diff -r 880514b576d5 -r b083590cb088 src/share/classes/org/omg/CORBA_2_3/portable/InputStream.java
--- a/src/share/classes/org/omg/CORBA_2_3/portable/InputStream.java	Tue Nov 12 17:56:08 2013 +0000
+++ b/src/share/classes/org/omg/CORBA_2_3/portable/InputStream.java	Tue Nov 12 18:04:13 2013 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1998, 2000, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1998, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -31,6 +31,10 @@
 
 package org.omg.CORBA_2_3.portable;
 
+import java.io.SerializablePermission;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+
 /**
  * InputStream provides for the reading of all of the mapped IDL types
  * from the stream. It extends org.omg.CORBA.portable.InputStream.  This
@@ -43,6 +47,43 @@
 
 public abstract class InputStream extends org.omg.CORBA.portable.InputStream {
 
+
+    private static final String ALLOW_SUBCLASS_PROP = "jdk.corba.allowInputStreamSubclass";
+
+    private static final boolean allowSubclass = AccessController.doPrivileged(
+        new PrivilegedAction<Boolean>() {
+            @Override
+            public Boolean run() {
+            String prop = System.getProperty(ALLOW_SUBCLASS_PROP);
+                return prop == null ? false :
+                           (prop.equalsIgnoreCase("false") ? false : true);
+            }
+        });
+
+    private static Void checkPermission() {
+        SecurityManager sm = System.getSecurityManager();
+        if (sm != null) {
+            if (!allowSubclass)
+                sm.checkPermission(new
+                    SerializablePermission("enableSubclassImplementation"));
+        }
+        return null;
+    }
+
+    private InputStream(Void ignore) { }
+
+    /**
+     * Create a new instance of this class.
+     *
+     * throw SecurityException if SecurityManager is installed and
+     * enableSubclassImplementation SerializablePermission
+     * is not granted or jdk.corba.allowOutputStreamSubclass system
+     * property is either not set or is set to 'false'
+     */
+    public InputStream() {
+        this(checkPermission());
+    }
+
     /**
      * Unmarshalls a value type from the input stream.
      * @return the value type unmarshalled from the input stream