Skip to content

[BUG] PkixNameConstraintValidator#IntersectPermittedSubtree in FIPS always throws an Exception #665

@GrimySoal

Description

@GrimySoal

Describe the Bug
In order to reproduce the problem, one needs to just create PkixNameConstraintValidator and call IntersectPermittedSubtree(Asn1Sequence) method in bouncy-castle FIPS.
In the code then, the following logic will always trigger KeyNotFoundException (decompiled code):

public void IntersectPermittedSubtree(Asn1Sequence permitted)
    {
      IDictionary<int, ISet<GeneralSubtree>> dictionary = (IDictionary<int, ISet<GeneralSubtree>>) new Dictionary<int, ISet<GeneralSubtree>>();
      foreach (object obj in permitted)
      {
        GeneralSubtree instance = GeneralSubtree.GetInstance(obj);
        int tagNo = instance.Base.TagNo;
        if (dictionary[tagNo] == null)
          dictionary[tagNo] = (ISet<GeneralSubtree>) new HashSet<GeneralSubtree>();
        dictionary[tagNo].Add(instance);
      }
      IEnumerator<KeyValuePair<int, ISet<GeneralSubtree>>> enumerator = dictionary.GetEnumerator();
      ....
   }

In particular, if (dictionary[tagNo] == null) check will always trigger such exception, since Dictionary was just created and therefore it's empty. Instead, TryGetValue should be used, similar to regular bouncy-castle code

Product Deployment

Deployment format: [netstandard2.0]
Version [Assembly: bcpkix-fips-1.0.2]

Desktop

OS: [Windows 11 64-bit]
Browser [N/A]
Version [N/A]

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions