| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: bcel | Distribution: openSUSE Tumbleweed |
| Version: 6.13.0 | Vendor: openSUSE |
| Release: 1.1 | Build date: Wed Oct 7 11:35:23 2026 |
| Group: Development/Libraries/Java | Build host: reproducible |
| Size: 738528 | Source RPM: bcel-6.13.0-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://commons.apache.org/proper/commons-bcel/ | |
| Summary: Byte Code Engineering Library | |
The Byte Code Engineering Library is intended to give users a convenient way to analyze, create, and manipulate (binary) Java class files (those ending with .class). Classes are represented by objects that contain all the symbolic information of the given class: methods, fields, and byte code instructions, in particular. Such objects can be read from an existing file, transformed by a program (such as a class loader at runtime), and dumped to a file again. An even more interesting application is the creation of classes from scratch at runtime. The Byte Code Engineering Library (BCEL) may also be useful if you want to learn about the Java Virtual Machine (JVM) and the format of Java .class files. BCEL is already being used successfully in several projects, such as compilers, optimizers, obfuscators, code generators, and analysis tools. It contains a byte code verifier named JustIce, which usually gives you much better information about what is wrong with your code than the standard JVM message.
Apache-2.0
* Wed Oct 07 2026 Fridrich Strba <fstrba@suse.com>
- Update to version 6.13.0
* New Features
+ Add support for permitted subclasses
+ Add RecordComponentInfo.getAttribute(byte tag)
+ Add Const.MAJOR_27
+ Add Const.MINOR_27
+ Add and use ArrayType.isElementType(Type)
+ Add Const.MAJOR_28
+ Add Const.MINOR_28
* Fixed Bugs
+ Fix constant pool module access test on Java 26 and above
+ Deprecate org.apache.bcel.classfile.Utility.Utility()
+ Deprecate org.apache.bcel.verifier.exc.Utility
.getStackTrace(Throwable)
+ Fix all Javadoc warnings and enforce checks by default
+ Escape constant pool names in generated HTML
+ Escape referenced names in BCELFactory Java output
+ Make wide flag thread-local in Utility.codeToString
+ Read multianewarray dimensions as unsigned byte
+ Site docs: clarify security model
+ Read ConstantDynamic indices as unsigned shorts
+ Validate index upper bound in CPInstruction, IINC and RET
setIndex
+ Use correct attribute tag in NestHost and ModuleMainClass
+ Propagate runtime-visible flag when parsing parameter
annotations
+ Use fixedLength for parsed LOOKUPSWITCH length
+ Fix ConstantPoolGen dedup key collisions for names with
delimiters
+ Read unsigned bytecode operands in CodeHTML disassembler
+ Deep-copy bootstrap arguments array in BootstrapMethod.copy()
+ Use exclusive live-range end in LocalVariableTable
.getLocalVariable
+ Build TABLESWITCH from sorted arrays in SWITCH
+ Use array element type not basic type for primitive array
access
+ Set length in INVOKEDYNAMIC constructor
+ Reject CALOAD on non-char arrays in structural verification
+ Add negative verifier tests for remaining array load/store
component type checks
+ Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY
+ Match wide local variable instruction length to dumped bytes
+ Bound IINC increment to signed short
+ Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ConstantUtf8
+ Nested Code/Record attributes drive unbounded parse-time
recursion in ClassParser
+ Nested annotation element values recurse unboundedly;
MAX_ARRAY_DIMENSIONS cap bypassed
+ Opcodes tableswitch and lookupswitch add boundary checks
+ JustIce Pass 2 hangs on cyclic superclass chain of a
referenced exception class
+ JustIce Pass 2 LVT check amplifies each 10-byte entry into
~131k hashtable operations
+ Pass 3b dataflow stores frames per instruction and clones
ever-growing execution chains
+ Cubic handlers × range × subroutines scan in Subroutines
constructor hangs JustIce Pass 3b
+ Subroutines.noRecursiveCalls enumerates exponentially many JSR
call paths
+ Disassembler and Class2HTML re-implement the unchecked
switch-table allocation
+ ConstantPool.constantToString recurses forever on
self-referencing CONSTANT_MethodHandle
+ Utility.typeSignatureToString recurses per generic-nesting
level, unbounded, with quadratic substring copies
+ Repositories cache classes under the input-defined this_class
name; global static Repository/VerifierFactory make the
poisoning ClassLoader-wide (bsc#1284400, CVE-2026-94114)
+ Silent u2/u1 count truncation across dump paths corrupts
emitted bytecode
+ Class2HTML emitters write attacker class-file strings into
HTML unescaped (stored XSS in reports) (bsc#1284399,
CVE-2026-105111)
+ Class2HTML builds output file paths from the unvalidated class
name
+ ClassPath.getBytes() sizes its buffer from the forged ZIP
uncompressed-size field
+ PMG attribute ignores declared length, enabling BCEL-vs-JVM
parse divergence
+ Signature.matchGJIdent recurses unboundedly on nested generic
signatures (Signature.translate)
+ Utility.decode fixed 3x buffer breaks the encode/decode round
trip and throws unchecked AIOOBE
+ BCELifier interpolates attacker class/package names into
generated Java source unescaped
+ Verifier pass 3a delayed checks are quadratic in attribute and
code size
+ Verifier cache grows unboundedly with attacker-chosen class
names
+ Static WIDE ThreadLocal survives exceptions, corrupting the
next class's disassembly on the same thread
+ Utility.JavaReader escape decoding: OOB table index, bad-hex
crash, silent non-canonical aliasing
* Changes
+ Bump org.apache.commons:commons-parent from 95 to 104
+ Bump org.jetbrains.kotlin:kotlin-stdlib from 2.3.0 to 2.4.20
+ Bump commons-io:commons-io from 2.21.0 to 2.22.0
+ Bump jna.version from 5.18.1 to 5.19.1
+ [test] Bump org.apache.commons:commons-collections4 from 4.5.0
to 4.6.0
- Changes of version 6.12.0
* New Features
+ Add Const.MAJOR_26
+ Add Const.MINOR_26
* Fixed Bugs
+ Fix infinite loop in example.TransitiveHull
+ Fix Apache RAT plugin console warnings
+ Fix malformed Javadoc comments
+ Make the build reproducible on the Azul JDK
+ Fix infinite loop in JavaClass.findField() on invalid input
+ Fix infinite loop in JavaClass.getAllInterfaces() on invalid
input
+ Fix infinite loop in JavaClass.getSuperClasses() on invalid
input
+ Exception message in Args.requireU4() refers to the wrong data
type
+ Exception message in Args.requireU2() refers to the wrong
upper range value
+ Code.Code(int, int, DataInput, ConstantPool) now throws a
ClassFormatException if the code array is greater than the
JVM specification allows
+ Code.Code(int, int, int, int, byte[], CodeException[],
Attribute[], ConstantPool) now throws a ClassFormatException
if the code array is greater than the JVM specification allows
+ Code.setCode(byte[]) now throws a ClassFormatException if the
code array is greater than the JVM specification allows
+ ClassDumper.dump() should not call the input stream it didn't
open; fixes IOException when calling DumpClass.main
(ClassDumper.java:351)
+ org.apache.bcel.classfile.ConstantPool.ConstantPool(Constant[])
now uses varagrs: ConstantPool(Constant...)
+ org.apache.bcel.classfile.Deprecated now requires its the
attribute_length item be zero
+ org.apache.bcel.classfile.Synthetic now requires its the
attribute_length item be zero
+ The size of an Attribute unknown to the JVM specification is
limited to 1 MB and is overridden with the system property
BCEL.Attribute.Unknown.max_attribute_length
* Changes
+ Bump org.apache.commons:commons-parent from 89 to 95
+ [test] Bump org.jetbrains.kotlin:kotlin-stdlib from 2.2.20 to
2.3.0
+ Bump commons-io:commons-io from 2.20.0 to 2.21.0
+ Bump commons-lang3 from 3.19.0 to 3.20.0
+ [test] Bump org.apache.commons:commons-exec from 1.5.0 to
1.6.0
- Changes of version 6.11.0
* New Features
+ Add Const.MAJOR_25
+ Add Const.MINOR_25
+ Add experimental CycloneDX VEX file
+ Refactor to use new Maven POM variable ecj.version
* Fixed Bugs
+ Replace internal use of Locale.ENGLISH with Locale.ROOT
+ BCEL-375: Wrong permissions on bcel .jar file in binary
.tar.gz distribution file
+ BCEL-376: ClassPath.close() throws
UnsupportedOperationException when created with
system-classpath
+ ClassPath.getResources(String) can use an ArrayList instead of
a Vector
+ Fix SpotBugs [ERROR] Medium: Operation on the "created" shared
variable in "ConstantUtf8" class is not atomic [org.apache
.bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 119]
AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE
+ Fix SpotBugs [ERROR] Medium: Operation on the "considered"
shared variable in "ConstantUtf8" class is not atomic [org
.apache.bcel.classfile.ConstantUtf8] At ConstantUtf8.java:
[line 137] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE
+ Fix SpotBugs [ERROR] Medium: Operation on the "skipped" shared
variable in "ConstantUtf8" class is not atomic [org.apache
.bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 134]
AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE
+ org.apache.bcel.util.ClassPath
.addJdkModules(String, List<String>) now reads the system
property "jdk.module.path" instead of "java.modules.path"
+ Fix ConstantPoolModuleAccessTest failures on Java 25
+ 377: Fix testing on Java 24 and up
* Changes
+ Bump org.apache.commons:commons-parent from 72 to 89
+ Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.19.0
+ Bump org.jetbrains.kotlin:kotlin-stdlib from 2.0.0 to 2.2.20
+ Bump commons-io:commons-io from 2.16.1 to 2.20.0
+ Bump jna.version from 5.14.0 to 5.18.1
+ Bump org.codehaus.mojo:taglist-maven-plugin from 3.1.0 to
3.2.1
+ Bump org.apache.commons:commons-collections4 from 4.5.0-M2 to
4.5.0
+ Bump org.apache.commons:commons-exec from 1.4.0 to 1.5.0
* Fri Sep 20 2024 Gus Kenion <gus.kenion@suse.com>
- Update to version 6.10.0
* 6.10.0 (2024-06-24) Maintenance and bug fix release. Requires
a minimum of Java 8
+ Fix PMD UnnecessaryFullyQualifiedName
+ Fix PMD EmptyCatchBlock by allowing commented blocks
+ Fix PMD EmptyControlStatement by allowing commented blocks
+ Fix SpotBugs RV_RETURN_VALUE_IGNORED_BAD_PRACTICE in
JasminVisitor
+ SpotBugs checks should ignore code generated by JavaCC
+ Fix SpotBugs URF_UNREAD_FIELD in ClassDumper
+ Fix SpotBugs DM_DEFAULT_ENCODING in JasminVisitor
+ Fix SpotBugs RCN_REDUNDANT_NULLCHECK_WOULD_HAVE_BEEN_A_NPE in
ASTFunAppl
+ Fix SpotBugs RV_ABSOLUTE_VALUE_OF_HASHCODE in
Mini.Environment
+ Fix SpotBugs DM_DEFAULT_ENCODING in Mini.MiniC
+ Fix SpotBugs WMI_WRONG_MAP_ITERATOR in Package.go(String[])
+ Deprecate TransitiveHull.INGORED in favor of
TransitiveHull.getIgnored()
+ Add accessors to model and unit tests, Javadoc
+ Add Const.MAJOR_22
+ Add Const.MINOR_22
+ Add Const.MAJOR_23
+ Add Const.MINOR_23
+ Add Const.MAJOR_24
+ Add Const.MINOR_24
+ Bump tests from org.assertj:assertj-core 3.25.3 to 3.26.3
+ Bump tests from org.jetbrains.kotlin:kotlin-stdlib 1.9.23 to
