[jira] Commented: (HARMONY-2940) [classlib][security]Class.forName("org.bouncycastle.jce.provider.BouncyCastleProvider"); fails while org.bouncycastle.jce.provider.BouncyCastleProvider is added as a security provider

["Stepan Mishura (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/HARMONY-2940?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12465050 ] 

Stepan Mishura commented on HARMONY-2940:
-----------------------------------------

The following test reproduces this race condition with BouncyCastle provider - Harmony throws NullPointerException and RI pass.(Please note it can be reproduced with any signed jar)

import java.io.IOException;
import java.security.Permission;
import java.security.Security;
import java.util.PropertyPermission;
import java.util.jar.JarFile;

public class test {

  public static void main(String[] args) throws Exception {

     // suggested workaround
     Security.getProviders();

     final JarFile f = new JarFile("bcprov.jar");

     System.setSecurityManager(new SecurityManager() {

       int i = 0;
       public void checkPermission(Permission perm) {

         // race conditions
         if (perm instanceof PropertyPermission) {
           i++;
           try {
             if (i == 2) { 
               f.getInputStream(
                 f.getEntry("org/bouncycastle/jce/provider/BouncyCastleProvider.class"));
             }
           } catch (IOException e) {
             e.printStackTrace();
           }
         }
       }
    });

    f.getInputStream(
      f.getEntry("org/bouncycastle/jce/provider/BouncyCastleProvider.class"));
  }
}

============ OUTPUT ==============
Exception in thread "main" java.lang.NullPointerException
        at java.util.jar.JarVerifier.verifyCertificate(JarVerifier.java:316)
        at java.util.jar.JarVerifier.readCertificates(JarVerifier.java:246)
        at java.util.jar.JarFile.getInputStream(JarFile.java:349)
        at test.main(test.java:34)


> [classlib][security]Class.forName("org.bouncycastle.jce.provider.BouncyCastleProvider"); fails while org.bouncycastle.jce.provider.BouncyCastleProvider is added as a security provider
> ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: HARMONY-2940
>                 URL: https://issues.apache.org/jira/browse/HARMONY-2940
>             Project: Harmony
>          Issue Type: Bug
>          Components: Classlib
>            Reporter: Leo Li
>         Assigned To: Stepan Mishura
>            Priority: Critical
>
> Here is a testcase:
> public void test()
> {
>     Class cls = Class.forName("org.bouncycastle.jce.provider.BouncyCastleProvider");
> }
> Harmony fails.
> After digging into it, I found that it is related with bcprov.jar has a certificate signed by the signature provided by itself.  I  tried to remove it signature and move it into the boot directory and it works.
> So I recommend to put an unsigned bcprov.jar into the boot directory.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira