From 72fb3db1b15e34449f22f2fac942a237a7c8ca03 Mon Sep 17 00:00:00 2001 From: Mark Powers Date: Sat, 27 Jul 2024 11:01:49 -0700 Subject: [PATCH 1/7] first iteration --- .../sun/security/x509/X509CRLImpl.java | 9 ++- .../x509/X509CRLImpl/UnexpectedCCE.java | 81 +++++++++++++++++++ 2 files changed, 88 insertions(+), 2 deletions(-) create mode 100644 test/jdk/sun/security/x509/X509CRLImpl/UnexpectedCCE.java diff --git a/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java b/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java index 9f72a6c55403c..784c778b3c18b 100644 --- a/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java +++ b/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java @@ -280,13 +280,18 @@ public X500Principal getIssuerX500Principal() { * prevCertIssuer if it does not exist */ private X500Principal getCertIssuer(X509CRLEntryImpl entry, - X500Principal prevCertIssuer) { + X500Principal prevCertIssuer) throws CRLException { CertificateIssuerExtension ciExt = entry.getCertificateIssuerExtension(); if (ciExt != null) { GeneralNames names = ciExt.getNames(); - X500Name issuerDN = (X500Name) names.get(0).getName(); + X500Name issuerDN = null; + try { + issuerDN = (X500Name) names.get(0).getName(); + } catch (ClassCastException e) { + throw new CRLException("Parsing error: bad X500 issuer"); + } return issuerDN.asX500Principal(); } else { return prevCertIssuer; diff --git a/test/jdk/sun/security/x509/X509CRLImpl/UnexpectedCCE.java b/test/jdk/sun/security/x509/X509CRLImpl/UnexpectedCCE.java new file mode 100644 index 0000000000000..dcfdc7b53abf9 --- /dev/null +++ b/test/jdk/sun/security/x509/X509CRLImpl/UnexpectedCCE.java @@ -0,0 +1,81 @@ +/* + * Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +/* + * @test + * @bug 8336665 + * @summary Verify that generateCRLs method does not throw ClassCastException. + * It should throw CRLException instead. + * @library /test/lib + */ +import java.security.NoSuchProviderException; +import java.security.cert.*; +import java.io.ByteArrayInputStream; +import java.util.Base64; + +import jdk.test.lib.Utils; + +public class UnexpectedCCE { + static CertificateFactory cf = null; + + public static void main(String[] av ) throws CertificateException, + NoSuchProviderException { + + // "class sun.security.x509.OIDName cannot be cast + // to class sun.security.x509.X500Name" + byte[] encoded_1 = Base64.getDecoder().decode(""" + MIIBljCCAVMCAQEwCwYHKoZIzjgEAwUAMC0xEzARBgoJkiaJk/IsZAEZEwNjb20xFjA\ + UBgoJkiaJjvIsZAEZEwZ0ZXN0Q0EXDTAzMDcxNTE2MjAwNVoXDTAzMDcyMDE2MjAwNV\ + owgdIwUwIBBBcNMDMwNzE1MTYyMDAzWjA/MD0GA1UdHQEB/wQzMDGILzETMBEGCgmSJ\ + omT8ixkARkMA2NvbTEYMBYGCgmSJomT8ixkARkTCGNlcnRzUlVTMBICAQMXDTAzMDcx\ + NTE2MjAwNFowUwIBAhcNMDMwNzE1MTYyMDA0WjA/MD0GA1UdIQEB/wQzMDEwGAYDVQQ\ + DExEwDyqGMDEUMgAwgDAuRQA1MRYGCgmSJomT8ixkARkTCG15VGVzdENBMBICAQEXDT\ + AzMDcxNTE2MjAwNFqgHzAdMA8GA1UdHAEB/wQFMAOEAf8wCgYDVR0UAwACAQIwCwYHK\ + oZIzjgEAwUAAzAAMC0CFBaZDryEEOr8Cw7sOAAAAKaDgtHcAhUAkUenJpwYZgS6IPjy\ + AjZG+RfHdO4="""); + + // "class sun.security.x509.X400Address cannot be cast + // to class sun.security.x509.X500Name" + byte[] encoded_2 = Base64.getDecoder().decode(""" + MIIBljCCAVMCAQEwCwYHKoZIzjgEAwUAMC0xEzARBgoJkiaJk/IsZAEZEwNjb20xFjA\ + UBgoJkiaJk/IsZAEZEwZ0ZXN0J0EXDTAzMDcxNTE2MjAwNVoXDTAzMDcyMDE2MjAwNV\ + owgdIwUwIBBBcNMDMwNzE1MTYyMDA0WjA/MD0GA1UdHQEB/wQzMDGkLzETMBEGCgmSJ\ + omT8ixkARkTA2NvbTEYMBYGCgmSJomT8ixkARkTCGNlcnRzUlVTMBICAQMXDTAzMDcx\ + NTE2MjAwNFowUwIBAhcNMDMwNzE1MTYyMDA0WjA/MD0GA1UdHQEB/wQzMDGjLzETMBE\ + GCgmSJomT8ixkARkTA2NvGG0wMRYGCgmSJomT8ixkARkTCG15VGVzdENBMBICAQEXDT\ + AzMDcxNTE2MjAwNVqgHzAdMGAGA1UdHAEB/wQFMAOEAf8wCgYDVR0UBAMCAQIwCwYHK\ + oZIzjgEAwUAAzAAMC0CFBaZDryEEOr8Cw7sJa07gqaDgtHcAhUAkUenJpwYZgS6IPjy\ + AjZG+RfHdO4="""); + + cf = CertificateFactory.getInstance("X.509", "SUN"); + + run(encoded_1); + run(encoded_2); + } + + private static void run(byte[] buf) { + Utils.runAndCheckException( + () -> cf.generateCRLs(new ByteArrayInputStream(buf)), + CRLException.class); + } +} From dd198f26153ff163f3a8ffbfcced1fb6678933e5 Mon Sep 17 00:00:00 2001 From: Mark Powers Date: Mon, 12 Aug 2024 08:40:31 -0700 Subject: [PATCH 2/7] copyright and unnecessary initialization --- .../share/classes/sun/security/x509/X509CRLImpl.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java b/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java index 784c778b3c18b..2a8fe93854d6d 100644 --- a/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java +++ b/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 2023, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1997, 2024, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -286,7 +286,7 @@ private X500Principal getCertIssuer(X509CRLEntryImpl entry, entry.getCertificateIssuerExtension(); if (ciExt != null) { GeneralNames names = ciExt.getNames(); - X500Name issuerDN = null; + X500Name issuerDN; try { issuerDN = (X500Name) names.get(0).getName(); } catch (ClassCastException e) { From f9b8d0b744292e80aa7c3e65d4ff20ca86aaf9ea Mon Sep 17 00:00:00 2001 From: Mark Powers Date: Tue, 13 Aug 2024 08:26:38 -0700 Subject: [PATCH 3/7] comment from Sean --- .../share/classes/sun/security/x509/X509CRLImpl.java | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java b/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java index 2a8fe93854d6d..a674f81454699 100644 --- a/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java +++ b/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java @@ -286,10 +286,7 @@ private X500Principal getCertIssuer(X509CRLEntryImpl entry, entry.getCertificateIssuerExtension(); if (ciExt != null) { GeneralNames names = ciExt.getNames(); - X500Name issuerDN; - try { - issuerDN = (X500Name) names.get(0).getName(); - } catch (ClassCastException e) { + if (!(names.get(0).getName() instanceof X500Name issuerDN)) { throw new CRLException("Parsing error: bad X500 issuer"); } return issuerDN.asX500Principal(); From 6907ae46e5e9858642f207f21d1094c4c2545350 Mon Sep 17 00:00:00 2001 From: Mark Powers Date: Wed, 11 Sep 2024 07:47:18 -0700 Subject: [PATCH 4/7] another comment from Sean --- src/java.base/share/classes/sun/security/x509/X509CRLImpl.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java b/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java index a674f81454699..37238bc2cb697 100644 --- a/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java +++ b/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java @@ -287,7 +287,8 @@ private X500Principal getCertIssuer(X509CRLEntryImpl entry, if (ciExt != null) { GeneralNames names = ciExt.getNames(); if (!(names.get(0).getName() instanceof X500Name issuerDN)) { - throw new CRLException("Parsing error: bad X500 issuer"); + throw new CRLException("Parsing error: " + + "issuer is not an X.500 DN"); } return issuerDN.asX500Principal(); } else { From 336f81a72097a4fbbea93d1a7cff2ae233ba1f4f Mon Sep 17 00:00:00 2001 From: Mark Powers Date: Tue, 8 Oct 2024 08:28:02 -0700 Subject: [PATCH 5/7] allow more than one name --- .../share/classes/sun/security/x509/X509CRLImpl.java | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java b/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java index 37238bc2cb697..e5c11dc71556d 100644 --- a/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java +++ b/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java @@ -286,11 +286,14 @@ private X500Principal getCertIssuer(X509CRLEntryImpl entry, entry.getCertificateIssuerExtension(); if (ciExt != null) { GeneralNames names = ciExt.getNames(); - if (!