-
Bug
-
Resolution: Fixed
-
P3
-
1.4.0
-
None
-
beta2
-
generic
-
generic
sun.security.x509.GeneralSubtrees.intersect(GeneralSubtrees other) behaves incorrectly if it finds a name in this that has at least one name of the same type in other, but no name in other that matches, narrows, or widens it.
The old code concluded that there was no intersection between the two GeneralSubtrees for that name type. Therefore, it deleted the problematic entry in this and added an entry in the excluded subtree encompassing all names of that name type (a widestSubTree of that name type). But there might be another entry in this that matches, narrows, or widens an entry in other.
The new code checks for this possibility. If there is another entry in this that matches, narrows, or widens an entry in other, the new code simply deletes the entry in this that started the whole problem.
Also, the old code didn't check whether the excluded tree already had a widestSubTree before adding one. This resulted in duplicate entries in the excluded tree. The new code checks for this.
The old code concluded that there was no intersection between the two GeneralSubtrees for that name type. Therefore, it deleted the problematic entry in this and added an entry in the excluded subtree encompassing all names of that name type (a widestSubTree of that name type). But there might be another entry in this that matches, narrows, or widens an entry in other.
The new code checks for this possibility. If there is another entry in this that matches, narrows, or widens an entry in other, the new code simply deletes the entry in this that started the whole problem.
Also, the old code didn't check whether the excluded tree already had a widestSubTree before adding one. This resulted in duplicate entries in the excluded tree. The new code checks for this.
- relates to
-
JDK-4457725 NameConstraintsExtension.verify sometimes returns false when it shouldn't
-
- Resolved
-