--- a/jdk/src/share/classes/sun/security/provider/certpath/OCSPChecker.java	Tue Jun 30 11:13:51 2009 +0100
+++ b/jdk/src/share/classes/sun/security/provider/certpath/OCSPChecker.java	Fri Jul 03 11:13:42 2009 +0800
@@ -1,5 +1,5 @@
 /*
- * Copyright 2003-2008 Sun Microsystems, Inc.  All Rights Reserved.
+ * Copyright 2003-2009 Sun Microsystems, Inc.  All Rights Reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -351,18 +351,27 @@
             }
             in = con.getInputStream();
 
+            byte[] response = null;
+            int total = 0;
             int contentLength = con.getContentLength();
-            if (contentLength == -1) {
+            if (contentLength != -1) {
+                response = new byte[contentLength];
+            } else {
+                response = new byte[2048];
                 contentLength = Integer.MAX_VALUE;
             }
 
-            byte[] response = new byte[contentLength];
-            int total = 0;
-            int count = 0;
-            while (count != -1 && total < contentLength) {
-                count = in.read(response, total, response.length - total);
+            while (total < contentLength) {
+                int count = in.read(response, total, response.length - total);
+                if (count < 0)
+                    break;
+
                 total += count;
+                if (total >= response.length && total < contentLength) {
+                    response = Arrays.copyOf(response, total * 2);
+                }
             }
+            response = Arrays.copyOf(response, total);
 
             OCSPResponse ocspResponse = new OCSPResponse(response, pkixParams,
                 responderCert);

--- a/jdk/src/share/classes/sun/security/timestamp/HttpTimestamper.java	Tue Jun 30 11:13:51 2009 +0100
+++ b/jdk/src/share/classes/sun/security/timestamp/HttpTimestamper.java	Fri Jul 03 11:13:42 2009 +0800
@@ -1,5 +1,5 @@
 /*
- * Copyright 2003-2006 Sun Microsystems, Inc.  All Rights Reserved.
+ * Copyright 2003-2009 Sun Microsystems, Inc.  All Rights Reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -32,6 +32,7 @@
 import java.net.HttpURLConnection;
 import java.util.Iterator;
 import java.util.Set;
+import java.util.Arrays;
 
 import sun.security.pkcs.*;
 
@@ -137,23 +138,33 @@
                 }
                 System.out.println();
             }
+            verifyMimeType(connection.getContentType());
+
+            int total = 0;
             int contentLength = connection.getContentLength();
-            if (contentLength == -1) {
+            if (contentLength != -1) {
+                replyBuffer = new byte[contentLength];
+            } else {
+                replyBuffer = new byte[2048];
                 contentLength = Integer.MAX_VALUE;
             }
-            verifyMimeType(connection.getContentType());
 
-            replyBuffer = new byte[contentLength];
-            int total = 0;
-            int count = 0;
-            while (count != -1 && total < contentLength) {
-                count = input.read(replyBuffer, total,
+            while (total < contentLength) {
+                int count = input.read(replyBuffer, total,
                                         replyBuffer.length - total);
+                if (count < 0)
+                    break;
+
                 total += count;
+                if (total >= replyBuffer.length && total < contentLength) {
+                    replyBuffer = Arrays.copyOf(replyBuffer, total * 2);
+                }
             }
+            replyBuffer = Arrays.copyOf(replyBuffer, total);
+
             if (DEBUG) {
                 System.out.println("received timestamp response (length=" +
-                        replyBuffer.length + ")");
+                        total + ")");
             }
         } finally {
             if (input != null) {