On Sun, 11 Sep 2022 07:44:44 GMT, Alan Bateman <al...@openjdk.org> wrote:
>> Markus KARG has updated the pull request incrementally with two additional >> commits since the last revision: >> >> - corrected copyright >> - testing transferTo() after reset() > >> I do not quite understand what would be wrong with the code below instead of >> falling back to the super implementation _in case of non-empty buffer_? > > I think you are asking if is safe to leak a reference to the internal buffer. > If there is no mark then it might be okay because there is no replay for an > evil output stream to attack. However, I think it would require wider review > to be confident that there aren't other interesting ways to break it; hence > the suggestion in one of the earlier comments to keep it simple and limit it > when there is no subclassing, no mark, and no bytes buffered. This does not > prevent widening the conditions in the future. @AlanBateman Kindly requesting approval. :-) ------------- PR: https://git.openjdk.org/jdk/pull/6935
