JDK-6803376 : BasicConstraintsExtension does not encode when (ca==false && pathLen<0)
  • Type: Bug
  • Component: security-libs
  • Sub-Component: java.security
  • Affected Version: 7
  • Priority: P4
  • Status: Closed
  • Resolution: Fixed
  • OS: generic
  • CPU: generic
  • Submitted: 2009-02-10
  • Updated: 2011-03-07
  • Resolved: 2011-03-07
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 7
7 b50Fixed
Related Reports
Relates :  
Description
When trying to encode a BasicConstraintsExtension with ca=false and a default pathlen (-1), the following exception is thrown:

Caused by: java.io.IOException: No value to encode for the extension!
	at sun.security.x509.Extension.encode(Extension.java:173)
	at sun.security.x509.BasicConstraintsExtension.encode(BasicConstraintsExtension.java:204)

The reason is the codes below in BasicConstraintsExtension.java,

     private void encodeThis() throws IOException {
         if (ca == false && pathLen < 0) {
             this.extensionValue = null;
             return;
         }
         ....

The ASN.1 definition for the extension (RFC 5280 4.2.1.9) declares both field as optional inside a SEQUENCE.

Comments
EVALUATION Suggest fix accepted. Also, this class uses if(data==bull) to check whether the extension is empty (no cA or pathLen field). This check is not always unsafe because some DerValue constrcutors might initialize this field as null while others might not. This behavior is fixed in another bug (see 6804045), ad the check here is enhanced.
23-02-2009

EVALUATION http://hg.openjdk.java.net/jdk7/tl/jdk/rev/8edcd68fb6ac
23-02-2009

SUGGESTED FIX Remove the if block at the beginning of encodeThis() method. *** (#1 of 1): [ UNSAVED ] ###@###.###
10-02-2009