2.0.0
+ Bump tests from org.apache.commons:commons-collections4 4.4
to 4.5.0-M2
+ Bump org.apache.commons:commons-parent from 69 to 71
+ Bump org.codehaus.mojo:taglist-maven-plugin from 3.0.0 to
3.1.0
* Includes changes from 6.9.0 Maintenance and bug fix release
+ Add Support for Java 16 records
+ Add null guard for InstructionFactory.createInvoke()
+ Avoid possible NullPointerException in
org.apache.bcel.classfile.DescendingVisitor.accept(E[])
+ Avoid possible NullPointerException in
AnnotationEntryGen.getAnnotationAttributes(ConstantPoolGen,
AnnotationEntryGen[])
+ Avoid possible NullPointerException in
AnnotationEntryGen.copyValues(ElementValuePair[],
ConstantPoolGen, boolean)
+ Avoid possible NullPointerException in
ArrayElementValueGen.ArrayElementValueGen(int,
ElementValue[], ConstantPoolGen)
+ Avoid possible NullPointerException in
org.apache.bcel.generic.ClassGen.setMethods(Method[])
+ Avoid possible NullPointerException in org.apache.bcel.generic
.ClassGen.unpackAnnotations(Attribute[])
+ Avoid possible NullPointerException in org.apache.bcel
.classfile.ParameterAnnotationEntry
.createParameterAnnotationEntries(Attribute[])
+ Avoid possible NullPointerException in
org.apache.bcel.generic.ClassGen.ClassGen(JavaClass)
+ Avoid possible NullPointerException in org.apache.bcel.generic
.FieldGenOrMethodGen.addAll(Attribute[])
+ Avoid possible NullPointerException in org.apache.bcel
.classfile.ParameterAnnotationEntry
.createParameterAnnotationEntries(Attribute[])
+ Avoid NullPointerException after calling org.apache.bcel
.classfile.MethodParameters.setParameters(MethodParameter[])
with null
+ Avoid NullPointerException after calling org.apache.bcel
.classfile.ParameterAnnotations
.setParameterAnnotationTable(ParameterAnnotationEntry[])
with null
+ Avoid NullPointerException after calling org.apache.bcel
.classfile.LocalVariableTypeTable
.setLocalVariableTable(LocalVariable[]) with null
+ Avoid NullPointerException after calling org.apache.bcel
.classfile.LocalVariableTable
.setLocalVariableTable(LocalVariable[]) with null
+ Avoid NullPointerException after calling org.apache.bcel
.classfile.LineNumberTable.setLineNumberTable(LineNumber[])
with null
+ Avoid NullPointerException after calling org.apache.bcel
.classfile.JavaClass.setMethods(Method[] with null
+ Avoid NullPointerException after calling org.apache.bcel
.classfile.JavaClass.setInterfaces(int[]) with null
+ Avoid NullPointerException after calling org.apache.bcel
.classfile.JavaClass.setInterfaceNames(String[]) with null
+ Avoid NullPointerException after calling org.apache.bcel
.classfile.JavaClass.setFields(Field[]) with null
+ Avoid NullPointerException after calling org.apache.bcel
.classfile.JavaClass.setAttributes(Attribute[]) with null
+ Avoid NullPointerException after calling org.apache.bcel
.classfile.ConstantPool.setConstantPool(Constant[]) with null
+ Avoid NullPointerException after calling org.apache.bcel
.classfile.FieldOrMethod.setAttributes(Attribute[]) with null
+ Avoid NullPointerException after calling org.apache.bcel
.classfile.Annotations.setAnnotationTable(AnnotationEntry[])
with null
+ Avoid NullPointerException after calling org.apache.bcel
.classfile.ArrayElementValue.ArrayElementValue(int,
ElementValue[], ConstantPool) with null
+ Avoid NullPointerException after calling org.apache.bcel
.classfile.BootstrapMethod.BootstrapMethod(int, int[]) with
null
+ Avoid NullPointerException after calling org.apache.bcel
.classfile.BootstrapMethod.setBootstrapArguments(int[]) with
null
+ Avoid NullPointerException after calling org.apache.bcel
.classfile.BootstrapMethods.BootstrapMethods(int, int,
BootstrapMethod[], ConstantPool) with null
+ Avoid NullPointerException after calling org.apache.bcel
