Skip to content

8386473: DESKeySpec and DESedeKeySpec may throw InvalidKeyException instead of ArrayIndexOutOfBoundsException for Integer.MIN_VALUE offset#31494

Open
smemery wants to merge 3 commits into
openjdk:masterfrom
smemery:JDK-8386473
Open

Conversation

@smemery

@smemery smemery commented Jun 12, 2026

Copy link
Copy Markdown
Contributor

This fix includes throwing the correct exception when an offset for the key length check would cause an integer overflow therefore throwing the wrong exception.



Progress

  • Change must be properly reviewed (1 review required, with at least 1 Reviewer)
  • Change must not contain extraneous whitespace
  • Commit message must refer to an issue

Issue

  • JDK-8386473: DESKeySpec and DESedeKeySpec may throw InvalidKeyException instead of ArrayIndexOutOfBoundsException for Integer.MIN_VALUE offset (Bug - P2)

Reviewers

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/31494/head:pull/31494
$ git checkout pull/31494

Update a local copy of the PR:
$ git checkout pull/31494
$ git pull https://git.openjdk.org/jdk.git pull/31494/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 31494

View PR using the GUI difftool:
$ git pr show -t 31494

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/31494.diff

Using Webrev

Link to Webrev Comment

smemery added 2 commits June 11, 2026 18:31
…nstead of ArrayIndexOutOfBoundsException for Integer.MIN_VALUE offset
@bridgekeeper

bridgekeeper Bot commented Jun 12, 2026

Copy link
Copy Markdown

👋 Welcome back semery! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

@openjdk

openjdk Bot commented Jun 12, 2026

Copy link
Copy Markdown

@smemery This change is no longer ready for integration - check the PR body for details.

@openjdk

openjdk Bot commented Jun 12, 2026

Copy link
Copy Markdown

@smemery The following label will be automatically applied to this pull request:

  • security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

@openjdk openjdk Bot added the rfr Pull request is ready for review label Jun 12, 2026
@mlbridge

mlbridge Bot commented Jun 12, 2026

Copy link
Copy Markdown

Webrevs

@openjdk openjdk Bot added the ready Pull request is ready to be integrated label Jun 12, 2026
@smemery

smemery commented Jun 12, 2026

Copy link
Copy Markdown
Contributor Author

/integrate

@openjdk openjdk Bot added the sponsor Pull request is ready to be sponsored label Jun 12, 2026
@openjdk

openjdk Bot commented Jun 12, 2026

Copy link
Copy Markdown

@smemery
Your change (at version bb25897) is now ready to be sponsored by a Committer.

boolean weak = DESKeySpec.isWeak(strongKey, Integer.MIN_VALUE);
throw new Exception("expected ArrayIndexOutOfBoundsException");
} catch (ArrayIndexOutOfBoundsException aiobe) {}
try{

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are several try{ missed a whitespace

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in latest delta.

* @summary DESKeySpec.isWeak should throw aiobe exception if the offset is
* negative.
* @bug 8364121 8386473
* @summary Test DES[ede]KeySpec for negative and integer overflow offsets
*/
import java.security.InvalidKeyException;

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

'import InvalidKeyException' seems useless.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, removed.

@openjdk openjdk Bot removed sponsor Pull request is ready to be sponsored ready Pull request is ready to be integrated labels Jun 13, 2026
@smemery

smemery commented Jun 14, 2026

Copy link
Copy Markdown
Contributor Author

/integrate

@openjdk

openjdk Bot commented Jun 14, 2026

Copy link
Copy Markdown

@smemery This pull request has not yet been marked as ready for integration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

rfr Pull request is ready for review security [email protected]

Development

Successfully merging this pull request may close these issues.

3 participants