(names.get(0).getName() instanceof X500Name issuerDN)) { - throw new CRLException("Parsing error: " - + "issuer is not an X.500 DN"); + Iterator itr = names.iterator(); + while (itr.hasNext()) { + if (itr.next().getName() instanceof X500Name issuerDN) { + return issuerDN.asX500Principal(); + } } - return issuerDN.asX500Principal(); + throw new CRLException("Parsing error: " + + "issuer is not an X.500 DN"); } else { return prevCertIssuer; } From 91e225acb0c76aa43e967dc9d3563662c8851416 Mon Sep 17 00:00:00 2001 From: Mark Powers Date: Mon, 21 Oct 2024 10:06:56 -0700 Subject: [PATCH 6/7] more precise exception message --- .../share/classes/sun/security/x509/X509CRLImpl.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java b/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java index e5c11dc71556d..c5421114f7d49 100644 --- a/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java +++ b/src/java.base/share/classes/sun/security/x509/X509CRLImpl.java @@ -292,8 +292,8 @@ private X500Principal getCertIssuer(X509CRLEntryImpl entry, return issuerDN.asX500Principal(); } } - throw new CRLException("Parsing error: " - + "issuer is not an X.500 DN"); + throw new CRLException("Parsing error: CertificateIssuer " + + "field does not contain an X.500 DN"); } else { return prevCertIssuer; } From 007fbf0dce21e9b734a7cc719b9af48bf1d9498c Mon Sep 17 00:00:00 2001 From: Mark Powers Date: Tue, 22 Oct 2024 08:40:19 -0700 Subject: [PATCH 7/7] more precise comment --- .../sun/security/x509/X509CRLImpl/UnexpectedCCE.java | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/test/jdk/sun/security/x509/X509CRLImpl/UnexpectedCCE.java b/test/jdk/sun/security/x509/X509CRLImpl/UnexpectedCCE.java index dcfdc7b53abf9..85acf520b431b 100644 --- a/test/jdk/sun/security/x509/X509CRLImpl/UnexpectedCCE.java +++ b/test/jdk/sun/security/x509/X509CRLImpl/UnexpectedCCE.java @@ -41,8 +41,9 @@ public class UnexpectedCCE { public static void main(String[] av ) throws CertificateException, NoSuchProviderException { - // "class sun.security.x509.OIDName cannot be cast - // to class sun.security.x509.X500Name" + // Fuzzed data input stream looks like an x509.OIDName + // in the CertificateIssuerExtension. A CRLException is thrown + // because an X500Name is expected. byte[] encoded_1 = Base64.getDecoder().decode(""" MIIBljCCAVMCAQEwCwYHKoZIzjgEAwUAMC0xEzARBgoJkiaJk/IsZAEZEwNjb20xFjA\ UBgoJkiaJjvIsZAEZEwZ0ZXN0Q0EXDTAzMDcxNTE2MjAwNVoXDTAzMDcyMDE2MjAwNV\ @@ -54,8 +55,9 @@ public static void main(String[] av ) throws CertificateException, oZIzjgEAwUAAzAAMC0CFBaZDryEEOr8Cw7sOAAAAKaDgtHcAhUAkUenJpwYZgS6IPjy\ AjZG+RfHdO4="""); - // "class sun.security.x509.X400Address cannot be cast - // to class sun.security.x509.X500Name" + // Fuzzed data input stream looks like an x509.X400Address + // in the CertificateIssuerExtension. A CRLException is thrown + // because an X500Name is expected. byte[] encoded_2 = Base64.getDecoder().decode(""" MIIBljCCAVMCAQEwCwYHKoZIzjgEAwUAMC0xEzARBgoJkiaJk/IsZAEZEwNjb20xFjA\ UBgoJkiaJk/IsZAEZEwZ0ZXN0J0EXDTAzMDcxNTE2MjAwNVoXDTAzMDcyMDE2MjAwNV\