Colleague Tobias Thierer writes:

"""
InputStream.read() and available() are specified to throw IOException if the stream has already been closed. JarVerifier.VerifierStream claims to implement InputStream but throws NullPointerException instead.

The following patch fixes JarVerifier.VerifierStream to throw IOException, rather than NPE, from read() and available() when the stream has already been closed; it also includes a change for the constructor to throw NPE when passed null as the InputStream to delegate to (there's no reason to allow this, and it doesn't seem to be possible to do so via public APIs).
"""