.classfile.BootstrapMethods
.setBootstrapMethods(BootstrapMethod[]) with null
+ Avoid NullPointerException calling org.apache.bcel.generic
.InstructionList.redirectLocalVariables(LocalVariableGen[],
InstructionHandle, InstructionHandle) with null
+ Avoid NullPointerException calling org.apache.bcel.generic
.InstructionList.redirectExceptionHandlers(CodeExceptionGen[],
InstructionHandle, InstructionHandle) with null
+ Avoid NullPointerException calling org.apache.bcel.generic
.InstructionList.findHandle(InstructionHandle[], int[], int,
int) with null
+ Avoid NullPointerException calling org.apache.bcel.generic
.MethodGen.setArgumentTypes(Type[]) with null
+ Avoid NullPointerException calling org.apache.bcel.generic
.MethodGen.setArgumentNames(String[]) with null
+ Avoid NullPointerException calling org.apache.bcel.generic
.MethodGen.removeRuntimeAttributes(Attribute[]) with null
+ Avoid NullPointerException calling org.apache.bcel.generic
.MethodGen.makeMutableVersion(AnnotationEntry[]) with null
+ Bump org.apache.commons:commons-parent from 66 to 69
+ Bump org.jetbrains.kotlin:kotlin-stdlib from 1.9.22 to 1.9.23
+ Bump commons-io:commons-io from 2.15.1 to 2.16.1
* Sat Dec 23 2023 Anton Shvetz <shvetz.anton@gmail.com>
- Update to version 6.8.0
* 6.8.0 (2023-12-08) Maintenance and bug fix release
+ New features:
~ Add and use InvalidMethodSignatureException extending
ClassFormatException
~ Increase code coverage in Class2HTMLTestCase with new test
input Java4Example
~ Add verifier tests on some opcodes
~ Added signature test cases for class/method, and bad
signatures
~ Add Const.MAJOR_20
~ Add Const.MINOR_20
~ Add Const.MAJOR_21
~ Add Const.MINOR_21
~ [Bcelifier] stackmap support to pass JDK verifier
~ Fix SpotBugs [ERROR] Class org.apache.bcel.util.ClassVector
defines non-transient non-serializable instance field vec
[org.apache.bcel.util.ClassVector] In ClassVector.java
SE_BAD_FIELD
~ Fix SpotBugs [ERROR] Switch statement found in
org.apache.bcel.util.BCELFactory.visitAllocationInstruction(AllocationInstruction)
where one case falls through to the next case
[org.apache.bcel.util.BCELFactory,
org.apache.bcel.util.BCELFactory] At
BCELFactory.java:[lines 188-191]Another occurrence at
BCELFactory.java:[lines 192-196] SF_SWITCH_FALLTHROUGH
+ Fixed bugs:
~ When parsing an class with an invalid constant reference,
ensure ClassParser.parse() throws ClassFormatException, not
NullPointerException
~ Ensure that references to a constant pool entry with index
zero trigger a ClassFormatException, not a
NullPointerException
~ Ensure that references to the unused constant pool entry
after a long/double entry triggers a ClassFormatException,
not a NullPointerException
~ Test and coverage of InstructionFactory
~ Verifier: test and coverage for SWAP instruction
~ Exception parsing Kotlin class with 'fun `method name with
() in it`()'
~ Fix null pointers in AnnotationEntry
~ Field not found, search field in both super class and
implemented interfaces (5x duplicated code to find field by
name and type is refactored to a new method and now
supports package-private)
~ BCEL-366: Use alternative name for broken classes under
test
~ BCEL-367: Fixes java.lang.IndexOutOfBoundsException for
ATHROW on empty stack
~ BCEL-368: Fixes java.lang.StackOverflowError in
Select#toString(boolean)
~ Fix for type.getType(...) use on non-signature type names
~ Fix EmptyVisitorTestCase on Java 21
+ Changes:
~ Bump commons-parent from 54 to 65
~ Bump jna.version from 5.12.1 to 5.13.0
~ Bump kotlin-stdlib from 1.8.10 to 1.9.21
~ Bump commons-io from 2.11.0 to 2.15.1
~ Bump commons-lang3 from 3.12.0 to 3.14.0
~ Bump org.codehaus.mojo:exec-maven-plugin from 3.1.0 to
3.1.1
* Thu Aug 31 2023 Fridrich Strba <fstrba@suse.com>
