8282395: URL.openConnection can throw IOOBE

src/java.base/share/classes/sun/net/www/ParseUtil.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1998, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1998, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -197,11 +197,14 @@ public static String decode(String s) {
             bb.clear();
             int ui = i;
             for (;;) {
-                assert (n - i >= 2);
+                if (n - i < 2) {
+                    throw new IllegalArgumentException("Malformed escape pair: " + s);
+                }
+
                 try {
                     bb.put(unescape(s, i));
-                } catch (NumberFormatException e) {
-                    throw new IllegalArgumentException();
+                } catch (NumberFormatException | IndexOutOfBoundsException e) {
+                    throw new IllegalArgumentException("Malformed escape pair: " + s);
                 }
                 i += 3;
                 if (i >= n)

src/java.base/share/classes/sun/net/www/protocol/ftp/Handler.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1994, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1994, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -30,6 +30,7 @@
 package sun.net.www.protocol.ftp;
 
 import java.io.IOException;
+import java.net.MalformedURLException;
 import java.net.URL;
 import java.net.Proxy;
 import java.util.Map;
@@ -58,6 +59,14 @@ protected java.net.URLConnection openConnection(URL u)
 
     protected java.net.URLConnection openConnection(URL u, Proxy p)
         throws IOException {
-        return new FtpURLConnection(u, p);
+        FtpURLConnection connection = null;
+        try {
+            connection = new FtpURLConnection(u, p);
+        } catch (IllegalArgumentException e) {
+            var mfue = new MalformedURLException(e.getMessage());
+            mfue.initCause(e);
+            throw mfue;
+        }
+        return connection;
     }
 }

test/jdk/java/net/URL/B8282395.java

@@ -0,0 +1,57 @@
+/*
+ * Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+/* @test
+ * @summary URL.openConnection can throw IOOBE
+ * @bug 8282395
+ */
+
+import java.net.MalformedURLException;
+import java.net.Proxy;
+import java.net.URL;
+
+public class B8282395 {
+    public static void main(String[] args) throws Exception {
+        boolean res = false;
+        URL url = new URL("ftp://.:%@");
+        try {
+            // Will throw IndexOutOfBoundsException if not fixed
+            url.openConnection();
+        } catch (MalformedURLException e) {
+            res = true;
+        }
+        if (!res) {
+            throw new RuntimeException("MalformedURLException should be thrown");
+        }
+        res = false;
+        try {
+            // Will throw IndexOutOfBoundsException if not fixed
+            url.openConnection(Proxy.NO_PROXY);
+        } catch (MalformedURLException e) {
+            res = true;
+        }
+        if (!res) {
+            throw new RuntimeException("MalformedURLException should be thrown");
+        }
+    }
+
+}