FULL PRODUCT VERSION :
java version "1.5.0"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0-b64)
Java HotSpot(TM) Client VM (build 1.5.0-b64, mixed mode)


ADDITIONAL OS VERSION INFORMATION :
Linux miguel 2.6.12-12mdksmp #1 SMP Fri Sep 9 17:43:23 CEST 2005 i686 Intel(R) Pentium(R) 4 CPU 2.60GHz unknown GNU/Linux

A DESCRIPTION OF THE PROBLEM :
Class org.ietf.jgss.Oid has a constructor with a String parameter. This constructor accepts oids with negative values, when this value is the last component of the oid. It seems to correctly reject negative values in the rest of the components of the oid.
An ArrayIndexOutOfBoundsException is then thrown when the getDER() method is invoked.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Calling the constructor with the string "1.2.3.-4" will construct an invalid object
org.ietf.jgss.Oid oid = new Oid("1.2.3.-4")

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
It should have thrown GSSException, like
GSSException: Improperly formatted Object Identifier String - 1.2.3.-4
	at org.ietf.jgss.Oid.<init>(Oid.java:54)
	at TestOid.main(TestOid.java:15)
ACTUAL -
The exception is not thrown. If you later call oid.getDER(), you get
Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: 4
	at sun.security.util.ObjectIdentifier.putComponent(ObjectIdentifier.java:314)
	at sun.security.util.ObjectIdentifier.encode(ObjectIdentifier.java:266)
	at sun.security.util.DerOutputStream.putOID(DerOutputStream.java:262)
	at org.ietf.jgss.Oid.getDER(Oid.java:163)
	at TestOid.main(TestOid.java:17)

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
import org.ietf.jgss.GSSException;
import org.ietf.jgss.Oid;

public class TestOid {

	/**
	 * @param args
	 * @throws GSSException
	 */
	public static void main(String[] args){
		String[] oids = {"1.2.-3.4", "1.2.3.-4"};
		for (String s:oids){
			Oid oid;
			try {
				oid = new Oid(s);
				System.out.println("Invalid oid: "+oid);
			} catch (GSSException e) {
				e.printStackTrace();
				System.out.println(s+" was correctly detected as invalid");
			}
		}
	}

}

---------- END SOURCE ----------