- Update to version 6.7.0
* 6.7.0 (2022-11-28) Maintenance and bug fix release
* 6.6.1 (2022-10-29) Maintenance and bug fix release
* 6.6.0 (2022-10-08) Minor feature and bug fix release
* 6.5.0 (2020-06-05) Minor feature and bug fix release
* 6.4.1 (2019-09-26) Bug fix release
* 6.4.0 (2019-09-20) Feature and bug fix release
* 6.3.1 (2019-03-20) Bug fix release
* 6.3 (2019-01-23) Experimental Java 9, 10, 11, 12-EA, and 13-EA
Support
* 6.2 (2017-12-08) Experimental Java 9 Support
* 6.1 (2017-09-14) Experimental Java 9 Support
* 6.0 (2016-07-10) Apache Commons BCEL 6.0 is a major release
supporting the new features introduced in Java 6, 7 and 8. It
requires Java 7 or higher to run
COMPATIBILITY with 5.2
+ Binary compatible
- not strictly compatible
- The constant interface org.apache.bcel.Constants has been
deprecated. Classes which implemented this interface in 5.2
now use the constants defined in the org.apache.bcel.Const
class
- The constant interface
org.apache.bcel.generic.InstructionConstants has been
deprecated. Classes which implemented this interface in 5.2
now use the constants defined in the
org.apache.bcel.generic.InstructionConsts class
- Return type of method 'public java.lang.Object
getElementAt(int)' in org.apache.bcel.verifier
.VerifierFactoryListModel has been changed to
java.lang.String
- The BCEL classes do no longer implement java.io.Serializable
+ Source compatible
- Yes, sort of;
- The org.apache.bcel.classfile.Visitor interface has been
enhanced with additional methods. If you implemented it
directly instead of extending the EmptyVisitor class you'll
have to implement the new methods
- The org.apache.bcel.generic.Visitor interface has been
enhanced with an additional method. If you implemented it
directly instead of extending the EmptyVisitor class you'll
have to implement the new methods
+ Semantic compatible
- Yes, except:
- BCEL 6.0 handles new attributes such as code annotations
that could only be processed by implementing a custom
AttributeReader in the previous versions. Code relying on
this behavior will have to be adjusted since the
AttributeReader will no longer be called in these cases
+ For full information about API changes please see the extended
Clirr report: https://commons.apache.org/bcel/clirr-report.html
- Removed patches:
* bcel-5.2-encoding.patch
+ part of our own build.xml file generated to build with ant
* bcel-CVE-2022-42920.patch
+ integrated upstrea
* Thu Nov 10 2022 Pedro Monreal <pmonreal@suse.com>
- Security fix: [bsc#1205125, CVE-2022-42920]
* Apache Commons BCEL prior to 6.6.0 allows producing
arbitrary bytecode via out-of-bounds writing
* Add bcel-CVE-2022-42920.patch
* Fri Feb 01 2019 Fridrich Strba <fstrba@suse.com>
- BuildIgnore xalan-j2, xml-apis, xml-resolver, xerces-j2, since
those packages are not necessary for the build
* Mon Dec 10 2018 Fridrich Strba <fstrba@suse.com>
- Build against the generic xml-apis provider which allows
building against bootstrap and non-bootstrap packages according
of their availability
* Thu Nov 15 2018 Fridrich Strba <fstrba@suse.com>
- Add maven pom file and generate mvn(...) dependencies for this
package
* Tue May 15 2018 fstrba@suse.com
- Build with source and target 8 to prepare for a possible removal
of 1.6 compatibility
* Wed Sep 27 2017 fstrba@suse.com
- Allow building with any java-devel provider
- Specify java source and target level 1.6 to fix build with jdk9
- Added patch:
* bcel-5.2-encoding.patch
+ specify the correct encoding of the files
/usr/share/java/bcel.jar /usr/share/licenses/bcel /usr/share/licenses/bcel/LICENSE.txt /usr/share/maven-metadata/bcel.xml /usr/share/maven-poms/bcel.pom
Generated by rpm2html 1.8.1
Fabrice Bellet, Mon Oct 12 22:27:32 2026