JDK-8226649 : NullPointerException (boundValues) in SSLSessionImpl methods since JDK-8211018
  • Type: Bug
  • Component: security-libs
  • Sub-Component: javax.net.ssl
  • Affected Version: 13
  • Priority: P3
  • Status: Closed
  • Resolution: Duplicate
  • OS: linux
  • CPU: x86_64
  • Submitted: 2019-06-22
  • Updated: 2019-06-24
  • Resolved: 2019-06-24
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 13
13Resolved
Related Reports
Duplicate :  
Relates :  
Description
A DESCRIPTION OF THE PROBLEM :
JDK-8211018 / c2398053ee90 introduced a new SSLSessionImpl constructor that initializes the final variable "boundValues" to null ... but none of the existing code in that class that references boundValues guards against the possibiility of this variable being null, resulting in NullPointerExceptions from methods such as getValue, putValue, getValueNames(), etc..

This manifests in Apache Solr testing (using jetty 9.4.19.v20190610) as...

java.lang.NullPointerException
at java.base/sun.security.ssl.SSLSessionImpl.getValue(SSLSessionImpl.java:1253)
at org.eclipse.jetty.server.SecureRequestCustomizer.customize(SecureRequestCustomizer.java:230)
at org.eclipse.jetty.server.SecureRequestCustomizer.customize(SecureRequestCustomizer.java:170)
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:363)
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:267)
at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:305)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103)
at org.eclipse.jetty.io.ssl.SslConnection$1.run(SslConnection.java:144)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:781)
at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:917)
at java.base/java.lang.Thread.run(Thread.java:830)

NOTE: I am not an SSL expert, and do not pretend to grasp the motivation behind  JDK-8211018 -- based on the description of that issue it's certainly possible that it's entirely intentional that boundValues = null in these code paths, and that the getValues/setValues/etc methods should not be used in these circustances -- but even if that is true it seems like the methods need to be updated to include null checks and throw something like IllegalStateException

http://hg.openjdk.java.net/jdk/jdk13/diff/c2398053ee90/src/java.base/share/classes/sun/security/ssl/SSLSessionImpl.java
http://hg.openjdk.java.net/jdk/jdk13/diff/c2398053ee90/src/java.base/share/classes/sun/security/ssl/SSLSessionImpl.java

REGRESSION : Last worked in version 13


FREQUENCY : always



Comments
This fix was already a part of updates in JDK-8226338
24-06-2019