engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undefect. CWE-407 — 63 sites patched across 27 ecosystems

Browse source 
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

102
test/jdk/java/security/Signature/ByteBuffers.java Normal file
View file

@ -0,0 +1,102 @@
/*
* Copyright (c) 2003, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* @test
* @bug 4844847
* @summary Test the Signature.update(ByteBuffer) method
* @author Andreas Sterbenz
* @key randomness
* @run main ByteBuffers DSA 512
* @run main ByteBuffers SHA256withDSA 2048
*/
import java.util.*;
import java.nio.*;
import java.security.*;
public class ByteBuffers {
public static void main(String[] args) throws Exception {
Provider p = Security.getProvider(
System.getProperty("test.provider.name", "SUN"));
Random random = new Random();
int n = 10 * 1024;
byte[] t = new byte[n];
random.nextBytes(t);
String kpgAlgorithm = "DSA";
int keySize = Integer.parseInt(args[1]);
KeyPairGenerator kpg = KeyPairGenerator.getInstance(kpgAlgorithm, p);
kpg.initialize(keySize);
KeyPair kp = kpg.generateKeyPair();
String signAlgo = args[0];
Signature sig = Signature.getInstance(signAlgo, p);
sig.initSign(kp.getPrivate());
sig.update(t);
byte[] signature = sig.sign();
sig.initVerify(kp.getPublic());
// test 1: ByteBuffer with an accessible backing array
ByteBuffer b1 = ByteBuffer.allocate(n + 256);
b1.position(random.nextInt(256));
b1.limit(b1.position() + n);
ByteBuffer b2 = b1.slice();
b2.put(t);
b2.clear();
verify(sig, signature, b2, random);
// test 2: direct ByteBuffer
ByteBuffer b3 = ByteBuffer.allocateDirect(t.length);
b3.put(t);
b3.clear();
verify(sig, signature, b3, random);
// test 3: ByteBuffer without an accessible backing array
b2.clear();
ByteBuffer b4 = b2.asReadOnlyBuffer();
verify(sig, signature, b4, random);
System.out.println("All tests passed");
}
private static void verify(Signature sig, byte[] signature, ByteBuffer b, Random random) throws Exception {
int lim = b.limit();
b.limit(random.nextInt(lim));
sig.update(b);
if (b.hasRemaining()) {
throw new Exception("Buffer not consumed");
}
b.limit(lim);
sig.update(b);
if (b.hasRemaining()) {
throw new Exception("Buffer not consumed");
}
if (sig.verify(signature) == false) {
throw new Exception("Signature did not verify");
}
}
}

96
test/jdk/java/security/Signature/NONEwithRSA.java Normal file
View file

@ -0,0 +1,96 @@
/*
* Copyright (c) 2003, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* @test
* @bug 4955844
* @library /test/lib
* @summary ensure that the NONEwithRSA adapter works correctly
* @author Andreas Sterbenz
* @key randomness
*/
import java.util.*;
import java.security.*;
import javax.crypto.*;
import jdk.test.lib.security.SecurityUtils;
public class NONEwithRSA {
public static void main(String[] args) throws Exception {
// showProvider(Security.getProvider(System.getProperty("test.provider.name", "SUN")));
Random random = new Random();
byte[] b = new byte[16];
random.nextBytes(b);
String kpgAlgorithm = "RSA";
KeyPairGenerator kpg = KeyPairGenerator.getInstance(kpgAlgorithm);
kpg.initialize(SecurityUtils.getTestKeySize(kpgAlgorithm));
KeyPair kp = kpg.generateKeyPair();
Signature sig = Signature.getInstance("NONEwithRSA");
sig.initSign(kp.getPrivate());
System.out.println("Provider: " + sig.getProvider());
sig.update(b);
byte[] sb = sig.sign();
sig.initVerify(kp.getPublic());
sig.update(b);
if (sig.verify(sb) == false) {
throw new Exception("verification failed");
}
Cipher c = Cipher.getInstance("RSA/ECB/PKCS1Padding");
c.init(Cipher.DECRYPT_MODE, kp.getPublic());
byte[] dec = c.doFinal(sb);
if (Arrays.equals(dec, b) == false) {
throw new Exception("decryption failed");
}
sig = Signature.getInstance("NONEwithRSA",
System.getProperty("test.provider.name", "SunJCE"));
sig.initSign(kp.getPrivate());
sig = Signature.getInstance("NONEwithRSA", Security.getProvider(
System.getProperty("test.provider.name", "SunJCE")));
sig.initSign(kp.getPrivate());
try {
Signature.getInstance("NONEwithRSA", "SUN");
throw new Exception("call succeeded");
} catch (NoSuchAlgorithmException e) {
e.printStackTrace();
}
System.out.println("OK");
}
private static void showProvider(Provider p) {
System.out.println(p);
for (Iterator t = p.getServices().iterator(); t.hasNext(); ) {
System.out.println(t.next());
}
}
}

99
test/jdk/java/security/Signature/NoProvider.java Normal file
View file

@ -0,0 +1,99 @@
/*
* Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8165751
* @summary Verify that that a subclass of Signature that does not contain a
* provider can be used to verify.
* @run main/othervm -Djava.security.debug=provider NoProvider
*/
import java.security.*;
public class NoProvider {
private static class NoProviderPublicKey implements PublicKey {
public String getAlgorithm() {
return "NoProvider";
}
public String getFormat() {
return "none";
}
public byte[] getEncoded() {
return new byte[1];
}
}
private static class NoProviderSignature extends Signature {
public NoProviderSignature() {
super("NoProvider");
}
protected void engineInitVerify(PublicKey publicKey)
throws InvalidKeyException {
// do nothing
}
protected void engineInitSign(PrivateKey privateKey)
throws InvalidKeyException {
// do nothing
}
protected void engineUpdate(byte b) throws SignatureException {
// do nothing
}
protected void engineUpdate(byte[] b, int off, int len)
throws SignatureException {
// do nothing
}
protected byte[] engineSign() throws SignatureException {
return new byte[1];
}
protected boolean engineVerify(byte[] sigBytes)
throws SignatureException {
return false;
}
@Deprecated
protected void engineSetParameter(String param, Object value)
throws InvalidParameterException {
// do nothing
}
@Deprecated
protected Object engineGetParameter(String param)
throws InvalidParameterException {
return null;
}
}
public static void main(String[] args) throws Exception {
new NoProviderSignature().initVerify(new NoProviderPublicKey());
}
}

