JDK-8055045 : StringIndexOutOfBoundsException while reading krb5.conf
  • Type: Bug
  • Component: security-libs
  • Sub-Component: org.ietf.jgss:krb5
  • Affected Version: 7u55
  • Priority: P3
  • Status: Closed
  • Resolution: Fixed
  • OS: generic
  • Submitted: 2014-08-13
  • Updated: 2016-08-26
  • Resolved: 2015-01-26
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 7 JDK 8 JDK 9
7u80Fixed 8u45Fixed 9 b49Fixed
Description
FULL PRODUCT VERSION :
java version "1.7.0_55"
Java(TM) SE Runtime Environment (build 1.7.0_55-b13)
Java HotSpot(TM) 64-Bit Server VM (build 24.55-b03, mixed mode)

ADDITIONAL OS VERSION INFORMATION :
Linux app482.auto.mobileiron.com 2.6.18-371.6.1.el5 #1 SMP Wed Mar 12 20:03:51 EDT 2014 x86_64 x86_64 x86_64 GNU/Linux

A DESCRIPTION OF THE PROBLEM :
Following Exception coming while parsing "krb5.conf" 

2014-04-17 13:53:12,958 ERROR [UploadSystemBackupImpl] (MIReportScheduler_Worker-2:) Failed to SCP file: java.lang.StringIndexOutOfBoundsException: String index out of range: 0
java.lang.StringIndexOutOfBoundsException: String index out of range: 0
	at java.lang.String.charAt(String.java:658)
	at sun.security.krb5.Config.trimmed(Config.java:802)
	at sun.security.krb5.Config.parseField(Config.java:819)
	at sun.security.krb5.Config.parseStanzaTable(Config.java:675)
	at sun.security.krb5.Config.<init>(Config.java:171)
	at sun.security.krb5.Config.getInstance(Config.java:96)
	at sun.security.krb5.PrincipalName.<init>(PrincipalName.java:364)
	at sun.security.jgss.krb5.Krb5NameElement.getInstance(Krb5NameElement.java:93)
	at sun.security.jgss.krb5.Krb5MechFactory.getNameElement(Krb5MechFactory.java:95)
	at sun.security.jgss.GSSManagerImpl.getNameElement(GSSManagerImpl.java:202)
	at sun.security.jgss.GSSNameImpl.getElement(GSSNameImpl.java:472)
	at sun.security.jgss.GSSNameImpl.init(GSSNameImpl.java:201)
	at sun.security.jgss.GSSNameImpl.<init>(GSSNameImpl.java:170)
	at sun.security.jgss.GSSNameImpl.<init>(GSSNameImpl.java:151)
	at sun.security.jgss.GSSManagerImpl.createName(GSSManagerImpl.java:127)
	at com.jcraft.jsch.jgss.GSSContextKrb5.create(GSSContextKrb5.java:80)
	at com.jcraft.jsch.UserAuthGSSAPIWithMIC.start(UserAuthGSSAPIWithMIC.java:125)
	at com.jcraft.jsch.Session.connect(Session.java:463)
	at com.jcraft.jsch.Session.connect(Session.java:183)
	at com.mi.middleware.service.impl.UploadSystemBackupImpl.sendViaSCP(UploadSystemBackupImpl.java:820)

Same "karb5.conf" file successfully getting parsed in Java 6.

Exception is due to following method which newly added in Java 7

800     private static String More ...trimmed(String s) {
801         s = s.trim();
802         if (s.charAt(0) == '"' && s.charAt(s.length()-1) == '"' ||
803                 s.charAt(0) == '\'' && s.charAt(s.length()-1) == '\'') {
804             s = s.substring(1, s.length()-1).trim();
805         }
806         return s;
807     }

