding ObjectOutputStream

* has written and flushed the header.

*

* <p>If a security manager is installed, this constructor will check for

* the "enableSubclassImplementation" SerializablePermission when invoked

* directly or indirectly by the constructor of a subclass which overrides

* the ObjectInputStream.readFields or ObjectInputStream.readUnshared

* methods.

*

* @param in input stream to read from

* @throws StreamCorruptedException if the stream header is incorrect

* @throws IOException if an I/O error occurs while reading stream header

* @throws SecurityException if untrusted subclass illegally overrides

* security-sensitive methods

* @throws NullPointerException if <code>in</code> is <code>null</code>

* @see ObjectInputStream#ObjectInputStream()

* @see ObjectInputStream#readFields()

* @see ObjectOutputStream#ObjectOutputStream(OutputStream)

*/

public ObjectInputStream(InputStream in) throws IOException {

verifySubclass();

bin = new BlockDataInputStream(in);

handles = new HandleTable(10);

vlist = new ValidationList();

enableOverride = false;

readStreamHeader();

bin.setBlockDataMode(true);

}

/**

* Provide a way for subclasses that are completely reimplementing

* ObjectInputStream to not have to allocate private data just used by this

* implementation of ObjectInputStream.

*

* <p>If there is a security manager installed, this method first calls the

* security manager's <code>checkPermission</code> method with the

* <code>SerializablePermission("enableSubclassImplementation")</code>

* permission to ensure it's ok to enable subclassing.

*

* @throws SecurityException if a security manager exists and its

* <code>checkPermission</code> method denies enabling

* subclassing.

* @see SecurityManager#checkPermission

* @see java.io.SerializablePermission

*/

protected ObjectInputStream() throws IOException, SecurityException {

SecurityManager sm = System.getSecurityManager();

if (sm != null) {

sm.checkPermission(SUBCLASS_IMPLEMENTATION_PERMISSION);

}

bin = null;

handles = null;

vlist = null;

enableOverride = true;

}

/**

* Read an object from the ObjectInputStream. The class of the object, the

* signature of the class, and the values of the non-transient and

* non-static fields of the class and all of its supertypes are read.

* Default deserializing for a class can be overriden using the writeObject

* and readObject methods. Objects referenced by this object are read

* transitively so that a complete equivalent graph of objects is

* reconstructed by readObject.

*

* <p>The root object is completely restored when all of its fields and the

* objects it references are completely restored. At this point the object

* validation callbacks are executed in order based on their registered

* priorities. The callbacks are registered by objects (in the readObject

* special methods) as they are individually restored.

*

* <p>Exceptions are thrown for problems with the InputStream and for

* classes that should not be deserialized. All exceptions are fatal to

* the InputStream and leave it in an indeterminate state; it is up to the

* caller to ignore or recover the stream state.

*

* @throws ClassNotFoundException Class of a serialized object cannot be

* found.

* @throws InvalidClassException Something is wrong with a class used by

* serialization.

* @throws StreamCorruptedException Control information in the

* stream is inconsistent.

* @throws OptionalDataException Primitive data was found in the

* stream instead of objects.

* @throws IOException Any of the usual Input/Output related exceptions.

*/

public final Object readObject()

throws IOException, ClassNotFoundException

{

if (enableOverride) {

return readObjectOverride();

}

// if nested read, passHandle contains handle of enclosing object

int outerHandle = passHandle;

try {

Object obj = readObject0(false);

handles.markDependency(outerHandle, passHandle);

ClassNotFoundException ex = handles.lookupException(passHandle);

if (ex != null) {

throw ex;

}

if (depth == 0) {

vlist.doCallbacks();

}

return obj;

} finally {

passHandle = outerHandle;

if (closed && depth == 0) {

clear();

}

}

}

/**

* This method is called by trusted subclasses of ObjectOutputStream that

* constructed ObjectOutputStream using the protected no-arg constructor.

* The subclass is expected to provide an override method with the modifier

* "final".

*

* @return the Object read from the stream.

* @throws ClassNotFoundException Class definition of a serialized object

* cannot be found.

* @throws OptionalDataException Primitive data was found in the stream

* instead of objects.

* @throws IOException if I/O errors occurred while reading from the

* underlying stream

* @see #ObjectInputStream()

* @see #readObject()

* @since 1.2

*/

protected Object readObjectOverride()

throws IOException, ClassNotFoundException

{

return null;

}

/**

* Reads an "unshared" object from the ObjectInputStream. This method is

* identical to readObject, except that it prevents subsequent calls to

* readObject and readUnshared from returning additional references to the

* deserialized instance obtained via this call. Specifically:

* <ul>

* <li>If readUnshared is called to deserialize a back-reference (the

* stream representation of an object which has been written

* previously to the stream), an ObjectStreamException will be

* thrown.

*

* <li>If readUnshared returns successfully, then any subsequent attempts

* to deserialize back-references to the stream handle deserialized

* by readUnshared will cause an ObjectStreamException to be thrown.

* </ul>

* Deserializing an object via readUnshared invalidates the stream handle

* associated with the returned object. Note that this in itself does not

* always guarantee that the reference returned by readUnshared is unique;

* the deserialized object may define a readResolve method which returns an

* object visible to other parties, or readUnshared may return a Class

* object or enum constant obtainable elsewhere in the stream or through

* external means. If the deserialized object defines a readResolve method

* and the invocation of that method returns an array, then readUnshared

* returns a shallow clone of that array; this guarantees that the returned

* array object is unique and cannot be obtained a second time from an

* invocation of readObject or readUnshared on the ObjectInputStream,

* even if the underlying data stream has been manipulated.

*

* <p>ObjectInputStream subclasses which override this method can only be

* constructed in security contexts possessing the

* "enableSubclassImplementation" SerializablePermission; any attempt to

* instantiate such a subclass without this permission will cause a

* SecurityException to be thrown.

*

* @return reference to deserialized object

* @throws ClassNotFoundException if class of an object to deserialize

* cannot be found

* @throws StreamCorruptedException if control information in the stream

* is inconsistent

* @throws ObjectStreamException if object to deserialize has already

* appeared in stream

* @throws OptionalDataException if primitive data is next in stream

* @throws IOException if an I/O error occurs during deserialization

* @since 1.4

*/

public Object readUnshared() throws IOException, ClassNotFoundException {

// if nested read, passHandle contains handle of enclosing object

int outerHandle = passHandle;

try {

Object obj = readObject0(true);

handles.markDependency(outerHandle, passHandle);

ClassNotFoundException ex = handles.lookupException(passHandle);

if (ex != null) {

throw ex;

}

if (depth == 0) {

vlist.doCallbacks();

}

return obj;

} finally {

passHandle = outerHandle;

if (closed && depth == 0) {

clear();

}

}

}

/**

* Read the non-static and non-transient fields of the current class from

* this stream. This may only be called from the readObject method of the

* class being deserialized. It will throw the NotActiveException if it is

* called otherwise.

*

* @throws ClassNotFoundException if the class of a serialized object

* could not be found.

* @throws IOException if an I/O error occurs.

* @throws NotActiveException if the stream is not currently reading

* objects.

*/

public void defaultReadObject()

throws IOException, ClassNotFoundException

{

SerialCallbackContext ctx = curContext;

if (ctx == null) {

throw new NotActiveException("not in call to readObject");

}

Object curObj = ctx.getObj();

ObjectStreamClass curDesc = ctx.getDesc();

bin.setBlockDataMode(false);

defaultReadFields(curObj, curDesc);

bin.setBlockDataMode(true);

if (!curDesc.hasWriteObjectData()) {

/*

* Fix for 4360508: since stream does not contain terminating

* TC_ENDBLOCKDATA tag, set flag so that reading code elsewhere

* knows to simulate end-of-custom-data behavior.

