-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
use of cleared weak reference in provider OcspCache #1541
Comments
There's a new beta up which should fix this one at https://www.bouncycastle.org/betas |
The url worked a few days ago but now gives 404 |
More excitement than I've had in a while, but I'm pleased to say the site is back. Let me know how you go. |
#1548 is blocking me from upgrading. |
@felixdo have you confirmed the latest beta fixes the issue? |
@dghgit It's on my list to test this, but can't say when. |
Fixed in 1.78. |
| | +--- org.bouncycastle:bcprov-jdk15on:1.70
| | \--- org.bouncycastle:bcutil-jdk15on:1.70
| | \--- org.bouncycastle:bcprov-jdk15on:1.70
| +--- org.bouncycastle:bcprov-jdk15on:1.70
at org.bouncycastle.jce.provider.OcspCache.getOcspResponse(Unknown Source)
at org.bouncycastle.jce.provider.ProvOcspRevocationChecker.check(Unknown Source)
at org.bouncycastle.jce.provider.ProvRevocationChecker.check(Unknown Source)
at java.base/java.security.cert.PKIXCertPathChecker.check(PKIXCertPathChecker.java:176)
at org.bouncycastle.jce.provider.RFC3280CertPathUtilities.processCertA(Unknown Source)
at org.bouncycastle.jce.provider.PKIXCertPathValidatorSpi_8.engineValidate(Unknown Source)
at org.bouncycastle.jce.provider.PKIXCertPathBuilderSpi_8.build(Unknown Source) ... 86 common frames omitted
CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email InfoSec@keyfactor.com with any questions.
Hi,
I hit the NPE below with OCSP validation using these BC libs:
+--- org.bouncycastle:bcpkix-jdk15on:1.70
| | +--- org.bouncycastle:bcprov-jdk15on:1.70
| | --- org.bouncycastle:bcutil-jdk15on:1.70
| | --- org.bouncycastle:bcprov-jdk15on:1.70
| +--- org.bouncycastle:bcprov-jdk15on:1.70
The exception does not happen reproducibly, it's rather intermittent:
at java.base/java.lang.Thread.run(Thread.java:833) Caused by: java.lang.NullPointerException: Cannot invoke "java.util.Map.put(Object, Object)" because "" is null
at org.bouncycastle.jce.provider.OcspCache.getOcspResponse(Unknown Source)
at org.bouncycastle.jce.provider.ProvOcspRevocationChecker.check(Unknown Source)
at org.bouncycastle.jce.provider.ProvRevocationChecker.check(Unknown Source)
at java.base/java.security.cert.PKIXCertPathChecker.check(PKIXCertPathChecker.java:176)
at org.bouncycastle.jce.provider.RFC3280CertPathUtilities.processCertA(Unknown Source)
at org.bouncycastle.jce.provider.PKIXCertPathValidatorSpi_8.engineValidate(Unknown Source)
at org.bouncycastle.jce.provider.PKIXCertPathBuilderSpi_8.build(Unknown Source) ... 86 common frames omitted
I will replace the dependency with the debug artefacts to get info about line numbers, but maybe someone on this list has seen this before and can advise.
From:Eckenfels. Bernd B.Eckenfels@seeburger.de
I bet it’s the weak reference here:
https://github.com/bcgit/bc-java/blob/5c35c9a5e79648d7fdf85d7cbaffe8169f249443/prov/src/main/java/org/bouncycastle/jce/provider/OcspCache.java#L199C32-L199C32
responseMap = markerRef.get();
responseMap.put(certID, response);
The text was updated successfully, but these errors were encountered: