8293093: NPE in P11KeyStore.getID

Reviewed-by: ascarpino, xuelei

Author: Mark Powers

src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11KeyStore.java

@@ -1444,7 +1444,7 @@ private void updatePkey(String alias,
                 throw new KeyStoreException
                         ("expected but could not find private key " +
                         "with CKA_ID " +
-                        getID(cka_id));
+                        getIDNullSafe(cka_id));
             }
 
             // next find existing end entity cert
@@ -1454,7 +1454,7 @@ private void updatePkey(String alias,
                 throw new KeyStoreException
                         ("expected but could not find certificate " +
                         "with CKA_ID " +
-                        getID(cka_id));
+                        getIDNullSafe(cka_id));
             } else {
                 if (replaceCert) {
                     // replacing existing cert and chain
@@ -1964,8 +1964,8 @@ private boolean destroyCert(byte[] cka_id)
             token.p11.C_DestroyObject(session.id(), h.handle);
             if (debug != null) {
                 debug.println("destroyCert destroyed cert with CKA_ID [" +
-                                                getID(cka_id) +
-                                                "]");
+                        getIDNullSafe(cka_id) +
+                        "]");
             }
             return true;
         } finally {
@@ -1999,7 +1999,7 @@ private boolean destroyChain(byte[] cka_id)
             if (debug != null) {
                 debug.println("destroyChain destroyed end entity cert " +
                         "with CKA_ID [" +
-                        getID(cka_id) +
+                        getIDNullSafe(cka_id) +
                         "]");
             }
 
@@ -2124,7 +2124,7 @@ private boolean destroyPkey(byte[] cka_id)
                 if (debug != null) {
                     debug.println
                         ("destroyPkey did not find private key with CKA_ID [" +
-                        getID(cka_id) +
+                        getIDNullSafe(cka_id) +
                         "]");
                 }
                 return false;
@@ -2169,6 +2169,13 @@ private static String getID(byte[] bytes) {
         }
     }
 
+    /**
+     * Null safe version of getID.
+     */
+    private static String getIDNullSafe(byte[] bytes) {
+        return (bytes != null) ? getID(bytes) : "null";
+    }
+
     /**
      * find an object on the token
      *
@@ -2205,12 +2212,12 @@ private THandle getTokenObject(Session session,
                 } else if (type == ATTR_CLASS_CERT) {
                     debug.println
                         ("getTokenObject did not find cert with CKA_ID [" +
-                        getID(cka_id) +
+                        getIDNullSafe(cka_id) +
                         "]");
                 } else {
                     debug.println("getTokenObject did not find private key " +
                         "with CKA_ID [" +
-                        getID(cka_id) +
+                        getIDNullSafe(cka_id) +
                         "]");
                 }
             }
@@ -2253,13 +2260,13 @@ private THandle getTokenObject(Session session,
                         "found " +
                         h.length +
                         " certificates sharing CKA_ID " +
-                        getID(cka_id));
+                        getIDNullSafe(cka_id));
             } else {
                 throw new KeyStoreException("invalid KeyStore state: " +
                         "found " +
                         h.length +
                         " private keys sharing CKA_ID " +
-                        getID(cka_id));
+                        getIDNullSafe(cka_id));
             }
         }
         return new THandle(NO_HANDLE, null);
@@ -2515,7 +2522,7 @@ private ArrayList<AliasInfo> mapPrivateKeys(ArrayList<byte[]> pkeyIDs,
                 if (debug != null) {
                     debug.println
                         ("did not find match for private key with CKA_ID [" +
-                        getID(pkeyID) +
+                        getIDNullSafe(pkeyID) +
                         "] (ignoring entry)");
                 }
             }