Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8214098

sun.security.ssl.HandshakeHash.T12HandshakeHash constructor check backwards.

XMLWordPrintable

    • b24
    • x86_64
    • linux

        ADDITIONAL SYSTEM INFORMATION :
        openjdk version "11" 2018-09-25
        OpenJDK Runtime Environment (build 11+24-Ubuntu-116.04.1)
        OpenJDK 64-Bit Server VM (build 11+24-Ubuntu-116.04.1, mixed mode, sharing)

        A DESCRIPTION OF THE PROBLEM :
        In the constructor for T12HandshakeHash in HandshakeHash:

                    MessageDigest md =
                            JsseJce.getMessageDigest(cipherSuite.hashAlg.name);
                    if (md instanceof Cloneable) {
                        transcriptHash = new CloneableHash(md);
                        this.baos = null;
                    } else {
                        transcriptHash = new NonCloneableHash(md);
                        this.baos = new ByteArrayOutputStream();
                    }

        This is clearly backwards. It guarantees that CloneableHash.archived() is called when T12HandshakeHash.archived() is called which guarantees an UnsupportedOperationException will be thrown. It looks like the same error has been made in T13Handshake as well.

        STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
        Issue with the code can be seen by inspection.


        CUSTOMER SUBMITTED WORKAROUND :
        No work around seems possible.

              ascarpino Anthony Scarpino
              webbuggrp Webbug Group
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: