Update SMIMETest.java - #2371
Open
cragkhit wants to merge 4128 commits into
Open
Conversation
- improve attribute validation and prepare for more
…allocation DoS, relates to github bcgit#2338.
…dd StreamsTest, relates to github bcgit#2338.
EthereumIESEngine: close static-key stream-mode cross-message MAC forgery See merge request root/bc-java!237
ArmoredOutputStream / PemWriter: reject CR/LF in header name/value (header injection) See merge request root/bc-java!232
…ew SecureRandom()` per operation
MLS SecureRandom hygiene: source from the Group / registrar, never `new SecureRandom()` per operation See merge request root/bc-java!212
GF(2^8) / GF(2^4) arithmetic consolidation onto constant-time util.GF256 / util.GF16 See merge request root/bc-java!215
EAX / CCM / OCB / KCCM: reject nonce reuse on re-init for encryption See merge request root/bc-java!226
AIMer See merge request root/bc-java!133
…bgroup confinement)
ElGamalEngine: validate ciphertext components on decryption (small-subgroup confinement) See merge request root/bc-java!236
Fix `PKIXCertPathReviewer.getPolicyTree()` always returning `null` See merge request root/bc-java!217
…nstraints per RFC 5280 sec. 4.2.1.10, relates to github bcgit#2331.
RFC 8702 — SHAKE in CMS: KMAC-with-SHAKE support See merge request root/bc-java!185
…dule so examples compile and smoke-test under CI without shipping in the bc jars
… configurable node limit (org.bouncycastle.x509.max_cert_path_build_nodes)
…e *Test classes from the bcprov copy, and relocate OwlUtilTest to its own AllTests so it builds under bctest
…jar junit test-sweeping OSGi gotcha in docs/claude/build-jdk14.md
…aging to avoid the OwlUtilTest bcprov signer-info clash, matching the lms/mayo/est/keybox pattern
…09CRLEntryObject/RFC3280/X509CertificateObject/BaseBlockCipher, new PQC KeyPairGeneratorSpi overlays with NoSuchProviderException catch, SM2Signer/Utils), the Falcon FPREngine JLS2 forward-reference fix, and drop the KEM cipher families so bcprov-jdk13 compiles clean
…ed NPE/AIOOBE
Consolidates the empty/missing-content parser-robustness fixes into one review unit.
Each entry point converts an unchecked runtime exception (NullPointerException,
ArrayIndexOutOfBoundsException, IllegalStateException or ArithmeticException) that
escaped on empty / content-less / truncated / out-of-range input into the checked
exception it already declares; the malformed input is rejected either way, only the
leaked exception type is corrected. Well-formed input is unaffected.
Parse entry points:
tsp.cms.CMSTimeStampedData (+ asn1.cms.MetaData, tsp.cms.TimeStampDataUtil)
cms.CMSEnvelopedData (EnvelopedData with no encryptedContent)
tsp.TimeStampToken (SignerInfo carrying no signed attributes)
tsp.TimeStampRequest, tsp.TimeStampResponse (empty/truncated stream)
cert.cmp.GeneralPKIMessage, est.CSRAttributesResponse, cmc.SimplePKIResponse,
openssl.X509TrustedCertificateBlock, pkcs.PKCS12PfxPdu,
pkcs.PKCS8EncryptedPrivateKeyInfo (empty / no-content input)
cert.crmf.CertificateRequestMessage.hasSigningKeyProofOfPossessionWithPKMAC
crypto.util.OpenSSHPrivateKeyUtil.parsePrivateKeyBlob, math.ec.ECCurve.decodePoint
PKIX revocation reporting (attacker-controlled CRL/OCSP fields):
pkix.jcajce.PKIXCertPathReviewer, pkix.jcajce.X509RevocationChecker
(out-of-range CRLReason index against the fixed reason table)
jce.provider.RFC3280CertPathUtilities (absent CRL distribution-point reasons mask)
jce.provider.ProvOcspRevocationChecker (OCSP response with no nonce extension)
Audit findings F16, F23, F24, F26, F28, F29, F30, F32, F52 plus the
parse-empty-input-null-guards, tsp-empty-stream-parse-guard and
crl-reasoncode-crlreasons-aioobe branches.
…ith destroy() throws DestroyFailedException resolved via the jce/src backport on the build-lw classpath, plus jdk14-parity cades excludes and jce/lcrypto test-contamination excludes
… and register it in the cert test AllTests suite
…tering its encapsulation lengths, with a round-trip test covering the AES-Wrap-192/256 mappings from draft-chen-lamps-cms-frodokem
…ntInfo generate side, binding the ukm field into the KDF otherInfo, with round-trip and tamper tests
…n CMS EnvelopedData, add the twelve composite encapsulation lengths, with a round-trip test over all parameter sets
…ssage through SecurityExceptions.invalidKeyException so the cause is chained (and stays Java 4 safe), across the KEM CipherSpis and the RSA/ElGamal/Falcon/Dilithium/composite paths
…rough SecurityExceptions.illegalBlockSizeException so the cause is chained, matching the sibling KEM CipherSpis
…ng NoSuchAlgorithmException throws through it so the cause is chained (and stays Java 4 safe), across the KEM CipherSpis, X509CRL/Certificate, BCFKS and JcaPKCS10CertificationRequest
…th CMS AuthEnvelopedData AEAD content, with ML-KEM/FrodoKEM/Composite round-trip tests
…ing the full draft-ietf-lamps-cms-composite-kem wrap/KDF/KEM mapping
…complete encoding and nothing extra; add byte[]/InputStream constructors to CMSEncryptedData
…n v3/checkout v4, use build-mode none (Gradle needs JDK 25 so autobuild cannot compile)
Add identity and null checks before comparing byte arrays.
cragkhit
force-pushed
the
matcha-update-smime-array-comparison
branch
from
July 22, 2026 23:04
ced58ce to
e9aaa7a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi. We are researchers from Mahidol University, Thailand, and the State University of Ceará, Brazil, working on a research project for improving open-source projects by using the latest accepted answer from Stack Overflow that matched your code snippet. We found this recommendation for improving your code from https://stackoverflow.com/a/40056844.
Note: Our study is approved by the Institutional Review Board of Mahidol University. You can find the participant information sheet explaining this study https://drive.google.com/file/d/1ml5AqrtWQ9pnifTQyTFTcWQmwp6RuPA7/view?usp=sharing.
Disclosure: This contribution was prepared with assistance from OpenAI Codex. I reviewed and verified the resulting change.
Proposed change
Added identity and null checks before comparing the byte arrays.
Testing
./gradlew :util:compileTestJava :util:testResult: Passed