[8u] RFR: 8028591: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString()

[Andrew Hughes]

Bug: https://bugs.openjdk.java.net/browse/JDK-8028591
Webrev: https://cr.openjdk.java.net/~andrew/openjdk8/8028591/webrev.01/

Simple range check additions that have been in OpenJDK since 9u. On the
Oracle parity list for 8u26{1,2}.

Modifications for the backport are the result of security fixes that
have been applied to 8u since the fix was made earlier in the 9u lifecycle:

* The check on validBits in
src/share/classes/sun/security/util/DerInputStream.java was already
added by JDK-8168714: "Tighten ECDSA validation"

* The len was already assigned to a variable in
src/share/classes/sun/security/util/ObjectIdentifier.java for
JDK-8168705: "Better ObjectIdentifier validation" which checked the
upper bound.

Also, the copyright header change is redundant as JDK-8175251: "Failed
to load RSA private key from pkcs12" already bumped it to 2017.

Ok for 8u262?

Thanks,
-- 
Andrew :)

Senior Free Java Software Engineer
Red Hat, Inc. (http://www.redhat.com)

PGP Key: ed25519/0xCFDA0F9B35964222 (hkp://keys.gnupg.net)
Fingerprint = 5132 579D D154 0ED2 3E04  C5A0 CFDA 0F9B 3596 4222