8328874: Class::forName0 should validate the class name length early

src/java.base/share/classes/java/lang/Class.java

@@ -92,6 +92,7 @@
 import sun.reflect.generics.scope.ClassScope;
 import sun.reflect.annotation.*;
 
+import static jdk.internal.util.ModifiedUtf.utfLen;
 /**
  * Instances of the class {@code Class} represent classes and
  * interfaces in a running Java application. An enum class and a record
@@ -222,6 +223,7 @@ public final class Class<T> implements java.io.Serializable,
     private static final int ANNOTATION= 0x00002000;
     private static final int ENUM      = 0x00004000;
     private static final int SYNTHETIC = 0x00001000;
+    private static final int JAVA_CLASSNAME_MAX_LEN = 65535;
 
     private static native void registerNatives();
     static {
@@ -467,6 +469,7 @@ public static Class<?> forName(String className)
     @CallerSensitiveAdapter
     private static Class<?> forName(String className, Class<?> caller)
             throws ClassNotFoundException {
+        validateClassNameLength(className);
         ClassLoader loader = (caller == null) ? ClassLoader.getSystemClassLoader()
                                               : ClassLoader.getClassLoader(caller);
         return forName0(className, true, loader, caller);
@@ -549,6 +552,7 @@ private static Class<?> forName(String className, Class<?> caller)
     public static Class<?> forName(String name, boolean initialize, ClassLoader loader)
         throws ClassNotFoundException
     {
+        validateClassNameLength(name);
         return forName0(name, initialize, loader, null);
     }
 
@@ -597,7 +601,9 @@ private static native Class<?> forName0(String name, boolean initialize,
      */
     public static Class<?> forName(Module module, String name) {
         Objects.requireNonNull(module);
-        Objects.requireNonNull(name);
+        if (!classNameLengthIsValid(name)) {
+            return null;
+        }
 
         ClassLoader cl = module.getClassLoader();
         if (cl != null) {
@@ -4148,4 +4154,25 @@ int getClassFileVersion() {
      int getClassFileAccessFlags() {
          return classFileAccessFlags;
      }
+
+    // Checks whether the class name exceeds the maximum allowed length.
+    private static boolean classNameLengthIsValid(String name) {
+        Objects.requireNonNull(name);
+        // Quick approximation: each char can be at most 3 bytes in Modified UTF-8.
+        // If the string is short enough, it definitely fits.
+        if (name.length() * 3 <= JAVA_CLASSNAME_MAX_LEN) {
+            return true;
+        }
+        // Compute exact Modified UTF-8 length.
+        return utfLen(name, 0) <= JAVA_CLASSNAME_MAX_LEN;
+    }
+
+    // Validates the length of the class name and throws an exception if it exceeds the maximum allowed length.
+    private static void validateClassNameLength(String name) throws ClassNotFoundException {
+        if (!classNameLengthIsValid(name)) {
+            throw new ClassNotFoundException(
+            "Class name exceeds maximum length of " + JAVA_CLASSNAME_MAX_LEN);
+        }
+    }
+
 }