Page History

import java.util.HashSet;
 
public class ShortSet {
 

In many times, you may want to create a dynamic array of integers. Unfortunately, the type parameter inside the angle brackets cannot be a primitive type. It is not possible to form an ArrayList<int>. Thanks to the wrapper class, now you can use ArrayList<Integer> to achieve this goal.&nbsp; And the process from int to Integer is called autoboxing. However, you should always be careful about doing this. Take the code below as an example:

h2. Code Example
\\ public class TestWrapper1 {
        public static void main(String[] args) {
             
           Integer i1	HashSet<Short> s = new 100HashSet<Short>();
      	for    (int Integeri i2 = 1000;
          i Integer i3 = 1000;
           Integer i4 = 1000;
           System.out.println(i1==i2);
           System.out.println(i3==i4);
          
       }
}


h2. Output of this code&nbsp;
true
false
 

It is because that in JDK 5.0, if the value p being boxed is true, false, a byte, an ASCII character, or an integer or short number between \-127 and 128, then let r1 and r2 be the results of any two boxing conversions of p. It is always the case that r1 == r2. And the reason for this rule explained in criterion for autoboxing:

&nbsp;_"Ideally,&nbsp;boxing a given primitive value p, would always yield an identical reference. In practice, this may not be feasible using existing implementation techniques. The rules above are a pragmatic compromise. The final clause above requires that certain common values always be boxed into indistinguishable objects. The implementation may cache these, lazily or eagerly."_&nbsp;It means that if we have enough memory, we could caches all the integer value(-32K-32K), which means that all the int value could be autoboxing to the same Integer object. But actually it is impractical, so we should be careful about using the following code:

h2. Code Example
\\ import java.util.ArrayList;
 public class TestWrapper2 {
       < 10; i++) {
	  s.add((short)i); // Cast required so that the code compiles
	  s.remove(i); // Tries to remove an Integer
	}
	System.out.println(s.size());
  }
}

import java.util.HashSet;
 
public class ShortSet {
  public static void main(String[] args) {
              //create an array list of integers, which each element
              //is more than 127
           ArrayList<Integer> list1 HashSet<Short> s = new ArrayList<Integer>HashSet<Short>();
      	for     for(int i = 0;i<10; i < 10; i++) {
      	            list1s.add((short)i+200);
             	 //create another array list of integers, which each element
              //is theRemove same with the first one
           ArrayList<Integer> list2 = new ArrayList<Integer>();
           for(int i=0;i<10;i++)
                  list2.add(i+200);        
        
           int counter = 0;
           for(int i=0;i<10;i++)
                  if(list1.get(i) == list2.get(i)) counter++;
           //output the total equal number
           System.out.println(counter);
        }
}
JDK 5.0, the output of this code is 0. But it is an undefined behavior, which depends on how many caches we could use.

h2. Risk Assessment

The result is an undefined behavior, so it will exert&nbsp; a potential security risk.
|| Recommendation || Severity || Likelihood || Remediation Cost || Priority || Level ||
| | medium | likely | low | | |

h2. Automated Detection

TODO

h2. Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

h2. References

Chapter 5, Core Java™ 2 Volume I - Fundamentals, Seventh Editiona Short
	  if (s.remove((short)i) == false) {
	    System.err.println("Error removing " + i);
	  }
	}
	System.out.println(s.size());
  }
}