*/

defaultDataEnd = true;

}

ClassNotFoundException ex = handles.lookupException(passHandle);

if (ex != null) {

throw ex;

}

}

/**

* Reads the persistent fields from the stream and makes them available by

* name.

*

* @return the <code>GetField</code> object representing the persistent

* fields of the object being deserialized

* @throws ClassNotFoundException if the class of a serialized object

* could not be found.

* @throws IOException if an I/O error occurs.

* @throws NotActiveException if the stream is not currently reading

* objects.

* @since 1.2

*/

public ObjectInputStream.GetField readFields()

throws IOException, ClassNotFoundException

{

SerialCallbackContext ctx = curContext;

if (ctx == null) {

throw new NotActiveException("not in call to readObject");

}

Object curObj = ctx.getObj();

ObjectStreamClass curDesc = ctx.getDesc();

bin.setBlockDataMode(false);

GetFieldImpl getField = new GetFieldImpl(curDesc);

getField.readFields();

bin.setBlockDataMode(true);

if (!curDesc.hasWriteObjectData()) {

/*

* Fix for 4360508: since stream does not contain terminating

* TC_ENDBLOCKDATA tag, set flag so that reading code elsewhere

* knows to simulate end-of-custom-data behavior.

*/

defaultDataEnd = true;

}

return getField;

}

/**

* Register an object to be validated before the graph is returned. While

* similar to resolveObject these validations are called after the entire

* graph has been reconstituted. Typically, a readObject method will

* register the object with the stream so that when all of the objects are

* restored a final set of validations can be performed.

*

* @param obj the object to receive the validation callback.

* @param prio controls the order of callbacks;zero is a good default.

* Use higher numbers to be called back earlier, lower numbers for

* later callbacks. Within a priority, callbacks are processed in

* no particular order.

* @throws NotActiveException The stream is not currently reading objects

* so it is invalid to register a callback.

* @throws InvalidObjectException The validation object is null.

*/

public void registerValidation(ObjectInputValidation obj, int prio)

throws NotActiveException, InvalidObjectException

{

if (depth == 0) {

throw new NotActiveException("stream inactive");

}

vlist.register(obj, prio);

}

/**

* Load the local class equivalent of the specified stream class

* description. Subclasses may implement this method to allow classes to

* be fetched from an alternate source.

*

* <p>The corresponding method in <code>ObjectOutputStream</code> is

* <code>annotateClass</code>. This method will be invoked only once for

* each unique class in the stream. This method can be implemented by

* subclasses to use an alternate loading mechanism but must return a

* <code>Class</code> object. Once returned, if the class is not an array

* class, its serialVersionUID is compared to the serialVersionUID of the

* serialized class, and if there is a mismatch, the deserialization fails

* and an {@link InvalidClassException} is thrown.

*

* <p>The default implementation of this method in

* <code>ObjectInputStream</code> returns the result of calling

* <pre>

* Class.forName(desc.getName(), false, loader)

* </pre>

* where <code>loader</code> is determined as follows: if there is a

* method on the current thread's stack whose declaring class was

* defined by a user-defined class loader (and was not a generated to

* implement reflective invocations), then <code>loader</code> is class

* loader corresponding to the closest such method to the currently

* executing frame; otherwise, <code>loader</code> is

* <code>null</code>. If this call results in a

* <code>ClassNotFoundException</code> and the name of the passed

* <code>ObjectStreamClass</code> instance is the Java language keyword

* for a primitive type or void, then the <code>Class</code> object

* representing that primitive type or void will be returned

* (e.g., an <code>ObjectStreamClass</code> with the name

* <code>"int"</code> will be resolved to <code>Integer.TYPE</code>).

* Otherwise, the <code>ClassNotFoundException</code> will be thrown to

* the caller of this method.

