On Mon, 12 Oct 2026 09:30:06 GMT, Timofei Fedotov <[email protected]> wrote:
>> Rfc2253Parser silently accepted an empty RDN (no attributeTypeAndValue pair)
>> instead of
>> throwing InvalidNameException. Rdn.getType()/getValue() then indexed an empty
>> internal list, throwing an uncaught IndexOutOfBoundsException instead of the
>> documented
>> exception.
>>
>> Two independent entry points:
>>
>> Rdn("") - the original fuzzer-found crash.
>> LdapName("cn=x,") / LdapName.add("") - a string with a trailing , or ;,
>> which never goes
>> through Rdn(String) at all (LdapName builds the RDN directly via
>> Rfc2253Parser).
>>
>> Add one check, rdn.size() == 0, throw InvalidNameException, placed in
>>
>> Rfc2253Parser.doParse(Rdn) - the single method both paths funnel through.
>>
>> Also add a regression check that "cn=a,,cn=b" still throws as before.
>>
>>
>>
>>
>> ---------
>> - [x] I confirm that I make this contribution in accordance with the
>> [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai).
>
> Timofei Fedotov has updated the pull request with a new target base due to a
> merge or a rebase. The incremental webrev excludes the unrelated changes
> brought in by the merge/rebase. The pull request contains 12 additional
> commits since the last revision:
>
> - Merge branch 'openjdk:master' into 8391649
> - Replace assert with check in Rdn constructor
> - Add new subtests in regression test
> - Add assert in Rdn constructor
> - Update regression test
> - Change message in body InvalidNameException
> - Add numAttributes method and correct Rfc2253Parser
> - Correct comment and move throw inside if
> - Add regression test
> - Correct date format of license
> - ... and 2 more: https://git.openjdk.org/jdk/compare/87c9d4be...e88828ad
ping!
-------------
PR Comment: https://git.openjdk.org/jdk/pull/32648#issuecomment-6259897337