265
test/jdk/java/security/Signature/Offsets.java Normal file
View file

@ -0,0 +1,265 @@
/*
* Copyright (c) 2015, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.security.*;
import java.security.spec.*;
import jdk.test.lib.RandomFactory;
/*
* @test
* @bug 8050374 8181048 8146293
* @key randomness
* @summary This test validates signature verification
* Signature.verify(byte[], int, int). The test uses RandomFactory to
* get random set of clear text data to sign. After the signature
* generation, the test tries to verify signature with the above API
* and passing in different signature offset (0, 33, 66, 99).
* @library /test/lib
* @build jdk.test.lib.RandomFactory
* @run main Offsets SUN NONEwithDSA
* @run main Offsets SUN SHA1withDSA
* @run main Offsets SUN SHA224withDSA
* @run main Offsets SUN SHA256withDSA
* @run main Offsets SunRsaSign SHA224withRSA
* @run main Offsets SunRsaSign SHA256withRSA
* @run main Offsets SunRsaSign SHA384withRSA
* @run main Offsets SunRsaSign SHA512withRSA
* @run main Offsets SunRsaSign SHA512/224withRSA
* @run main Offsets SunRsaSign SHA512/256withRSA
*/
public class Offsets {
private final int size;
private final byte[] cleartext;
private final PublicKey pubkey;
private final Signature signature;
private final byte[] signed;
private Offsets(Signature signature, PublicKey pubkey, PrivateKey privkey,
int size, byte[] cleartext) throws InvalidKeyException,
SignatureException {
System.out.println("Testing signature " + signature.getAlgorithm());
this.pubkey = pubkey;
this.signature = signature;
this.size = size;
this.cleartext = cleartext;
String sigAlg = signature.getAlgorithm();
signature.initSign(privkey);
signature.update(cleartext, 0, size);
signed = signature.sign();
}
int getDataSize() {
return size;
}
int getSignatureLength() {
return signed.length;
}
byte[] shiftSignData(int offset) {
byte[] testSignData = new byte[offset + signed.length];
System.arraycopy(signed, 0, testSignData, offset,
signed.length);
return testSignData;
}
boolean verifySignature(byte[] sigData, int sigOffset, int sigLength,
int updateOffset, int updateLength)
throws InvalidKeyException, SignatureException {
signature.initVerify(pubkey);
signature.update(cleartext, updateOffset, updateLength);
return signature.verify(sigData, sigOffset, sigLength);
}
static Offsets init(String provider, String algorithm)
throws NoSuchAlgorithmException, NoSuchProviderException,
InvalidKeyException, SignatureException {
// fill the cleartext data with random bytes
byte[] cleartext = new byte[100];
RandomFactory.getRandom().nextBytes(cleartext);
// NONEwith requires input to be of 20 bytes
int size = algorithm.contains("NONEwith") ? 20 : 100;
// create signature instance
Signature signature = Signature.getInstance(algorithm, provider);
String keyAlgo;
int keySize = 2048;
if (algorithm.contains("RSA")) {
keyAlgo = "RSA";
} else if (algorithm.contains("ECDSA")) {
keyAlgo = "EC";
keySize = 256;
} else if (algorithm.contains("DSA")) {
keyAlgo = "DSA";
if (algorithm.startsWith("SHAwith") ||
algorithm.startsWith("SHA1with")) {
keySize = 1024;
}
} else {
throw new RuntimeException("Test doesn't support this signature "
+ "algorithm: " + algorithm);
}
KeyPairGenerator kpg = null;
// first try matching provider, fallback to most preferred if none available
try {
kpg = KeyPairGenerator.getInstance(keyAlgo, provider);
} catch (NoSuchAlgorithmException nsae) {
kpg = KeyPairGenerator.getInstance(keyAlgo);
}
kpg.initialize(keySize);
KeyPair kp = kpg.generateKeyPair();
PublicKey pubkey = kp.getPublic();
PrivateKey privkey = kp.getPrivate();
return new Offsets(signature, pubkey, privkey, size, cleartext);
}
public static void main(String[] args) throws NoSuchAlgorithmException,
InvalidKeyException, SignatureException {
if (args.length < 2) {
throw new RuntimeException("Wrong parameters");
}
boolean result = true;
try {
Offsets test = init(args[0], args[1]);
// We are trying 3 different offsets, data size has nothing to do
// with signature length
for (int chunk = 3; chunk > 0; chunk--) {
int signOffset = test.getDataSize() / chunk;
System.out.println("Running test with offset " + signOffset);
byte[] signData = test.shiftSignData(signOffset);
boolean success = test.verifySignature(signData, signOffset,
test.getSignatureLength(), 0, test.getDataSize());
if (success) {
System.out.println("Successfully verified with offset "
+ signOffset);
} else {
System.out.println("Verification failed with offset "
+ signOffset);
result = false;
}
}
// save signature to offset 0
byte[] signData = test.shiftSignData(0);
// Negative tests
// Test signature offset 0.
// Wrong test data will be passed to update,
// so signature verification should fail.
for (int chunk = 3; chunk > 0; chunk--) {
int dataOffset = (test.getDataSize() - 1) / chunk;
boolean success;
try {
success = test.verifySignature(signData, 0,
test.getSignatureLength(), dataOffset,
(test.getDataSize() - dataOffset));
} catch (SignatureException e) {
// Since we are trying different data size, it can throw
// SignatureException
success = false;
}
if (!success) {
System.out.println("Signature verification failed "
+ "as expected, with data offset " + dataOffset
+ " and length "
+ (test.getDataSize() - dataOffset));
} else {
System.out.println("Signature verification "
+ "should not succeed, with data offset "
+ dataOffset + " and length "
+ (test.getDataSize() - dataOffset));
result = false;
}
}
// Tests with manipulating offset and length
result &= Offsets.checkFailure(test, signData, -1,
test.getSignatureLength());
result &= Offsets.checkFailure(test, signData, 0,
test.getSignatureLength() - 1);
result &= Offsets.checkFailure(test, signData,
test.getSignatureLength() + 1, test.getSignatureLength());
result &= Offsets.checkFailure(test, signData, 0,
test.getSignatureLength() + 1);
result &= Offsets.checkFailure(test, signData, 0, 0);
result &= Offsets.checkFailure(test, signData, 0, -1);
result &= Offsets.checkFailure(test, signData,
2147483646, test.getSignatureLength());
result &= Offsets.checkFailure(test, null, 0,
test.getSignatureLength());
} catch (NoSuchProviderException nspe) {
System.out.println("No such provider: " + nspe);
}
if (!result) {
throw new RuntimeException("Some test cases failed");
}
}
static boolean checkFailure(Offsets test, byte[] signData, int offset,
int length) {
boolean success;
try {
success = test.verifySignature(signData, offset, length, 0,
test.getDataSize());
} catch (IllegalArgumentException | SignatureException e) {
System.out.println("Expected exception: " + e);
success = false;
} catch (InvalidKeyException e) {
System.out.println("Unexpected exception: " + e);
return false;
}
if (!success) {
System.out.println("Signature verification failed as expected, "
+ "with signature offset " + offset + " and length "
+ length);
return true;
} else {
System.out.println("Signature verification should not succeed, "
+ "with signature offset " + offset + " and length "
+ length);
return false;
}
}
}

143
test/jdk/java/security/Signature/ResetAfterException.java Normal file
View file

