8381796: Enhance Certificate parsing

Aleksei Voitylov · gnu-andrew · commit ef49b596552e · 2026-07-08T16:25:18.000+01:00
Reviewed-by: evergizova, andrew
Backport-of: 7af4aa0630d17fca1d689fcd0fe5ee18ad6c3bb9
diff --git a/src/java.base/share/classes/sun/security/provider/certpath/URICertStore.java b/src/java.base/share/classes/sun/security/provider/certpath/URICertStore.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006, 2025, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2006, 2026, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,7 @@
 
 package sun.security.provider.certpath;
 
+import java.io.FilterInputStream;
 import java.io.InputStream;
 import java.io.IOException;
 import java.net.HttpURLConnection;
@@ -153,6 +154,16 @@ private static int initializeTimeout() {
         return tmp * 1000;
     }
 
+    /**
+     * Maximum size for a CRL downloaded through a URICertStore
+     * in bytes. This can be controlled by the com.sun.security.crl.maxSize
+     * Security or System property. The System property, if set, overrides
+     * the Security property. The default size is 20MiB.
+     */
+    private static final long MAX_CRL_DOWNLOAD_SIZE =
+            SecurityProperties.getOverridableLongProp(
+                    "com.sun.security.crl.maxSize", 20971520, debug);
+
     /**
      * Enumeration for the allowed schemes we support when following a
      * URI from an authorityInfoAccess extension on a certificate.
@@ -193,6 +204,13 @@ static AllowedScheme nameOf(String name) {
     private static final boolean CA_ISS_ALLOW_ANY;
 
     static {
+        // Add a debug message for the configured CRL download limit
+        if (debug != null) {
+            debug.println("Maximum downloadable CRL size: " +
+                    MAX_CRL_DOWNLOAD_SIZE +
+                    ((MAX_CRL_DOWNLOAD_SIZE < 0) ? " (DISABLED)" : ""));
+        }
+
         boolean allowAny = false;
         try {
             if (Builder.USE_AIA) {
@@ -586,7 +604,19 @@ public synchronized Collection<X509CRL> engineGetCRLs(CRLSelector selector)
                 if (debug != null) {
                     debug.println("Downloading new CRL...");
                 }
-                crl = (X509CRL) factory.generateCRL(in);
+                InputStream crlIn = (MAX_CRL_DOWNLOAD_SIZE > -1) ?
+                        new SizeLimitedInputStream(in, MAX_CRL_DOWNLOAD_SIZE) :
+                        in;
+                try {
+                    crl = (X509CRL) factory.generateCRL(crlIn);
+                } catch (IllegalArgumentException iae) {
+                    // IAE should only be thrown when the CRL exceeds a
+                    // configured maximum length.
+                    if (debug != null) {
+                        debug.println("Discarding CRL: " + iae.getMessage());
+                        crl = null;
+                    }
+                }
             }
             return getMatchingCRLs(crl, selector);
         } catch (IOException | CRLException e) {
@@ -779,4 +809,59 @@ boolean matchRule(URI filterRule, URI caIssuer) {
             return true;
         }
     }
+
+    /**
+     * Stream wrapper used when an InputStream passed into a CertificateFactory
+     * needs to be size limited.  It will throw IllegalArgumentException when
+     * the downloaded resource via the underlying stream exceeds the maximum
+     * limit.
+     */
+    private static class SizeLimitedInputStream extends FilterInputStream {
+
+        private final long maxBytes;
+        private long bytesRead = 0;
+
+        private SizeLimitedInputStream(InputStream in, long maxBytes) {
+            super(in);
+            this.maxBytes = maxBytes;
+        }
+
+        @Override
+        public int read() throws IOException {
+            if (bytesRead >= maxBytes) {
+                // We will use IAE here to differentiate this special case
+                // from other IOEs that the underlying input stream might
+                // legitimately throw.
+                throw new IllegalArgumentException("InputStream exceeded max " +
+                        "size of " + maxBytes);
+            }
+
+            int b = super.read();
+            if (b != -1) {
+                bytesRead++;
+            }
+            return b;
+        }
+
+        @Override
+        public int read(byte[] b, int off, int len) throws IOException {
+
+            if (bytesRead >= maxBytes) {
+                // We will use IAE here to differentiate this special case
+                // from other IOEs that the underlying input stream might
+                // legitimately throw.
+                throw new IllegalArgumentException("InputStream exceeded max " +
+                        "size of " + maxBytes);
+            }
+
+            long remaining = maxBytes - bytesRead;
+            int toRead = (int) Math.min(len, remaining);
+
+            int n = super.read(b, off, toRead);
+            if (n != -1) {
+                bytesRead += n;
+            }
+            return n;
+        }
+    }
 }
diff --git a/src/java.base/share/classes/sun/security/util/SecurityProperties.java b/src/java.base/share/classes/sun/security/util/SecurityProperties.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2026, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2018 SAP SE. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
@@ -79,4 +79,34 @@ public static boolean includedInExceptions(String refName) {
         }
         return false;
     }
+
+    /**
+     * A convenience routine for fetching a numeric value from a Security
+     * or System property and returning it as a long. The value from the
+     * property is obtained according to the logic in
+     * {@link SecurityProperties#privilegedGetOverridable(String)}
+     *
+     * @param prop the property to query
+     * @param defaultValue the default value
+     * @param dbg a Debug object, if null no debug messages will be sent
+     * @return the value of the property as a {@code long}. If a non-numeric
+     * value is supplied, the default value will be returned.
+     */
+    public static long getOverridableLongProp(String prop, long defaultValue,
+            Debug dbg) {
+        long longVal = defaultValue;
+        try {
+            String propVal = SecurityProperties.privilegedGetOverridable(prop);
+            if (propVal != null) {
+                longVal = Long.parseLong(propVal);
+            }
+        } catch (NumberFormatException nfe) {
+            // We will use the default, but add a warning debug message
+            if (dbg != null) {
+                dbg.println("Warning: Non-numeric value found in property " +
+                        prop + ", using default value of " + defaultValue);
+            }
+        }
+        return longVal;
+    }
 }
diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security
@@ -1488,3 +1488,19 @@ jdk.tls.alpnCharset=ISO_8859_1
 #    com.sun.security.allowedAIALocations=http://some.company.com/cacert \
 #          ldap://ldap.company.com/dc=company,dc=com?caCertificate;binary
 com.sun.security.allowedAIALocations=
+
+#
+# Certificate Revocation List (CRL) Download Size Limitation
+#
+# This property sets a size limit for CRLs downloaded via URIs provided
+# in the CRL Distribution Points certificate extension.  This property
+# must be a numeric value that is the size in bytes of the DER-encoded CRL.
+# For protocols that can return multi-value responses, such as LDAP, the
+# size threshold is the sum of all CRLs downloaded from a single search
+# query. CRLs that exceed this length will not be processed during certificate
+# path validation. This size limit does not apply to CRLs that are imported
+# through non-network-based means. A negative value will disable this size
+# limitation. A non-numeric value will be ignored and the default size will
+# be used instead. The default size limit is 20MiB.
+# This property may be overridden by a System property of the same name.
+com.sun.security.crl.maxSize = 20971520
diff --git a/src/java.naming/share/classes/sun/security/provider/certpath/ldap/LDAPCertStoreImpl.java b/src/java.naming/share/classes/sun/security/provider/certpath/ldap/LDAPCertStoreImpl.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015, 2023, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2015, 2026, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -52,6 +52,7 @@
 import sun.security.provider.certpath.X509CertificatePair;
 import sun.security.util.Cache;
 import sun.security.util.Debug;
+import sun.security.util.SecurityProperties;
 
