[security-dev 01141]: TimeZone.setDefaultZone() permission check change between 6 and 7

[Mark Wielaard]

Hi,

While investigating a bug report reported by one of the JBoss hackers:
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=381
"Stackoverflow error with security manager, signed jars and
-Djava.security.debug set", I noticed there is a change in permission
check between openjdk6 and openjdk7 with respect to the
TimeZone.setDefaultZone() method.

Attached is the diff. The first change is similar to what I would have
suggested. But I am not sure about the second change.

I couldn't find a commit or bug report for this issue. Does someone
remember why the changes were made? I would like to backport them to 6.

Thanks,

Mark

--- openjdk6/jdk/src/share/classes/java/util/TimeZone.java	2009-08-04 18:54:13.026104895 +0200
+++ openjdk7/jdk/src/share/classes/java/util/TimeZone.java	2009-08-04 18:53:09.035985858 +0200
@@ -602,11 +602,7 @@
                 }
             });
 
-        if (hasPermission()) {
-            defaultTimeZone = tz;
-        } else {
-            defaultZoneTL.set(tz);
-        }
+        defaultTimeZone = tz;
         return tz;
     }
 
@@ -637,6 +633,7 @@
         if (hasPermission()) {
             synchronized (TimeZone.class) {
                 defaultTimeZone = zone;
+                defaultZoneTL.set(null);
             }
         } else {
             defaultZoneTL.set(zone);