@ -0,0 +1,143 @@
/*
* Copyright (c) 2016, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* @test
* @bug 8149802
* @library /test/lib
* @summary Ensure that Signature objects are reset after verification errored out.
*/
import java.util.Arrays;
import java.security.*;
import jdk.test.lib.security.SecurityUtils;
public class ResetAfterException {
public static void main(String[] args) throws Exception {
byte[] data = "data to be signed".getBytes();
byte[] shortBuffer = new byte[2];
Provider[] provs = Security.getProviders();
boolean failed = false;
for (Provider p : provs) {
Signature sig;
try {
sig = Signature.getInstance("SHA256withRSA", p);
} catch (NoSuchAlgorithmException nsae) {
// no support, skip
continue;
}
boolean res = true;
System.out.println("Testing Provider: " + p.getName());
KeyPairGenerator keyGen = null;
String kpgAlgorithm = "RSA";
try {
// It's possible that some provider, e.g. SunMSCAPI,
// doesn't work well with keys from other providers
// so we use the same provider to generate key first
keyGen = KeyPairGenerator.getInstance(kpgAlgorithm, p);
} catch (NoSuchAlgorithmException nsae) {
keyGen = KeyPairGenerator.getInstance(kpgAlgorithm);
}
if (keyGen == null) {
throw new RuntimeException("Error: No support for RSA KeyPairGenerator");
}
keyGen.initialize(SecurityUtils.getTestKeySize(kpgAlgorithm));
KeyPair keyPair = keyGen.generateKeyPair();
sig.initSign(keyPair.getPrivate());
sig.update(data);
byte[] signature = sig.sign();
// First check signing
try {
sig.update(data);
// sign with short output buffer to cause exception
int len = sig.sign(shortBuffer, 0, shortBuffer.length);
System.out.println("FAIL: Should throw SE with short buffer");
res = false;
} catch (SignatureException e) {
// expected exception; ignore
System.out.println("Expected Ex for short output buffer: " + e);
}
// Signature object should reset after a failed generation
sig.update(data);
byte[] signature2 = sig.sign();
if (!Arrays.equals(signature, signature2)) {
System.out.println("FAIL: Generated different signature");
res = false;
} else {
System.out.println("Generated same signature");
}
// Now, check signature verification
sig.initVerify(keyPair.getPublic());
sig.update(data);
try {
// first verify with valid signature bytes
res = sig.verify(signature);
} catch (SignatureException e) {
System.out.println("FAIL: Valid signature rejected");
e.printStackTrace();
res = false;
}
try {
sig.update(data);
// verify with short signaure to cause exception
if (sig.verify(shortBuffer)) {
System.out.println("FAIL: Invalid signature verified");
res = false;
} else {
System.out.println("Invalid signature rejected");
}
} catch (SignatureException e) {
// expected exception; ignore
System.out.println("Expected Ex for short output buffer: " + e);
}
// Signature object should reset after a failed verification
sig.update(data);
try {
// verify with valid signature bytes again
res = sig.verify(signature);
if (!res) {
System.out.println("FAIL: Valid signature is rejected");
} else {
System.out.println("Valid signature is accepted");
}
} catch (GeneralSecurityException e) {
System.out.println("FAIL: Valid signature is rejected");
e.printStackTrace();
res = false;
}
failed |= !res;
}
if (failed) {
throw new RuntimeException("One or more test failed");
} else {
System.out.println("Test Passed");
}
}
}

71
test/jdk/java/security/Signature/SignWithOutputBuffer.java Normal file
View file

@ -0,0 +1,71 @@
/*
* Copyright (c) 1998, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4114896
* @summary Signature should support a sign() method that places the signature
* in an already existing array.
* @run main SignWithOutputBuffer DSS 512
* @run main SignWithOutputBuffer SHA256withDSA 2048
*/
import java.security.*;
public class SignWithOutputBuffer {
public static void main(String[] args) throws Exception {
int numBytes;
String kpgAlgorithm = "DSA";
int keySize = Integer.parseInt(args[1]);
KeyPairGenerator kpGen = KeyPairGenerator.getInstance(kpgAlgorithm);
kpGen.initialize(keySize);
KeyPair kp = kpGen.genKeyPair();
String signAlgo = args[0];
Signature sig = Signature.getInstance(signAlgo);
sig.initSign(kp.getPrivate());
sig.update((byte)0xff);
// Allocate buffer for signature. According to BSAFE, the size of the
// signature may be as many as 48 bytes.
// First, let's allocate a buffer that's too short.
byte[] out = new byte[10];
try {
numBytes = sig.sign(out, 0, out.length);
} catch (SignatureException e) {
System.out.println(e);
}
// Now repeat the same with a buffer that's big enough
sig = Signature.getInstance(signAlgo);
sig.initSign(kp.getPrivate());
sig.update((byte)0xff);
out = new byte[64];
numBytes = sig.sign(out, 0, out.length);
System.out.println("Signature len="+numBytes);
}
}

112
test/jdk/java/security/Signature/SignatureGetAlgorithm.java Normal file
View file

@ -0,0 +1,112 @@
/*
* Copyright (c) 2013, 2016, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* Portions Copyright (c) 2013 IBM Corporation
*/
/*
* @test
* @bug 8014620 8130181
* @summary Signature.getAlgorithm return null in special case
* @run main/othervm SignatureGetAlgorithm
* @author youdwei
*/
import java.security.*;
public class SignatureGetAlgorithm {
public static void main(String[] args) throws Exception {
Provider testProvider = new TestProvider();
Security.addProvider(testProvider);
Signature sig = Signature.getInstance("MySignatureAlg");
String algorithm = sig.getAlgorithm();
System.out.println("Algorithm Name: " + algorithm);
if (algorithm == null) {
throw new Exception("algorithm name should be 'MySignatureAlg'");
}
}
public static class TestProvider extends Provider {
TestProvider() {
super("testSignatureGetAlgorithm", "1.0", "test Signatures");
put("Signature.MySignatureAlg",
"SignatureGetAlgorithm$MySignatureAlg");
}
}
public static class MySignatureAlg extends Signature {
public MySignatureAlg() {
super(null);
}
MySignatureAlg(String s) {
super(s);
}
@Override
protected void engineInitVerify(PublicKey publicKey)
throws InvalidKeyException {
}
@Override
protected void engineInitSign(PrivateKey privateKey)
throws InvalidKeyException {
}
@Override
protected void engineUpdate(byte b) throws SignatureException {
}
@Override
protected void engineUpdate(byte[] b, int off, int len)
throws SignatureException {
}
@Override
protected byte[] engineSign()
throws SignatureException {
return new byte[0];
}
@Override
protected boolean engineVerify(byte[] sigBytes)
throws SignatureException {
return false;
}
@Override
@Deprecated
protected void engineSetParameter(String param, Object value)
throws InvalidParameterException {
}
@Override
@Deprecated
protected Object engineGetParameter(String param)
throws InvalidParameterException {
return null;
}
}
}

245
test/jdk/java/security/Signature/SignatureGetInstance.java Normal file
View file

@ -0,0 +1,245 @@
/*
* Copyright (c) 2019, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8216039
* @summary Ensure the BC provider-reselection workaround in Signature class
* functions correctly
* @modules java.base/sun.security.util
* @run main/othervm SignatureGetInstance default
* @run main/othervm SignatureGetInstance SHA-256
*/
import java.security.*;
import java.security.interfaces.*;
import java.security.spec.*;
import sun.security.util.SignatureUtil;
public class SignatureGetInstance {
private static final String SIGALG = "RSASSA-PSS";
private static PSSParameterSpec pssParamSpec;
public static void main(String[] args) throws Exception {
String mdName = args[0];
pssParamSpec = "default".equals(mdName) ? PSSParameterSpec.DEFAULT :
new PSSParameterSpec(mdName, "MGF1", new MGF1ParameterSpec(mdName), 20, 1);
Provider testProvider = new TestProvider();
// put test provider before SunRsaSign provider
Security.insertProviderAt(testProvider, 1);
//Security.addProvider(testProvider);
KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
KeyPair kp = kpg.generateKeyPair();
MyPrivKey testPriv = new MyPrivKey();
MyPubKey testPub = new MyPubKey();
testDblInit(testPriv, testPub, true, "TestProvider");
testDblInit(kp.getPrivate(), kp.getPublic(), true,
System.getProperty("test.provider.name", "SunRsaSign"));
testDblInit(testPriv, kp.getPublic(), false, null);
testDblInit(kp.getPrivate(), testPub, false, null);
testSetAndInit(null, testPriv, true);
testSetAndInit(null, testPub, true);
testSetAndInit(null, kp.getPrivate(), true);
testSetAndInit(null, kp.getPublic(), true);
String provName = System.getProperty("test.provider.name", "SunRsaSign");
testSetAndInit(provName, testPriv, false);
testSetAndInit(provName, testPub, false);
testSetAndInit(provName, kp.getPrivate(), true);
testSetAndInit(provName, kp.getPublic(), true);
provName = "TestProvider";
testSetAndInit(provName, testPriv, true);
testSetAndInit(provName, testPub, true);
testSetAndInit(provName, kp.getPrivate(), false);
testSetAndInit(provName, kp.getPublic(), false);
System.out.println("Test Passed");
}
private static void checkName(Signature s, String name) {
if (name != null &&
!(name.equals(s.getProvider().getName()))) {
throw new RuntimeException("Fail: provider name mismatch");
}
}
private static void testDblInit(PrivateKey key1, PublicKey key2,
boolean shouldPass, String expectedProvName) throws Exception {
Signature sig = Signature.getInstance(SIGALG);
SignatureUtil.initSignWithParam(sig, key1, pssParamSpec, null);
try {
sig.initVerify(key2);
if (!shouldPass) {
throw new RuntimeException("Fail: should throw InvalidKeyException");
}
checkName(sig, expectedProvName);
} catch (InvalidKeyException ike) {
if (shouldPass) {
System.out.println("Fail: Unexpected InvalidKeyException");
throw ike;
}
}
}
private static void testSetAndInit(String provName, Key key,
boolean shouldPass) throws Exception {
Signature sig;
if (provName == null) {
sig = Signature.getInstance(SIGALG);
} else {
sig = Signature.getInstance(SIGALG, provName);
}
AlgorithmParameterSpec params = pssParamSpec;
boolean doSign = (key instanceof PrivateKey);
try {
if (doSign) {
SignatureUtil.initSignWithParam(sig, (PrivateKey)key, params, null);
} else {
SignatureUtil.initVerifyWithParam(sig, (PublicKey)key, params);
}
if (!shouldPass) {
throw new RuntimeException("Fail: should throw InvalidKeyException");
}
checkName(sig, provName);
// check that the earlier parameter is still there
if (sig.getParameters() == null) {
throw new RuntimeException("Fail: parameters not preserved");
}
} catch (InvalidKeyException ike) {
if (shouldPass) {
System.out.println("Fail: Unexpected InvalidKeyException");
throw ike;
}
}
}
// Test provider which only accepts its own Key objects
// Registered to be more preferred than SunRsaSign provider
// for testing deferred provider selection
public static class TestProvider extends Provider {
TestProvider() {
super("TestProvider", "1.0", "provider for SignatureGetInstance");
put("Signature.RSASSA-PSS",
"SignatureGetInstance$MySigImpl");
}
}
public static class MyPrivKey implements PrivateKey {
public String getAlgorithm() { return "RSASSA-PSS"; }
public String getFormat() { return "MyOwn"; }
public byte[] getEncoded() { return null; }
}
public static class MyPubKey implements PublicKey {
public String getAlgorithm() { return "RSASSA-PSS"; }
public String getFormat() { return "MyOwn"; }
public byte[] getEncoded() { return null; }
}
public static class MySigImpl extends SignatureSpi {
// simulate BC behavior of only using params set before init calls
AlgorithmParameterSpec initParamSpec = null;
AlgorithmParameterSpec paramSpec = null;
public MySigImpl() {
super();
}
@Override
protected void engineInitVerify(PublicKey publicKey)
throws InvalidKeyException {
if (!(publicKey instanceof MyPubKey)) {
throw new InvalidKeyException("Must be MyPubKey");
}
initParamSpec = paramSpec;
}
@Override
protected void engineInitSign(PrivateKey privateKey)
throws InvalidKeyException {
if (!(privateKey instanceof MyPrivKey)) {
throw new InvalidKeyException("Must be MyPrivKey");
}
initParamSpec = paramSpec;
}
@Override
protected void engineUpdate(byte b) throws SignatureException {
}
@Override
protected void engineUpdate(byte[] b, int off, int len)
throws SignatureException {
}
@Override
protected byte[] engineSign()
throws SignatureException {
return new byte[0];
}
@Override
protected boolean engineVerify(byte[] sigBytes)
throws SignatureException {
return false;
}
@Override
@Deprecated
protected void engineSetParameter(String param, Object value)
throws InvalidParameterException {
}
@Override
protected void engineSetParameter(AlgorithmParameterSpec params)
throws InvalidAlgorithmParameterException {
paramSpec = params;
}
@Override
@Deprecated
protected AlgorithmParameters engineGetParameter(String param)
throws InvalidParameterException {
return null;
}
@Override
protected AlgorithmParameters engineGetParameters() {
if (initParamSpec != null) {
try {
AlgorithmParameters ap =
AlgorithmParameters.getInstance("RSASSA-PSS");
ap.init(initParamSpec);
return ap;
} catch (Exception e) {
throw new RuntimeException(e);
}
}
return null;
}
}
}