 /**
  * Core implementation of a LDAP Cert Store.
@@ -96,6 +97,16 @@ final class LDAPCertStoreImpl {
     private final static String PROP_DISABLE_APP_RESOURCE_FILES =
         "sun.security.certpath.ldap.disable.app.resource.files";
 
+    /**
+     * Maximum size for a CRL downloaded through an LDAPCertStoreImpl
+     * in bytes. This can be controlled by the com.sun.security.crl.maxSize
+     * Security or System property. The System property, if set, overrides
+     * the Security property. The default size is 20MiB.
+     */
+    private static final long MAX_CRL_DOWNLOAD_SIZE =
+            SecurityProperties.getOverridableLongProp(
+                    "com.sun.security.crl.maxSize", 20971520, debug);
+
     static {
         String s = AccessController.doPrivileged(
             (PrivilegedAction<String>) () -> System.getProperty(PROP_LIFETIME));
@@ -104,6 +115,13 @@ final class LDAPCertStoreImpl {
         } else {
             LIFETIME = DEFAULT_CACHE_LIFETIME;
         }
+
+        // Add a debug message for the configured CRL download limit
+        if (debug != null) {
+            debug.println("Maximum downloadable CRL size: " +
+                    MAX_CRL_DOWNLOAD_SIZE +
+                    ((MAX_CRL_DOWNLOAD_SIZE < 0) ? " (DISABLED)" : ""));
+        }
     }
 
     /**
@@ -671,12 +689,12 @@ private Collection<X509Certificate> getMatchingCrossCerts(
         return certs;
     }
 
-    /*
+    /**
      * Gets CRLs from an attribute id and location in the LDAP directory.
      * Returns a Collection containing only the CRLs that match the
      * specified X509CRLSelector.
      *
-     * @param name the location holding the attribute
+     * @param request the LDAP request used for this CRL fetch operation
      * @param id the attribute identifier
      * @param sel a X509CRLSelector that the CRLs must match
      * @return a Collection of CRLs found
@@ -688,7 +706,26 @@ private Collection<X509CRL> getCRLs(LDAPRequest request, String id,
         /* fetch the encoded crls from storage */
         byte[][] encodedCRL;
         try {
-            encodedCRL = request.getValues(id);
+            byte[][] tmpCrls = request.getValues(id);
+            if (MAX_CRL_DOWNLOAD_SIZE > -1) {
+                int totalSize = 0;
+                for (byte[] tCrl : tmpCrls) {
+                    totalSize += tCrl.length;
+                }
+                if (totalSize <= MAX_CRL_DOWNLOAD_SIZE) {
+                    encodedCRL = tmpCrls;
+                } else {
+                    if (debug != null) {
+                        debug.println("Received " + tmpCrls.length +
+                                " CRL(s). Combined length of " + totalSize +
+                                " exceeds configured maximum.  Discarding.");
+                    }
+                    encodedCRL = new byte[0][];
+                }
+            } else {
+                // Download limits disabled
+                encodedCRL = tmpCrls;
+            }
         } catch (NamingException namingEx) {
             throw new CertStoreException(namingEx);
         }
diff --git a/test/jdk/java/security/testlibrary/CertificateBuilder.java b/test/jdk/java/security/testlibrary/CertificateBuilder.java
