changeset 10401:4581ed6af636

8059485: Resolve parsing ambiguity Reviewed-by: mullan, vinnie
author weijun
date Wed, 08 Oct 2014 19:13:57 +0800
parents b1cf98897adc
children efdbab635f57
files src/share/classes/com/sun/jndi/ldap/BerDecoder.java src/share/classes/sun/security/util/DerIndefLenConverter.java src/share/classes/sun/security/util/DerInputStream.java
diffstat 3 files changed, 23 insertions(+), 5 deletions(-) [+]
line wrap: on
line diff
--- a/src/share/classes/com/sun/jndi/ldap/BerDecoder.java	Tue Oct 07 08:50:20 2014 -0700
+++ b/src/share/classes/com/sun/jndi/ldap/BerDecoder.java	Wed Oct 08 19:13:57 2014 +0800
@@ -95,6 +95,9 @@
             for( int i = 0; i < lengthbyte; i++) {
                 retval = (retval << 8) + (buf[offset++] & 0xff);
             }
+            if (retval < 0) {
+              throw new DecodeException("Invalid length bytes");
+            }
             return retval;
         } else {
             return lengthbyte;
--- a/src/share/classes/sun/security/util/DerIndefLenConverter.java	Tue Oct 07 08:50:20 2014 -0700
+++ b/src/share/classes/sun/security/util/DerIndefLenConverter.java	Wed Oct 08 19:13:57 2014 +0800
@@ -156,12 +156,18 @@
         }
         if (isLongForm(lenByte)) {
             lenByte &= LEN_MASK;
-            if (lenByte > 4)
+            if (lenByte > 4) {
                 throw new IOException("Too much data");
-            if ((dataSize - dataPos) < (lenByte + 1))
+            }
+            if ((dataSize - dataPos) < (lenByte + 1)) {
                 throw new IOException("Too little data");
-            for (int i = 0; i < lenByte; i++)
+            }
+            for (int i = 0; i < lenByte; i++) {
                 curLen = (curLen << 8) + (data[dataPos++] & 0xff);
+            }
+            if (curLen < 0) {
+                throw new IOException("Invalid length bytes");
+            }
         } else {
            curLen = (lenByte & LEN_MASK);
         }
@@ -188,10 +194,15 @@
         }
         if (isLongForm(lenByte)) {
             lenByte &= LEN_MASK;
-            for (int i = 0; i < lenByte; i++)
+            for (int i = 0; i < lenByte; i++) {
                 curLen = (curLen << 8) + (data[dataPos++] & 0xff);
-        } else
+            }
+            if (curLen < 0) {
+                throw new IOException("Invalid length bytes");
+            }
+        } else {
             curLen = (lenByte & LEN_MASK);
+        }
         writeLength(curLen);
         writeValue(curLen);
     }
--- a/src/share/classes/sun/security/util/DerInputStream.java	Tue Oct 07 08:50:20 2014 -0700
+++ b/src/share/classes/sun/security/util/DerInputStream.java	Wed Oct 08 19:13:57 2014 +0800
@@ -566,6 +566,10 @@
                 value <<= 8;
                 value += 0x0ff & in.read();
             }
+            if (value < 0) {
+                throw new IOException("DerInputStream.getLength(): "
+                        + "Invalid length bytes");
+            }
         }
         return value;
     }