*

* @param desc an instance of class <code>ObjectStreamClass</code>

* @return a <code>Class</code> object corresponding to <code>desc</code>

* @throws IOException any of the usual Input/Output exceptions.

* @throws ClassNotFoundException if class of a serialized object cannot

* be found.

*/

protected Class<?> resolveClass(ObjectStreamClass desc)

throws IOException, ClassNotFoundException

{

String name = desc.getName();

try {

return Class.forName(name, false, latestUserDefinedLoader());

} catch (ClassNotFoundException ex) {

Class<?> cl = primClasses.get(name);

if (cl != null) {

return cl;

} else {

throw ex;

}

}

}

/**

* Returns a proxy class that implements the interfaces named in a proxy

* class descriptor; subclasses may implement this method to read custom

* data from the stream along with the descriptors for dynamic proxy

* classes, allowing them to use an alternate loading mechanism for the

* interfaces and the proxy class.

*

* <p>This method is called exactly once for each unique proxy class

* descriptor in the stream.

*

* <p>The corresponding method in <code>ObjectOutputStream</code> is

* <code>annotateProxyClass</code>. For a given subclass of

* <code>ObjectInputStream</code> that overrides this method, the

* <code>annotateProxyClass</code> method in the corresponding subclass of

* <code>ObjectOutputStream</code> must write any data or objects read by

* this method.

*

* <p>The default implementation of this method in

* <code>ObjectInputStream</code> returns the result of calling

* <code>Proxy.getProxyClass</code> with the list of <code>Class</code>

* objects for the interfaces that are named in the <code>interfaces</code>

* parameter. The <code>Class</code> object for each interface name

* <code>i</code> is the value returned by calling

* <pre>

* Class.forName(i, false, loader)

* </pre>

* where <code>loader</code> is that of the first non-<code>null</code>

* class loader up the execution stack, or <code>null</code> if no

* non-<code>null</code> class loaders are on the stack (the same class

* loader choice used by the <code>resolveClass</code> method). Unless any

* of the resolved interfaces are non-public, this same value of

* <code>loader</code> is also the class loader passed to

* <code>Proxy.getProxyClass</code>; if non-public interfaces are present,

* their class loader is passed instead (if more than one non-public

* interface class loader is encountered, an

* <code>IllegalAccessError</code> is thrown).

* If <code>Proxy.getProxyClass</code> throws an

* <code>IllegalArgumentException</code>, <code>resolveProxyClass</code>

* will throw a <code>ClassNotFoundException</code> containing the

* <code>IllegalArgumentException</code>.

*

* @param interfaces the list of interface names that were

* deserialized in the proxy class descriptor

* @return a proxy class for the specified interfaces

* @throws IOException any exception thrown by the underlying

* <code>InputStream</code>

* @throws ClassNotFoundException if the proxy class or any of the

* named interfaces could not be found

* @see ObjectOutputStream#annotateProxyClass(Class)

* @since 1.3

*/

protected Class<?> resolveProxyClass(String[] interfaces)

throws IOException, ClassNotFoundException

{

ClassLoader latestLoader = latestUserDefinedLoader();

ClassLoader nonPublicLoader = null;

boolean hasNonPublicInterface = false;

// define proxy in class loader of non-public interface(s), if any

Class[] classObjs = new Class[interfaces.length];

for (int i = 0; i < interfaces.length; i++) {

Class cl = Class.forName(interfaces[i], false, latestLoader);

if ((cl.getModifiers() & Modifier.PUBLIC) == 0) {

if (hasNonPublicInterface) {

if (nonPublicLoader != cl.getClassLoader()) {

throw new IllegalAccessError(

"conflicting non-public interface class loaders");

}

} else {

nonPublicLoader = cl.getClassLoader();

hasNonPublicInterface = true;

}

}

classObjs[i] = cl;

}

try {

return Proxy.getProxyClass(

hasNonPublicInterface ? nonPublicLoader : latestLoader,

classObjs);

} catch (IllegalArgumentException e) {

throw new ClassNotFoundException(null, e);

}

}

/**

* This method will allow trusted subclasses of ObjectInputStream to

* substitute one object for another during deserialization. Replacing

* objects is disabled until enableResolveObject is called. The

* enableResolveObject method checks that the stream requesting to resolve

* object can be trusted. Every reference to serializable objects is passed

* to resolveObject. To insure that the private state of objects is not

* unintentionally exposed only trusted streams may use resolveObject.

