Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-6418433

org.ietf.jgss.Oid constructor accepts invalid values (and rejects valid values)

    XMLWordPrintable

Details

    • b85
    • x86
    • linux, windows_xp

    Backports

      Description

        FULL PRODUCT VERSION :
        java version "1.5.0"
        Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0-b64)
        Java HotSpot(TM) Client VM (build 1.5.0-b64, mixed mode)


        ADDITIONAL OS VERSION INFORMATION :
        Linux miguel 2.6.12-12mdksmp #1 SMP Fri Sep 9 17:43:23 CEST 2005 i686 Intel(R) Pentium(R) 4 CPU 2.60GHz unknown GNU/Linux

        A DESCRIPTION OF THE PROBLEM :
        Class org.ietf.jgss.Oid has a constructor with a String parameter. This constructor accepts oids with negative values, when this value is the last component of the oid. It seems to correctly reject negative values in the rest of the components of the oid.
        An ArrayIndexOutOfBoundsException is then thrown when the getDER() method is invoked.

        STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
        Calling the constructor with the string "1.2.3.-4" will construct an invalid object
        org.ietf.jgss.Oid oid = new Oid("1.2.3.-4")

        EXPECTED VERSUS ACTUAL BEHAVIOR :
        EXPECTED -
        It should have thrown GSSException, like
        GSSException: Improperly formatted Object Identifier String - 1.2.3.-4
        at org.ietf.jgss.Oid.<init>(Oid.java:54)
        at TestOid.main(TestOid.java:15)
        ACTUAL -
        The exception is not thrown. If you later call oid.getDER(), you get
        Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: 4
        at sun.security.util.ObjectIdentifier.putComponent(ObjectIdentifier.java:314)
        at sun.security.util.ObjectIdentifier.encode(ObjectIdentifier.java:266)
        at sun.security.util.DerOutputStream.putOID(DerOutputStream.java:262)
        at org.ietf.jgss.Oid.getDER(Oid.java:163)
        at TestOid.main(TestOid.java:17)

        REPRODUCIBILITY :
        This bug can be reproduced always.

        ---------- BEGIN SOURCE ----------
        import org.ietf.jgss.GSSException;
        import org.ietf.jgss.Oid;

        public class TestOid {

        /**
        * @param args
        * @throws GSSException
        */
        public static void main(String[] args){
        String[] oids = {"1.2.-3.4", "1.2.3.-4"};
        for (String s:oids){
        Oid oid;
        try {
        oid = new Oid(s);
        System.out.println("Invalid oid: "+oid);
        } catch (GSSException e) {
        e.printStackTrace();
        System.out.println(s+" was correctly detected as invalid");
        }
        }
        }

        }

        ---------- END SOURCE ----------

        Attachments

          Issue Links

            Activity

              People

                weijun Weijun Wang
                jleesunw Jon Lee (Inactive)
                Votes:
                0 Vote for this issue
                Watchers:
                0 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved:
                  Imported:
                  Indexed: