code review request: 7099399: cannot deal with CRL file larger than 16MB (original) (raw)

Weijun Wang weijun.wang at oracle.com
Tue Oct 11 20:06:51 UTC 2011

On 10/11/2011 12:50 PM, Michael StJohns wrote:

Two things -

1) Why not just extend this to support "unsigned" long rather than just the 32 bit value - not saying it will be needed, but seems like you might as well do this once.

Well, InputStream::read only supports 32-bit int, and array length is also 32-bit int. Trying to read so many bytes will be quite complicated.

2) How about cleaning up this section of code and moving it to an iterative model:

Yes, your codes look more correct. However, this is a regression bug and we need to fix it fast and with zero risk. Therefore, I choose this stupid and lazy code change.

Thanks Max

long length = 0; if (n< 0x80)_ _length = n;_ _else if (n == 0x80) {_ _// indefinite encoding_ _} else {_ _int bytecount = (n&0x7f);_ _int lencount = bytecount; // needed to do a write to bout_ _int tempbyte;_ _is.mark(8);_ _if (bytecount> 8) error; // can't fit this in a long do { tempbyte = is.read(); if (tempbyte == -1) error - encoding EOL; if ((length& 0x7f) != 0& bytecount == 8) error; // can't do an unsigned long length = (length<< 8) | tempbyte;_ _bytecount--;_ _} while (bytecount> 0); is.reset(); for (int i = 0; i< lencount; i++) { bout.write(is.read()); } }

At 09:05 PM 10/10/2011, Weijun Wang wrote: Webrev at http://cr.openjdk.java.net/~weijun/7099399/webrev.00/

Basically, we're now accepting X.509 block of 4-octets length. For simplicity, the highest byte must be<= 127, so that the length can be expressed with a 32-bit int. Thanks Max

-------- Original Message -------- Change Request ID: 7099399 Synopsis: cannot deal with CRL file larger than 16MB Product: java Category: java Subcategory: classessecurity Type: Defect === Description ============================================================ The X.509 impl of CertificateFactory only parses X.509 blocks smaller than 16MB, i.e. when the length can be encoded in 3 octets. Now we have a customer whose CRL file is as big as 30MB.

More information about the security-dev mailing list