[
https://issues.apache.org/jira/browse/PDFBOX-6253?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
robo updated PDFBOX-6253:
-------------------------
Description:
We use digicert
([http://timestamp.digicert.com|http://timestamp.digicert.com/]) as TSA for an
integration test. This exception popped suddenly up during testing:
{code:java}
java.util.ConcurrentModificationException
at java.base/java.util.HashMap$HashIterator.nextNode(HashMap.java:1605)
at java.base/java.util.HashMap$KeyIterator.next(HashMap.java:1628)
at
...CertInformationCollector.traverseChain(CertInformationCollector.java:244)
at
...CertInformationCollector.getAlternativeIssuerCertificate(CertInformationCollector.java:304)
at
...CertInformationCollector.traverseChain(CertInformationCollector.java:227)
{code}
The problem is here:
{code:java}
for (X509Certificate issuer : certificateSet) {code}
During that iteration, traverseChain() is called recursively. The recursive
call may invoke getAlternativeIssuerCertificate(), which modifies the same set.
This, again, may lead to an ConcurrentModificationException.
For the time being, I fixed it with:
{code:java}
for (X509Certificate issuer : new HashSet<>(certificateSet)){code}
This looks semantically correct, although there might be edge cases, where this
approach could miss an issuer discovered during recursion? Perhaps issuer
detection and recursive chain traversal could be somehow separated instead,
avoiding dynamic modification of the set?
was:
We use digicert
([http://timestamp.digicert.com|http://timestamp.digicert.com/]) as TSA for an
integration. This exception popped suddenly up during testing:
{code:java}
java.util.ConcurrentModificationException
at java.base/java.util.HashMap$HashIterator.nextNode(HashMap.java:1605)
at java.base/java.util.HashMap$KeyIterator.next(HashMap.java:1628)
at
...CertInformationCollector.traverseChain(CertInformationCollector.java:244)
at
...CertInformationCollector.getAlternativeIssuerCertificate(CertInformationCollector.java:304)
at
...CertInformationCollector.traverseChain(CertInformationCollector.java:227)
{code}
The problem is here:
{code:java}
for (X509Certificate issuer : certificateSet) {code}
During that iteration, traverseChain() is called recursively. The recursive
call may invoke getAlternativeIssuerCertificate(), which modifies the same set.
This, again, may lead to an ConcurrentModificationException.
For the time being, I fixed it with:
{code:java}
for (X509Certificate issuer : new HashSet<>(certificateSet)){code}
This looks semantically correct, although there might be edge cases, where this
approach could miss an issuer discovered during recursion? Perhaps issuer
detection and recursive chain traversal could be somehow separated instead,
avoiding dynamic modification of the set?
> CertInformationCollector.traverseChain() can throw
> ConcurrentModificationException when loading alternative issuer certificate
> ------------------------------------------------------------------------------------------------------------------------------
>
> Key: PDFBOX-6253
> URL: https://issues.apache.org/jira/browse/PDFBOX-6253
> Project: PDFBox
> Issue Type: Bug
> Reporter: robo
> Priority: Major
>
> We use digicert
> ([http://timestamp.digicert.com|http://timestamp.digicert.com/]) as TSA for
> an integration test. This exception popped suddenly up during testing:
> {code:java}
> java.util.ConcurrentModificationException
> at java.base/java.util.HashMap$HashIterator.nextNode(HashMap.java:1605)
> at java.base/java.util.HashMap$KeyIterator.next(HashMap.java:1628)
> at
> ...CertInformationCollector.traverseChain(CertInformationCollector.java:244)
> at
> ...CertInformationCollector.getAlternativeIssuerCertificate(CertInformationCollector.java:304)
> at
> ...CertInformationCollector.traverseChain(CertInformationCollector.java:227)
> {code}
> The problem is here:
> {code:java}
> for (X509Certificate issuer : certificateSet) {code}
> During that iteration, traverseChain() is called recursively. The recursive
> call may invoke getAlternativeIssuerCertificate(), which modifies the same
> set. This, again, may lead to an ConcurrentModificationException.
> For the time being, I fixed it with:
> {code:java}
> for (X509Certificate issuer : new HashSet<>(certificateSet)){code}
> This looks semantically correct, although there might be edge cases, where
> this approach could miss an issuer discovered during recursion? Perhaps
> issuer detection and recursive chain traversal could be somehow separated
> instead, avoiding dynamic modification of the set?
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