142
test/jdk/java/security/Signature/SignatureLength.java Normal file
View file

@ -0,0 +1,142 @@
/*
* Copyright (c) 2016, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8161571 8178370
* @summary Reject signatures presented for verification that contain extra
* bytes.
* @modules jdk.crypto.ec
* @run main SignatureLength
*/
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchAlgorithmException;
import java.security.Provider;
import java.security.Security;
import java.security.Signature;
import java.security.SignatureException;
public class SignatureLength {
public static void main(String[] args) throws Exception {
for (Provider p0 : Security.getProviders()) {
for (Provider p1 : Security.getProviders()) {
for (Provider p2 : Security.getProviders()) {
// SunMSCAPI signer can only be initialized with
// a key generated with SunMSCAPI
if (!p0.getName().equals("SunMSCAPI")
&& p1.getName().equals("SunMSCAPI")) continue;
// SunMSCAPI generated key can only be signed
// with SunMSCAPI signer
if (p0.getName().equals("SunMSCAPI")
&& !p1.getName().equals("SunMSCAPI")) continue;
// SunMSCAPI and SunPKCS11 verifiers may return false
// instead of throwing SignatureException
boolean mayNotThrow = p2.getName().equals("SunMSCAPI")
|| p2.getName().startsWith("SunPKCS11");
main0("EC", 256, "SHA256withECDSA", p0, p1, p2, mayNotThrow);
main0("RSA", 2048, "SHA256withRSA", p0, p1, p2, mayNotThrow);
main0("DSA", 2048, "SHA256withDSA", p0, p1, p2, mayNotThrow);
}
}
}
}
private static void main0(String keyAlgorithm, int keysize,
String signatureAlgorithm, Provider generatorProvider,
Provider signerProvider, Provider verifierProvider,
boolean mayNotThrow) throws Exception {
KeyPairGenerator generator;
Signature signer;
Signature verifier;
try {
generator = KeyPairGenerator.getInstance(keyAlgorithm,
generatorProvider);
signer = Signature.getInstance(signatureAlgorithm,
signerProvider);
verifier = Signature.getInstance(signatureAlgorithm,
verifierProvider);
} catch (NoSuchAlgorithmException nsae) {
// ignore this set of providers
return;
}
byte[] plaintext = "aaa".getBytes("UTF-8");
// Generate
generator.initialize(keysize);
System.out.println("Generating " + keyAlgorithm + " keypair using " +
generator.getProvider().getName() + " JCE provider");
KeyPair keypair = generator.generateKeyPair();
// Sign
signer.initSign(keypair.getPrivate());
signer.update(plaintext);
System.out.println("Signing using " + signer.getProvider().getName() +
" JCE provider");
byte[] signature = signer.sign();
// Invalidate
System.out.println("Invalidating signature ...");
byte[] badSignature = new byte[signature.length + 5];
System.arraycopy(signature, 0, badSignature, 0, signature.length);
badSignature[signature.length] = 0x01;
badSignature[signature.length + 1] = 0x01;
badSignature[signature.length + 2] = 0x01;
badSignature[signature.length + 3] = 0x01;
badSignature[signature.length + 4] = 0x01;
// Verify
verifier.initVerify(keypair.getPublic());
verifier.update(plaintext);
System.out.println("Verifying using " +
verifier.getProvider().getName() + " JCE provider");
try {
boolean valid = verifier.verify(badSignature);
System.out.println("Valid? " + valid);
if (mayNotThrow) {
if (valid) {
throw new Exception(
"ERROR: expected a SignatureException but none was thrown"
+ " and invalid signature was verified");
} else {
System.out.println("OK: verification failed as expected");
}
} else {
throw new Exception(
"ERROR: expected a SignatureException but none was thrown");
}
} catch (SignatureException e) {
System.out.println("OK: caught expected exception: " + e);
}
System.out.println();
}
}

99
test/jdk/java/security/Signature/TestCloneable.java Normal file
View file

@ -0,0 +1,99 @@
/*
* Copyright (c) 2020, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8246077
* @summary Make sure that signature objects which are cloneable
* implement the Cloneable interface
* @run testng TestCloneable
*/
import java.security.NoSuchProviderException;
import java.security.NoSuchAlgorithmException;
import java.security.Signature;
import org.testng.annotations.DataProvider;
import org.testng.annotations.Test;
import org.testng.Assert;
public class TestCloneable {
private static final Class<CloneNotSupportedException> CNSE =
CloneNotSupportedException.class;
@DataProvider
public Object[][] testData() {
String dsaProviderName = System.getProperty("test.provider.name", "SUN");
String ecProviderName = System.getProperty("test.provider.name", "SunEC");
String rsaProviderName = System.getProperty("test.provider.name", "SunRsaSign");
return new Object[][] {
{ "SHA1withDSA", dsaProviderName }, { "NONEwithDSA", dsaProviderName },
{ "SHA224withDSA", dsaProviderName }, { "SHA256withDSA", dsaProviderName },
{ "EdDSA", ecProviderName }, { "Ed25519", ecProviderName }, { "Ed448", ecProviderName },
{ "SHA1withECDSA", ecProviderName }, { "SHA224withECDSA", ecProviderName },
{ "SHA256withECDSA", ecProviderName }, { "SHA384withECDSA", ecProviderName },
{ "SHA512withECDSA", ecProviderName }, { "NONEwithECDSA", ecProviderName },
{ "MD2withRSA", rsaProviderName }, { "MD5withRSA", rsaProviderName },
{ "SHA1withRSA", rsaProviderName }, { "SHA224withRSA", rsaProviderName },
{ "SHA256withRSA", rsaProviderName },
{ "SHA384withRSA", rsaProviderName },
{ "SHA512withRSA", rsaProviderName },
{ "SHA512/224withRSA", rsaProviderName },
{ "SHA512/256withRSA", rsaProviderName },
{ "RSASSA-PSS", rsaProviderName },
{ "NONEwithRSA", "SunMSCAPI" },
{ "SHA1withRSA", "SunMSCAPI" }, { "SHA256withRSA", "SunMSCAPI" },
{ "SHA384withRSA", "SunMSCAPI" }, { "SHA512withRSA", "SunMSCAPI" },
{ "RSASSA-PSS", "SunMSCAPI" },
{ "MD5withRSA", "SunMSCAPI" }, { "MD2withRSA", "SunMSCAPI" },
{ "SHA1withECDSA", "SunMSCAPI" },
{ "SHA224withECDSA", "SunMSCAPI" },
{ "SHA256withECDSA", "SunMSCAPI" },
{ "SHA384withECDSA", "SunMSCAPI" },
{ "SHA512withECDSA", "SunMSCAPI" }
};
}
@Test(dataProvider = "testData")
public void test(String algo, String provName)
throws NoSuchAlgorithmException, CloneNotSupportedException {
System.out.print("Testing " + algo + " impl from " + provName);
try {
Signature sig = Signature.getInstance(algo, provName);
if (sig instanceof Cloneable) {
System.out.println(": Cloneable");
Signature sig2 = (Signature) sig.clone();
Assert.assertEquals(sig2.getAlgorithm(), algo);
Assert.assertEquals(sig2.getProvider().getName(), provName);
Assert.assertTrue(sig2 instanceof Cloneable);
} else {
System.out.println(": NOT Cloneable");
Assert.assertThrows(CNSE, ()->sig.clone());
}
System.out.println("Test Passed");
} catch (NoSuchProviderException nspe) {
// skip testing
System.out.println("Skip " + provName + " - not available");
}
}
}

91
test/jdk/java/security/Signature/TestDisabledAlgorithms.java Normal file
View file

@ -0,0 +1,91 @@
/*
* Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* @test
* @bug 8244336
* @summary Test JCE layer algorithm restriction
* @library /test/lib
* @run main/othervm TestDisabledAlgorithms SIGNATURe.sha512withRSA true
* @run main/othervm TestDisabledAlgorithms signaturE.what false
* @run main/othervm TestDisabledAlgorithms SiGnAtUrE.SHa512/224withRSA false
*/
import java.util.List;
import java.security.NoSuchAlgorithmException;
import java.security.Signature;
import java.security.Provider;
import java.security.Security;
import jdk.test.lib.Utils;
public class TestDisabledAlgorithms {
private static final String PROP_NAME = "jdk.crypto.disabledAlgorithms";
private static void test(List<String> algos, Provider p,
boolean shouldThrow) throws Exception {
for (String a : algos) {
System.out.println("Testing " + (p != null ? p.getName() : "") +
": " + a + ", shouldThrow=" + shouldThrow);
if (shouldThrow) {
if (p == null) {
Utils.runAndCheckException(() -> Signature.getInstance(a),
NoSuchAlgorithmException.class);
} else {
Utils.runAndCheckException(() -> Signature.getInstance(a, p),
NoSuchAlgorithmException.class);
Utils.runAndCheckException(() -> Signature.getInstance(a,
p.getName()), NoSuchAlgorithmException.class);
}
} else {
Signature s;
if (p == null) {
s = Signature.getInstance(a);
} else {
s = Signature.getInstance(a, p);
s = Signature.getInstance(a, p.getName());
}
System.out.println("Got Signature w/ algo " + s.getAlgorithm());
}
}
}
public static void main(String[] args) throws Exception {
String propValue = args[0];
System.out.println("Setting Security Prop " + PROP_NAME + " = " +
propValue);
Security.setProperty(PROP_NAME, propValue);
boolean shouldThrow = Boolean.valueOf(args[1]);
List<String> algos = List.of("sha512withRsa", "1.2.840.113549.1.1.13");
// test w/o provider
test(algos, null, shouldThrow);
// test w/ provider
Provider[] providers = Security.getProviders("Signature.SHA512withRSA");
for (Provider p : providers) {
test(algos, p, shouldThrow);
}
}
}

74
test/jdk/java/security/Signature/TestInitSignWithMyOwnRandom.java Normal file
View file

@ -0,0 +1,74 @@
/*
* Copyright (c) 2002, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* @test
* @bug 4716321
* @library /test/lib
* @summary Ensure the random source supplied in
* Signature.initSign(PrivateKey, SecureRandom) is used.
* @run main TestInitSignWithMyOwnRandom DSA 512
* @run main TestInitSignWithMyOwnRandom SHA256withDSA 2048
*/
import java.security.*;
import jdk.test.lib.security.SecurityUtils;
public class TestInitSignWithMyOwnRandom {
public static void main(String[] args) throws Exception {
// any signature implementation will do as long as
// it needs a random source
Provider p = Security.getProvider(
System.getProperty("test.provider.name", "SUN"));
String kpgAlgorithm = "DSA";
int keySize = Integer.parseInt(args[1]);
KeyPairGenerator kpg = KeyPairGenerator.getInstance(kpgAlgorithm, p);
kpg.initialize(keySize);
KeyPair kp = kpg.generateKeyPair();
TestRandomSource rand = new TestRandomSource();
String signAlgo = args[0];
Signature sig = Signature.getInstance(signAlgo, p);
sig.initSign(kp.getPrivate(), rand);
sig.update(new byte[20]);
sig.sign();
if (rand.isUsed()) {
System.out.println("Custom random source is used.");
} else {
throw new Exception("Custom random source is not used");
}
}
}
class TestRandomSource extends SecureRandom {
int count = 0;
@Override
public void nextBytes(byte[] rs) {
count++;
}
public boolean isUsed() {
return (count != 0);
}
}

59
test/jdk/java/security/Signature/VerifyRangeCheckOverflow.java Normal file
View file

@ -0,0 +1,59 @@
/*
* Copyright (c) 2012, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* Portions Copyright (c) 2012 IBM Corporation
*/
/* @test
* @bug 7172149
* @library /test/lib
* @summary AIOOBE from Signature.verify after integer overflow
* @author Jonathan Lu
*/
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.PublicKey;
import java.security.Signature;
import jdk.test.lib.security.SecurityUtils;
public class VerifyRangeCheckOverflow {
public static void main(String[] args) throws Exception {
String kpgAlgorithm = "DSA";
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(kpgAlgorithm);
keyPairGenerator.initialize(SecurityUtils.getTestKeySize(kpgAlgorithm));
KeyPair keys = keyPairGenerator.generateKeyPair();
PublicKey publicKey = keys.getPublic();
byte[] sigBytes = new byte[100];
Signature signature = Signature.getInstance("SHA256withDSA");
signature.initVerify(publicKey);
try {
signature.verify(sigBytes, Integer.MAX_VALUE, 1);
} catch (IllegalArgumentException ex) {
// Expected
}
}
}