IV28958: SIGNATURE.VERIFY() SHOULD THROW ILLEGALARGUMENTEXCEPTION UNDER E DGE CASE

APAR status

• Closed as program error.

Error description

• Error Message: java.lang.ArrayIndexOutOfBoundsException is
  thrown when Signature.verify(byte<OSB><CSB> signature, int
  offset, int length) is called under edge case
  (offset+length>MAX_INT)
  .
  Stack Trace: java.lang.ArrayIndexOutOfBoundsException: Array
  index out of range: 2147483647
   at
  java.security.SignatureSpi.engineVerify(SignatureSpi.java:161)
   at
  java.security.SignatureSpi.engineVerify(SignatureSpi.java:161)
   at java.security.Signature.verify(Signature.java:305)
  .
  

Local fix

Problem summary

• The bug occurs when param offset+length is greater than MAX
  INTEGER in java.  No expected IllegalArgumentException is thrown
  but instead ArrayIndexOutOfBoundsException is thrown from
  underlying security provider package.
  

Problem conclusion

• This defect will be fixed in:
  6.0.0 SR12
  6.0.1 SR4
  .
  Consider the overflow case for comparison condition.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  JAVA CLASS LIBS

• Fixed component ID

  620700130

Applicable component levels

• R600 PSY

     UP