Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8268621

SunJCE provider may throw unexpected NPE for un-initialized AES KW/KWP Ciphers

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: P3
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 17
    • Component/s: security-libs
    • Labels:
      None
    • Subcomponent:
    • Introduced In Version:
      17
    • Resolved In Build:
      b27

      Backports

        Description

        When using the AES KW and KWP ciphers from SunJCE provider, it is observed that unexpected NPE occur calling getIV() and getParameters() if init() is not yet called. When the cipher object has not yet been initialized with init(), the internal iv field has value 'null'. The getIV() should check for null value (meaning iv has not been set as no init() call takes place) before cloning the iv. As for getParameters(), it should also check for null iv and return a default parameters as the javadoc suggested.

          Attachments

            Issue Links

              Activity

                People

                Assignee:
                valeriep Valerie Peng
                Reporter:
                valeriep Valerie Peng
                Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                  Dates

                  Created:
                  Updated:
                  Resolved: