Name: asR10047 Date: 09/18/2000


CertificateFactory.generateCertificates() method throws NPE instead of returning
an empty Collection when an input stream contains a PKCS#7 SignedData object
without 'certificates' in it.

JavaDoc comment say :
     This is a PKCS#7 SignedData object, with the only significant field being
     certificates. In particular, the signature and the contents are ignored. This
     format allows multiple certificates to be downloaded at once. If no certificates
     are present, an empty collection is returned.


Here is the example demonstrating the bug:
------------------ PKCS7Test.java -----------------
import java.io.ByteArrayInputStream;
import java.security.cert.CertificateFactory;

public class PKCS7Test {

    public static void main(String[] argv) {
        CertificateFactory cf;
        /*
         create an empty SignedData content type in ASN.1 as defined in PKCS#7
        */
        byte[] b={ 0x30, 0x23,
                       /* contentInfo ::= signedData */
                       0x06, 0x09, 0x2A, (byte)0x86, 0x48,
                                   (byte)0x86, (byte)0xF7, 0x0D,
                                   0x01, 0x07, 0x02,
                       0x00, 0x16,
                             0x30, 0x14, /* SignedData */
                                   0x02, 0x01, 0x01, /* version */
                                   0x31, 0x00, /* digestAlgorithms */
                                   0x30, 0x0B, /* contentInfo ::= data */
                                       0x06, 0x09, 0x2A, (byte)0x86, 0x48,
                                                   (byte)0x86, (byte)0xF7, 0x0D,
                                                   0x01, 0x07, 0x01,
                                  /* certificates are absent */
                                   0x31, 0x00 /* signerInfos */
               };
        try {
            cf = CertificateFactory.getInstance( "X509", "SUN");
            cf.generateCertificates( new ByteArrayInputStream(b));
        } catch(Exception e) {
            System.out.println(" "+e);
            e.printStackTrace();
        }
    }
}

-------------- Output from the test -----------------
   java.lang.NullPointerException
java.lang.NullPointerException
        at sun.security.pkcs.PKCS7.getCertificates(PKCS7.java:541)
        at sun.security.provider.X509Factory.parseX509orPKCS7Cert(X509Factory.java:353)
        at sun.security.provider.X509Factory.engineGenerateCertificates(X509Factory.java:248)
        at java.security.cert.CertificateFactory.generateCertificates(CertificateFactory.java:412)
        at PKCS7Test.main(PKCS7Test.java:29)
------------------------------------------------------

======================================================================