PKCS12KeyStore.loadSafeContents() reads valSet[0] for friendlyName and localKeyId attributes without checking whether their DER SET contains any values.
DerInputStream.getSet(1) accepts an empty SET; the argument controls initial collection capacity rather than a minimum element count. A malformed PKCS12 bag attribute containing SET encoding 3100 therefore produces a zero-length array and triggers ArrayIndexOutOfBoundsException during KeyStore.load(). The unencrypted content path can encounter the error with a null password. Expected behavior: invalid attribute encodings must produce the normal IOException parsing failure instead of an unchecked indexing exception. --------- - [x] I confirm that I make this contribution in accordance with the [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai). ------------- Commit messages: - 8397199: PKCS12KeyStore throws ArrayIndexOutOfBoundsException for empty attribute value sets Changes: https://git.openjdk.org/jdk/pull/33864/files Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=33864&range=00 Issue: https://bugs.openjdk.org/browse/JDK-8397199 Stats: 65 lines in 2 files changed: 65 ins; 0 del; 0 mod Patch: https://git.openjdk.org/jdk/pull/33864.diff Fetch: git fetch https://git.openjdk.org/jdk.git pull/33864/head:pull/33864 PR: https://git.openjdk.org/jdk/pull/33864
