DO NOT REPLY [Bug 33393] New: - Base64 Transform throws "Stream is closed" IOExceptions

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=33393>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=33393

           Summary: Base64 Transform throws "Stream is closed" IOExceptions
           Product: Security
           Version: cvs
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: major
          Priority: P2
         Component: Signature
        AssignedTo: security-dev@xml.apache.org
        ReportedBy: sean.mullan@sun.com


There is a problem because
org.apache.xml.security.transforms.implementations.TransformBase64Decode invokes
the XMLSignatureInput.getOctetStreamReal method. If an XMLSignatureInput is
constructed with a byte[] and not a stream, then calling "getOctetStreamReal" on
XMLSignatureInput during the transform in TransformBase64Decode will yield an
empty stream and thus when trying to access the newly constructed
BufferInputStream with null will yield the "stream is closed" error.
The XMLSignatureInput should do more than setting the internal "bytes" to the
input of the XMLSignature(byte[]) constructor.
The line :
//this._inputOctetStreamProxy = new ByteArrayInputStream(inputOctets);
in the byte[] constructor is currently commented out.


Here's the diffs of the fix:

$ cvs diff XMLSignatureInput.java
Index: XMLSignatureInput.java
===================================================================
RCS file:
/home/cvspublic/xml-security/src/org/apache/xml/security/signature/XMLSignatureInput.java,v
retrieving revision 1.33
diff -r1.33 XMLSignatureInput.java
123c123,125
<       //this._inputOctetStreamProxy = new ByteArrayInputStream(inputOctets);
---
>       if (inputOctets != null) {
>           this._inputOctetStreamProxy = new ByteArrayInputStream(inputOctets);
>       }

-- 
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.