[8u] RFR 8028591: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString()

[Martin Balao]

Hi,

I'd like to request a review for the 8u backport of 8028591 [1]. This
backport is needed for parity with Oracle's JDK.

Webrev.00:

 *
http://cr.openjdk.java.net/~mbalao/webrevs/8028591/8028591.webrev.jdk8u.jdk.00/

Main line patch does not apply cleanly for the following reasons:

 * src/share/classes/sun/security/util/DerInputStream.java
  * 8u has several patches after 8028591 already applied: 8059485,
8168714 and 8175251.
  * Copyright date hook does not apply. Current file copyright date is
2017, newer than 2014 present in the hook.
  * "if (buffer.read() != DerValue.tag_BitString)" part applied manually
(surrounding of the if-true statement with curly brackets)
  * "int length = getDefiniteLength(buffer);" part applied manually
  * "length--;" applied manually
  * "if (validBits < 0) {" part alraedy applied in 8u
  * "if ((length != 0) && (buffer.read(repn) != length))" part already
applied in 8u
  * After these changes, I verified that
"DerInputStream::getUnalignedBitString" looks identical in JDK-8 and JDK-11.

 * src/share/classes/sun/security/util/ObjectIdentifier.java
  * 8u has 8168705 already applied
  * Manually set 'encoding' array length to 'in.getDefiniteLength()'.
JDK-8 and JDK-11 look the same.

Testing:

 * java/security/cert/X509Certificate/X509BadCertificate.java
  * Passed
 * No regressions found in java/security/cert (50 passed)

Thanks,
Martin.-

--
[1] - https://bugs.openjdk.java.net/browse/JDK-8028591