JDK-8014620 : Signature.getAlgorithm return null in special case
  • Type: Bug
  • Component: security-libs
  • Sub-Component: java.security
  • Affected Version: 8
  • Priority: P3
  • Status: Closed
  • Resolution: Fixed
  • Submitted: 2013-05-15
  • Updated: 2016-11-26
  • Resolved: 2013-06-18
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 6 JDK 7 JDK 8
6u181Fixed 7u171Fixed 8 b96Fixed
Description
From:  http://mail.openjdk.java.net/pipermail/security-dev/2013-May/007455.html

I find in a special case: If you create a SignatureSpi service through extending Signature rather than SignatureSpi, the returned signature instance will lose its algorithm name.

Though the fix[1] is simple I think it's valuable. Could anyone take a look?

--- old/src/share/classes/java/security/Signature.java	2013-05-14 10:49:13.214766505 +0800
+++ new/src/share/classes/java/security/Signature.java	2013-05-14 10:49:13.094766510 +0800
@@ -248,6 +248,7 @@
         Signature sig;
         if (instance.impl instanceof Signature) {
             sig = (Signature)instance.impl;
+            sig.algorithm = algorithm;
         } else {
             SignatureSpi spi = (SignatureSpi)instance.impl;
             sig = new Delegate(spi, algorithm);
--- /dev/null	2013-05-14 09:52:53.426842541 +0800
+++ new/test/java/security/Signature/SignatureGetAlgorithm.java	2013-05-14 10:49:13.666766485 +0800
@@ -0,0 +1,83 @@
+/*
+ * Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * Portions Copyright (c) 2013 IBM Corporation
+ */
+
+/*
+ * @test
+ * @bug 
+ * @Signature.getAlgorithm() return null if a concrete SignatureSpi extends
+ * Signature rather than SignatureSpi
+ * @author youdwei
+ */
+
+import java.security.*;
+
+public class SignatureGetAlgorithm {
+    public static void main(String[] args) throws Exception {
+        Provider testProvider = new TestProvider();
+        Security.addProvider(testProvider);
+        Signature apple = Signature.getInstance("apple");
+        String algorithm = apple.getAlgorithm();
+        System.out.println("Algorithm is " + algorithm);
+        if (algorithm == null) {
+            throw new Exception("algorithm should be apple but null");
+       }
+    }
+
+public static class TestProvider extends Provider {
+    TestProvider() {
+        super("test", 1.0, "test");
+        put("Signature.apple", "SignatureGetAlgorithm$Apple");
+    }
+}
+
+public static class Apple extends Signature {
+        public Apple() {
+            super(null);
+            System.out.println("Apple Signature");
+       }
+        Apple(String s) {
+            super(s);
+        }
+        protected void engineInitVerify(PublicKey publicKey) throws InvalidKeyException {
+        }
+        protected void engineInitSign(PrivateKey privateKey) throws InvalidKeyException {
+        }
+        protected void engineUpdate(byte b) throws SignatureException { }
+        protected void engineUpdate(byte[] b, int off, int len) throws SignatureException { }
+        protected byte[] engineSign() throws SignatureException {
+            return new byte[0];
+        }
+        protected boolean engineVerify(byte[] sigBytes) throws SignatureException {
+            return false;
+        }
+        protected void engineSetParameter(String param, Object value) throws InvalidParameterException {
+        }
+        protected Object engineGetParameter(String param) throws InvalidParameterException {
+            return null;
+        }
+}
+}
Comments
java/security/Signature/SignatureGetAlgorithm.java has passed in B95-B96 in jdk8
25-06-2013

Submission from OpenJDK.
18-06-2013

I tweaked the test case around quite a bit, but the underlying code seems to be ok. Thanks.
18-06-2013

I took a quick look at the code and it seems reasonable, but need to do a more thorough codereview.
15-05-2013