Search code examples
javasecuritycompiler-constructionverification

Accessing private fields without bytecode-verificator

The example is taken from the O'Reilly Java Security book.

There are two classes Card.java

public class Card {
    public int num = 123234;
}

and Test.java

public class Test {
    public static void main(String[] args) {
        Card card = new Card();
        System.out.println("Your card - " + card.num);
    }
}

I compile both classes using Java 1.2. Then I change the modifier of the num field to private and recompile only the Card class.

Starting the Test (java Test) class produces the following output.

Your card - 123234.

So it worked even without switching off the bytecode verifier (Though the author says that had we not the bytecode verifier, it would work).

Now I do the same using Java 1.6. Starting the Test class produces IllegalAccessError, even if I start it with -noverify.

The questions are:

1) Does it have anything to do with bytecode verifier. If it does not, who produced the error.

2) Was it a bug in previous versions of Java then?

Solution

  • Yes, it was an old verifier bug. It looks like it was this one:

    http://bugs.java.com/bugdatabase/view_bug.do?bug_id=4007892

    It is not clear from the (public) bug history exactly when it was fixed, but I suspect that it was fixed a long time ago.

    If it's a bug, and what does it have to do with bytecode verifier

    The bytecode verifier should check that a class doesn't attempt to reference private fields of another class. This check is supposed to happen when the classes are loaded by the JVM.