Re: [cp-patches] FYI: RMI/java.io bug 25520 fix in VMObjectInputStream

[Audrius Meskauskas]

Hi, Nicolas,

>Are you sure this is the correct behaviour? The class of the stream 
(which contains the members that couldn't be unserialized and were the 
cause of the bug) is loaded in RMI with the resolveClass method of the 
gnu.java.rmi.server.RMIObjectInputStream. This method calls the 
java.rmi.server.RMIClassLoader.loadClass() which uses a specific class 
loader. Shouldn't the fields be loaded by this class loader instead of 
the application's class loader (which is actually the thread's context 
class loader)?

The thread context class loader need not be always the applications 
class loader, this is just the default value. To load remote classes in 
the ObjectInputStream methods, the mentioned RMI-specific class loader 
should probably be set as the thread context class loader. This must be 
done before that thread calls methods of the ObjectInputStream.  This 
another future fix would be additional to the recently applied patch, 
actualy solving another bug (remote class loading problems).

Regards
Audrius