REGRESSION.  Last worked in version 6u45


ERROR MESSAGES/STACK TRACES THAT OCCUR :
2014-04-17 13:53:12,958 ERROR [UploadSystemBackupImpl] (MIReportScheduler_Worker-2:) Failed to SCP file: java.lang.StringIndexOutOfBoundsException: String index out of range: 0
java.lang.StringIndexOutOfBoundsException: String index out of range: 0
	at java.lang.String.charAt(String.java:658)
	at sun.security.krb5.Config.trimmed(Config.java:802)
	at sun.security.krb5.Config.parseField(Config.java:819)
	at sun.security.krb5.Config.parseStanzaTable(Config.java:675)
	at sun.security.krb5.Config.<init>(Config.java:171)
	at sun.security.krb5.Config.getInstance(Config.java:96)
	at sun.security.krb5.PrincipalName.<init>(PrincipalName.java:364)
	at sun.security.jgss.krb5.Krb5NameElement.getInstance(Krb5NameElement.java:93)
	at sun.security.jgss.krb5.Krb5MechFactory.getNameElement(Krb5MechFactory.java:95)
	at sun.security.jgss.GSSManagerImpl.getNameElement(GSSManagerImpl.java:202)
	at sun.security.jgss.GSSNameImpl.getElement(GSSNameImpl.java:472)
	at sun.security.jgss.GSSNameImpl.init(GSSNameImpl.java:201)
	at sun.security.jgss.GSSNameImpl.<init>(GSSNameImpl.java:170)
	at sun.security.jgss.GSSNameImpl.<init>(GSSNameImpl.java:151)
	at sun.security.jgss.GSSManagerImpl.createName(GSSManagerImpl.java:127)
	at com.jcraft.jsch.jgss.GSSContextKrb5.create(GSSContextKrb5.java:80)
	at com.jcraft.jsch.UserAuthGSSAPIWithMIC.start(UserAuthGSSAPIWithMIC.java:125)
	at com.jcraft.jsch.Session.connect(Session.java:463)
	at com.jcraft.jsch.Session.connect(Session.java:183)
	at com.mi.middleware.service.impl.UploadSystemBackupImpl.sendViaSCP(UploadSystemBackupImpl.java:820)

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
krb5.conf file

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log
[libdefaults]
 default_realm = EXCHCE.COM
 default_keytab_name = FILE:/etc/krb5.keytab
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
[realms]
 EXCHCE.COM = {
  kdc = prince.exchce.com
  default_domain = exchce.com
  admin_server = prince.exchce.com
 }
[domain_realm]
 .exchce.com = EXCHCE.COM
 exchce.com = EXCHCE.COM
---------- END SOURCE ----------

SUPPORT :
YES


Comments
[~asaha] JDK-6714845 seems to be the cause
30-01-2015

which fix caused this regression ?
28-01-2015

Nightly results are OK. So, SQE OK to take the fix in PSU15_02
28-01-2015

[~weijun] Okay, sure. I've set the fix version to 9, removed the 8-na label and reassigned the issue to you then.
22-01-2015

[~igerasim] Yes, you do 8u and me 9, OK? And, should the 8-na label be removed?
22-01-2015

The pushed fix also handles a degenerative case when the value is an unpaired quote. Might be worth to forward-port it into 8 and 9.
22-01-2015

Recommended fix (jdk8 already fixed in another bug fix) diff --git a/src/share/classes/sun/security/krb5/Config.java b/src/share/classes/sun/security/krb5/Config.java --- a/src/share/classes/sun/security/krb5/Config.java +++ b/src/share/classes/sun/security/krb5/Config.java @@ -795,6 +795,7 @@ private static String trimmed(String s) { s = s.trim(); + if (s.isEmpty()) return s; if (s.charAt(0) == '"' && s.charAt(s.length()-1) == '"' || s.charAt(0) == '\'' && s.charAt(s.length()-1) == '\'') { s = s.substring(1, s.length()-1).trim();
22-08-2014

Confirmed, the krb5.conf actually read is [libdefaults] default_realm = default_checksum = rsa-md5 default_tkt_enctypes = default_tgs_enctypes = permitted_enctypes = [realms]
21-08-2014

This is a bug but it should only show when a relation has no value (say, a=). The customer provided krb5.conf does not seem so, Will double check.
15-08-2014