JDK-6804045 : DerValue does not accept empty OCTET STRING
  • Type: Bug
  • Component: security-libs
  • Sub-Component: java.security
  • Affected Version: 6u6,7
  • Priority: P4
  • Status: Closed
  • Resolution: Fixed
  • OS: generic,linux
  • CPU: generic,x86
  • Submitted: 2009-02-11
  • Updated: 2011-03-07
  • Resolved: 2011-03-07
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 7
7 b50Fixed
Related Reports
Relates :  
JDK-6766844 - ByteArrayInputStream#read with a byte array of length 0 not consistent with InputStream when at EOF
Relates :  
JDK-6803376 - BasicConstraintsExtension does not encode when (ca==false && pathLen<0)
Relates :  
JDK-6967112 - keytool and generateCertificate() fails when user tries to use OCSP respondercertificates in jdk6u22
Description
When creating a DerValue with 04 00 and then try to read the content, an NPE is thrown.

The reason is that buffer is not assigned a non-null value if length == 0:

    private DerInputStream init(boolean fullyBuffered, InputStream in)
            throws IOException {
        ....
        if (length == 0)
            return null;
        ....
        buffer = new DerInputBuffer(bytes);
        ....
    }

    public byte[] getOctetString() throws IOException {
            byte[] bytes;
        ....
        if (buffer.read(bytes) != length)
        ....
    }
Comments
EVALUATION Fixed. Note that this means the DerValue.data will never be null. Some codes may rely on the nullness of the field to determine whether the value is empty. This check is not longer correct. Until now, the only place this check is found is sun.security.x509.BasicConstraintsExtension. The check will be updated, bug already files at 6803376: BasicConstraintsExtension does not encode when (ca==false && pathLen<0)
23-02-2009
EVALUATION http://hg.openjdk.java.net/jdk7/tl/jdk/rev/ec98d5f9b338
23-02-2009
EVALUATION The data and buffer need to be initialized for any length == 0 data. This is also true for empty SEQUECE, i.e. 30 00. Another problem is that getOctetString tries to call DerInputBuffer.read(byte[0]). A known bug (6766844) causes the return value to be -1 (instead of 0).
13-02-2009