*

* <p>This method is called after an object has been read but before it is

* returned from readObject. The default resolveObject method just returns

* the same object.

*

* <p>When a subclass is replacing objects it must insure that the

* substituted object is compatible with every field where the reference

* will be stored. Objects whose type is not a subclass of the type of the

* field or array element abort the serialization by raising an exception

* and the object is not be stored.

*

* <p>This method is called only once when each object is first

* encountered. All subsequent references to the object will be redirected

* to the new object.

*

* @param obj object to be substituted

* @return the substituted object

* @throws IOException Any of the usual Input/Output exceptions.

*/

protected Object resolveObject(Object obj) throws IOException {

return obj;

}

/**

* Enable the stream to allow objects read from the stream to be replaced.

* When enabled, the resolveObject method is called for every object being

* deserialized.

*

* <p>If <i>enable</i> is true, and there is a security manager installed,

* this method first calls the security manager's

* <code>checkPermission</code> method with the

* <code>SerializablePermission("enableSubstitution")</code> permission to

* ensure it's ok to enable the stream to allow objects read from the

* stream to be replaced.

*

* @param enable true for enabling use of <code>resolveObject</code> for

* every object being deserialized

* @return the previous setting before this method was invoked

* @throws SecurityException if a security manager exists and its

* <code>checkPermission</code> method denies enabling the stream

* to allow objects read from the stream to be replaced.

* @see SecurityManager#checkPermission

* @see java.io.SerializablePermission

*/

protected boolean enableResolveObject(boolean enable)

throws SecurityException

{

if (enable == enableResolve) {

return enable;

}

if (enable) {

SecurityManager sm = System.getSecurityManager();

if (sm != null) {

sm.checkPermission(SUBSTITUTION_PERMISSION);

}

}

enableResolve = enable;

return !enableResolve;

}

/**

* The readStreamHeader method is provided to allow subclasses to read and

* verify their own stream headers. It reads and verifies the magic number

* and version number.

*

* @throws IOException if there are I/O errors while reading from the

* underlying <code>InputStream</code>

* @throws StreamCorruptedException if control information in the stream

* is inconsistent

*/

protected void readStreamHeader()

throws IOException, StreamCorruptedException

{

short s0 = bin.readShort();

short s1 = bin.readShort();

if (s0 != STREAM_MAGIC || s1 != STREAM_VERSION) {

throw new StreamCorruptedException(

String.format("invalid stream header: %04X%04X", s0, s1));

}

}

/**

* Read a class descriptor from the serialization stream. This method is

* called when the ObjectInputStream expects a class descriptor as the next

* item in the serialization stream. Subclasses of ObjectInputStream may

* override this method to read in class descriptors that have been written

* in non-standard formats (by subclasses of ObjectOutputStream which have

* overridden the <code>writeClassDescriptor</code> method). By default,

* this method reads class descriptors according to the format defined in

* the Object Serialization specification.

*

* @return the class descriptor read

* @throws IOException If an I/O error has occurred.

* @throws ClassNotFoundException If the Class of a serialized object used

* in the class descriptor representation cannot be found

* @see java.io.ObjectOutputStream#writeClassDescriptor(java.io.ObjectStreamClass)

* @since 1.3

*/

protected ObjectStreamClass readClassDescriptor()

throws IOException, ClassNotFoundException

{

ObjectStreamClass desc = new ObjectStreamClass();

desc.readNonProxy(this);

return desc;

}

/**

* Reads a byte of data. This method will block if no input is available.

