> EdDSAPublicKeyImpl(byte[]) reads the last byte of the encoded point before > invoking checkLength(). An empty subjectPublicKey BIT STRING produces a > zero-length array and causes an access at index -1. > > The error is reachable through KeyFactory.generatePublic() with an > X509EncodedKeySpec and through certificate parsing that decodes an EdDSA > SubjectPublicKeyInfo. A minimal Ed25519 SubjectPublicKeyInfo reproducer is > the DER byte sequence 300a300506032b6570030100. > > A malformed encoded key must be rejected with the normal checked key-parsing > exception rather than an array indexing exception. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai).
Timofei Fedotov has updated the pull request incrementally with one additional commit since the last revision: Update license test ------------- Changes: - all: https://git.openjdk.org/jdk/pull/33641/files - new: https://git.openjdk.org/jdk/pull/33641/files/fc75060a..b2ce89f6 Webrevs: - full: https://webrevs.openjdk.org/?repo=jdk&pr=33641&range=02 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=33641&range=01-02 Stats: 1 line in 1 file changed: 0 ins; 0 del; 1 mod Patch: https://git.openjdk.org/jdk/pull/33641.diff Fetch: git fetch https://git.openjdk.org/jdk.git pull/33641/head:pull/33641 PR: https://git.openjdk.org/jdk/pull/33641
