<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Done… <div class=""><br class=""></div><div class="">Received:</div><div class=""><br class=""></div><div class=""><span style="caret-color: rgb(51, 51, 51); color: rgb(51, 51, 51); font-family: "Helvetica Neue", "Segoe UI", Roboto, Helvetica, Arial, sans-serif; font-size: 14px; background-color: rgb(255, 255, 255);" class="">We will review your report and have assigned it an internal review ID : 9057381</span></div><div class=""><font color="#333333" face="Helvetica Neue, Segoe UI, Roboto, Helvetica, Arial, sans-serif" class=""><span style="caret-color: rgb(51, 51, 51); font-size: 14px; background-color: rgb(255, 255, 255);" class=""><br class=""></span></font></div><div class=""><font color="#333333" face="Helvetica Neue, Segoe UI, Roboto, Helvetica, Arial, sans-serif" class=""><span style="caret-color: rgb(51, 51, 51); font-size: 14px; background-color: rgb(255, 255, 255);" class="">I used Java8 as Java version but mentioned that it also happens on 11.</span></font></div><div class=""><font color="#333333" face="Helvetica Neue, Segoe UI, Roboto, Helvetica, Arial, sans-serif" class=""><span style="caret-color: rgb(51, 51, 51); font-size: 14px; background-color: rgb(255, 255, 255);" class=""><br class=""></span></font></div><div class=""><font color="#333333" face="Helvetica Neue, Segoe UI, Roboto, Helvetica, Arial, sans-serif" class=""><span style="caret-color: rgb(51, 51, 51); font-size: 14px; background-color: rgb(255, 255, 255);" class="">Hope it helps,</span></font></div><div class=""><font color="#333333" face="Helvetica Neue, Segoe UI, Roboto, Helvetica, Arial, sans-serif" class=""><span style="caret-color: rgb(51, 51, 51); font-size: 14px; background-color: rgb(255, 255, 255);" class="">Norman</span></font></div><div class=""><font color="#333333" face="Helvetica Neue, Segoe UI, Roboto, Helvetica, Arial, sans-serif" class=""><span style="caret-color: rgb(51, 51, 51); font-size: 14px; background-color: rgb(255, 255, 255);" class=""><br class=""></span></font><div><br class=""><blockquote type="cite" class=""><div class="">On 24. Sep 2018, at 19:19, Xuelei Fan <<a href="mailto:xuelei.fan@oracle.com" class="">xuelei.fan@oracle.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi Norman,<br class=""><br class="">It looks like a bug to me. Would you please file a new bug?<br class=""><br class="">Thanks,<br class="">Xuelei<br class=""><br class="">On 9/22/2018 3:40 PM, Norman Maurer wrote:<br class=""><blockquote type="cite" class="">Hi all,<br class="">I think I found another bug in the the SSL implementation (well really in the TrustManager related part) which leads to a NPE. I was able to reproduce this on Java8 and Java11 (ea28) but I am sure it also exists on 9 and 10.<br class="">While trying to write some test code for netty I did something stupid while creating the SSLEngine by passing a hostname as parameter for the server which then ended up in an NPE during handshake. I would argue we should not fail with a NPE.<br class="">Basically something like:<br class="">SSLEngine serverEngine = serverCtx.createSSLEngine("localhost", -1);<br class="">I think this is caused by sun.security.ssl.X509TrustManagerImpl.checkIdentity(…) missing a null check for the hostname before calling sun.security.util.HostnameChecker.match(…)<br class="">A full reproduce (which I extracted from my netty testcase) can be found here (there is a README.md which explains how to run it):<br class=""><a href="https://github.com/normanmaurer/jdk_ssl_npe_reproducer" class="">https://github.com/normanmaurer/jdk_ssl_npe_reproducer</a><br class="">The stack I see is:<br class="">|Exception in thread "main" java.lang.RuntimeException: Delegated task threw Exception/Error at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1527) at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535) at sun.security.ssl.SSLEngineImpl.writeAppRecord(SSLEngineImpl.java:1214) at sun.security.ssl.SSLEngineImpl.wrap(SSLEngineImpl.java:1186) at javax.net.ssl.SSLEngine.wrap(SSLEngine.java:469) at JDKSslReproducer.handshake(JDKSslReproducer.java:76) at JDKSslReproducer.main(JDKSslReproducer.java:51) Caused by: java.lang.NullPointerException at sun.net.util.IPAddressUtil.textToNumericFormatV4(IPAddressUtil.java:49) at sun.net.util.IPAddressUtil.isIPv4LiteralAddress(IPAddressUtil.java:241) at sun.security.util.HostnameChecker.isIpAddress(HostnameChecker.java:125) at sun.security.util.HostnameChecker.match(HostnameChecker.java:93) at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455) at sun.security.ssl.AbstractTrustManagerWrapper.checkAdditionalTrust(SSLContextImpl.java:1068) at sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLContextImpl.java:1007) at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1601) at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052) at sun.security.ssl.Handshaker$1.run(Handshaker.java:992) at sun.security.ssl.Handshaker$1.run(Handshaker.java:989) at java.security.AccessController.doPrivileged(Native Method) at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1467) at JDKSslReproducer.runDelegatedTasks(JDKSslReproducer.java:131) at JDKSslReproducer.handshake(JDKSslReproducer.java:99) ... 1 more|<br class="">This only happens if a X509Trustmanager is used (not the Extended version) and when setEndpointIdentificationAlgorithm(…) is used on the client-side.<br class="">Please let me know if you agree this is a bug and I am happy to open a bug for it.<br class="">Thanks<br class="">Norman<br class=""></blockquote></div></div></blockquote></div><br class=""></div></body></html>