*

* @return the byte read, or -1 if the end of the stream is reached.

* @throws IOException If an I/O error has occurred.

*/

public int read() throws IOException {

return bin.read();

}

/**

* Reads into an array of bytes. This method will block until some input

* is available. Consider using java.io.DataInputStream.readFully to read

* exactly 'length' bytes.

*

* @param buf the buffer into which the data is read

* @param off the start offset of the data

* @param len the maximum number of bytes read

* @return the actual number of bytes read, -1 is returned when the end of

* the stream is reached.

* @throws IOException If an I/O error has occurred.

* @see java.io.DataInputStream#readFully(byte[],int,int)

*/

public int read(byte[] buf, int off, int len) throws IOException {

if (buf == null) {

throw new NullPointerException();

}

int endoff = off + len;

if (off < 0 || len < 0 || endoff > buf.length || endoff < 0) {

throw new IndexOutOfBoundsException();

}

return bin.read(buf, off, len, false);

}

/**

* Returns the number of bytes that can be read without blocking.

*

* @return the number of available bytes.

* @throws IOException if there are I/O errors while reading from the

* underlying <code>InputStream</code>

*/

public int available() throws IOException {

return bin.available();

}

/**

* Closes the input stream. Must be called to release any resources

* associated with the stream.

*

* @throws IOException If an I/O error has occurred.

*/

public void close() throws IOException {

/*

* Even if stream already closed, propagate redundant close to

* underlying stream to stay consistent with previous implementations.

*/

closed = true;

if (depth == 0) {

clear();

}

bin.close();

}

/**

* Reads in a boolean.

*

* @return the boolean read.

* @throws EOFException If end of file is reached.

* @throws IOException If other I/O error has occurred.

*/

public boolean readBoolean() throws IOException {

return bin.readBoolean();

}

/**

* Reads an 8 bit byte.

*

* @return the 8 bit byte read.

* @throws EOFException If end of file is reached.

* @throws IOException If other I/O error has occurred.

*/

public byte readByte() throws IOException {

return bin.readByte();

}

/**

* Reads an unsigned 8 bit byte.

*

* @return the 8 bit byte read.

* @throws EOFException If end of file is reached.

* @throws IOException If other I/O error has occurred.

*/

public int readUnsignedByte() throws IOException {

return bin.readUnsignedByte();

}

/**

* Reads a 16 bit char.

*

* @return the 16 bit char read.

* @throws EOFException If end of file is reached.

* @throws IOException If other I/O error has occurred.

*/

public char readChar() throws IOException {

return bin.readChar();

}

/**

* Reads a 16 bit short.

*

* @return the 16 bit short read.

* @throws EOFException If end of file is reached.

* @throws IOException If other I/O error has occurred.

*/

public short readShort() throws IOException {

return bin.readShort();

}

/**

* Reads an unsigned 16 bit short.

*

* @return the 16 bit short read.

* @throws EOFException If end of file is reached.

* @throws IOException If other I/O error has occurred.

*/

public int readUnsignedShort() throws IOException {

return bin.readUnsignedShort();

}

/**

* Reads a 32 bit int.

*

* @return the 32 bit integer read.

* @throws EOFException If end of file is reached.

* @throws IOException If other I/O error has occurred.

*/

public int readInt() throws IOException {

return bin.readInt();

}

/**

* Reads a 64 bit long.

*

* @return the read 64 bit long.

* @throws EOFException If end of file is reached.

* @throws IOException If other I/O error has occurred.

*/

public long readLong() throws IOException {

return bin.readLong();

}

/**

* Reads a 32 bit float.

*

* @return the 32 bit float read.

* @throws EOFException If end of file is reached.

* @throws IOException If other I/O error has occurred.

*/

public float readFloat() throws IOException {

return bin.readFloat();

}

/**

* Reads a 64 bit double.

*

* @return the 64 bit double read.

* @throws EOFException If end of file is reached.