8328874: Class::forName0 should validate the class name length early

src/java.base/share/classes/java/lang/Class.java

@@ -92,6 +92,7 @@
 import sun.reflect.generics.scope.ClassScope;
 import sun.reflect.annotation.*;
 
+import static jdk.internal.util.ModifiedUtf.utfLen;
 /**
  * Instances of the class {@code Class} represent classes and
  * interfaces in a running Java application. An enum class and a record
@@ -222,6 +223,7 @@ public final class Class<T> implements java.io.Serializable,
     private static final int ANNOTATION= 0x00002000;
     private static final int ENUM      = 0x00004000;
     private static final int SYNTHETIC = 0x00001000;
+    private static final int JAVA_CLASSNAME_MAX_LEN = 65535;
 
     private static native void registerNatives();
     static {
@@ -467,6 +469,7 @@ public static Class<?> forName(String className)
     @CallerSensitiveAdapter
     private static Class<?> forName(String className, Class<?> caller)
             throws ClassNotFoundException {
+        validateClassNameLength(className);
         ClassLoader loader = (caller == null) ? ClassLoader.getSystemClassLoader()
                                               : ClassLoader.getClassLoader(caller);
         return forName0(className, true, loader, caller);
@@ -549,6 +552,7 @@ private static Class<?> forName(String className, Class<?> caller)
     public static Class<?> forName(String name, boolean initialize, ClassLoader loader)
         throws ClassNotFoundException
     {
+        validateClassNameLength(name);
         return forName0(name, initialize, loader, null);
     }
 
@@ -597,7 +601,9 @@ private static native Class<?> forName0(String name, boolean initialize,
      */
     public static Class<?> forName(Module module, String name) {
         Objects.requireNonNull(module);
-        Objects.requireNonNull(name);
+        if (!classNameLengthIsValid(name)) {
+            return null;
+        }
 
         ClassLoader cl = module.getClassLoader();
         if (cl != null) {
@@ -4148,4 +4154,25 @@ int getClassFileVersion() {
      int getClassFileAccessFlags() {
          return classFileAccessFlags;
      }
+
+    // Checks whether the class name exceeds the maximum allowed length.
+    private static boolean classNameLengthIsValid(String name) {
+        Objects.requireNonNull(name);
+        // Quick approximation: each char can be at most 3 bytes in Modified UTF-8.
+        // If the string is short enough, it definitely fits.
+        if (name.length() * 3 <= JAVA_CLASSNAME_MAX_LEN) {
+            return true;
+        }
+        // Compute exact Modified UTF-8 length.
+        return utfLen(name, 0) <= JAVA_CLASSNAME_MAX_LEN;
+    }
+
+    // Validates the length of the class name and throws an exception if it exceeds the maximum allowed length.
+    private static void validateClassNameLength(String name) throws ClassNotFoundException {
+        if (!classNameLengthIsValid(name)) {
+            throw new ClassNotFoundException(
+            "Class name length exceeds limit of " + JAVA_CLASSNAME_MAX_LEN);
+        }
+    }
+
 }

test/jdk/java/lang/Class/forName/ForNameNames.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2023, 2025, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -23,7 +23,7 @@
 
 /**
  * @test
- * @bug 8310242
+ * @bug 8310242 8328874
  * @run junit ForNameNames
  * @summary Verify class names for Class.forName
  */
@@ -37,6 +37,7 @@
 import static org.junit.jupiter.api.Assertions.*;
 
 public class ForNameNames {
+    private static final int JAVA_CLASSNAME_MAX_LEN = 65535;
     static class Inner {}
     static Stream<Arguments> testCases() {
         return Stream.of(
@@ -90,4 +91,21 @@ void testModule() {
         assertNull(c);
     }
 
+    @Test
+    void testTooLongName() {
+        ClassLoader loader = ForNameNames.class.getClassLoader();
+        String tooLongName = "A".repeat(JAVA_CLASSNAME_MAX_LEN+1);
+        String errMsg = "Class name length exceeds limit of";
+
+        ClassNotFoundException ex = assertThrows(ClassNotFoundException.class,
+                                                 () -> Class.forName(tooLongName, false, loader));
+        assertTrue(ex.getMessage().contains(errMsg),
+                   "Unexpected exception message");
+
+        ex = assertThrows(ClassNotFoundException.class,
+                          () -> Class.forName(tooLongName));
+        assertTrue(ex.getMessage().contains(errMsg),
+                   "Unexpected exception message");
+   }
+
 }