commit c10465ee58c938b6af0d3504d3d895e342a26da6
author Valerie Peng <valeriep@openjdk.org> Mon Mar 31 16:12:37 2008 -0700
committer Valerie Peng <valeriep@openjdk.org> Mon Mar 31 16:12:37 2008 -0700
tree ff5333ecf4ab80e9fec40dcc4631d512b025eb09
parent 3470103a939d299425cf447679e48deb96815a2b

6682411: JCK test failed w/ ArrayIndexOutOfBoundException (-1) when decrypting with no data

Fixed PKCS5Padding class with additional check and throw BadPaddingException if the check failed

Reviewed-by: wetmore

jdk/src/share/classes/sun/security/pkcs11/P11Cipher.java

diff --git a/jdk/src/share/classes/sun/security/pkcs11/P11Cipher.java b/jdk/src/share/classes/sun/security/pkcs11/P11Cipher.java
index 97e0bb5..918c5ad 100644
--- a/jdk/src/share/classes/sun/security/pkcs11/P11Cipher.java
+++ b/jdk/src/share/classes/sun/security/pkcs11/P11Cipher.java
@@ -72,7 +72,7 @@
 
         // DEC: return the length of trailing padding bytes given the specified
         // padded data
-        int unpad(byte[] paddedData, int ofs, int len)
+        int unpad(byte[] paddedData, int len)
                 throws BadPaddingException;
     }
 
@@ -94,14 +94,17 @@
             return padLen;
         }
 
-        public int unpad(byte[] paddedData, int ofs, int len)
+        public int unpad(byte[] paddedData, int len)
                 throws BadPaddingException {
-            byte padValue = paddedData[ofs + len - 1];
+            if (len < 1 || len > paddedData.length) {
+                throw new BadPaddingException("Invalid pad array length!");
+            }
+            byte padValue = paddedData[len - 1];
             if (padValue < 1 || padValue > blockSize) {
                 throw new BadPaddingException("Invalid pad value!");
             }
             // sanity check padding bytes
-            int padStartIndex = ofs + len - padValue;
+            int padStartIndex = len - padValue;
             for (int i = padStartIndex; i < len; i++) {
                 if (paddedData[i] != padValue) {
                     throw new BadPaddingException("Invalid pad bytes!");
@@ -712,7 +715,7 @@
                     }
                     k += token.p11.C_DecryptFinal(session.id(), 0, padBuffer, k,
                             padBuffer.length - k);
-                    int actualPadLen = paddingObj.unpad(padBuffer, 0, k);
+                    int actualPadLen = paddingObj.unpad(padBuffer, k);
                     k -= actualPadLen;
                     System.arraycopy(padBuffer, 0, out, outOfs, k);
                 } else {
@@ -781,7 +784,7 @@
                     }
                     k += token.p11.C_DecryptFinal(session.id(),
                             0, padBuffer, k, padBuffer.length - k);
-                    int actualPadLen = paddingObj.unpad(padBuffer, 0, k);
+                    int actualPadLen = paddingObj.unpad(padBuffer, k);
                     k -= actualPadLen;
                     outArray = padBuffer;
                     outOfs = 0;