JKSKeyStoreSpi: a store shorter than the SHA-1 checksum it ends with threw ArrayIndexOutOfBoundsException out of KeyStore.load; validateStream now checks the length against the checksum plus the 12-byte header and reports a truncated store as EOFException, with the jdk1.1 and jdk1.4 copies in step, relates to github #2451.

Author: peterdettman

docs/releasenotes.md

@@ -24,6 +24,7 @@ Date: 2026, TBD
 - The name-constraint host canonicalisation removed a single RFC 1034 root-label dot, the only empty label a name may legally carry, but nothing refused the ones that are not legal: a dNSName, rfc822Name host or uniformResourceIdentifier host such as "example.com.." kept a phantom empty label after the strip and so matched no constraint at all, escaping an excluded subtree naming the host it appears to carry. A tested name whose host carries an empty label - a second trailing dot, a doubled dot or a leading dot - is now refused outright wherever a constraint of that type is in force, rather than canonicalised into a name it is not: removing the extra dots would decide on the caller's behalf that "example.com.." names example.com, which is not how a consumer resolving or comparing the name reads it, and refusing fails closed in both directions where canonicalising would newly admit such a name under a permitted subtree. The single trailing dot is canonicalised as before, a bare "." remains the root label rather than an empty one, and the guard is scoped to the host, so the doubled dot a quoted local part may legally carry is unaffected. Constraints are untouched - one may still begin with a dot, which is how this implementation spells "subdomains only" (github PR #2436).
 - SSLContext.createSSLEngine() from the BCJSSE provider in the 1.86 bctls jar failed with NoSuchMethodError on every JDK from 9 up, leaving engine-based users of the provider (Netty, Vert.x and the like) unable to open a connection. The jdk1.5 and jdk1.9 copies of the package-private SSLEngineUtil had declared create(ContextData) with different return types since 2019 - SSLEngine and ProvSSLEngine - and the root ProvSSLContextSpi, compiled against the first, is paired at runtime with the versions/9 copy on any modern JDK. Until 1.86 the java9 compile had hidden this by implicitly recompiling the whole base tree into META-INF/versions/9 (447 classes, ProvSSLContextSpi among them); the -implicit:none added in 1.86 to stop that duplication exposed the mismatch. The jdk1.9 copy now declares the same return type as the root one, a JDK 25 test creates engines against the built jar, and a new multiReleaseCheck Gradle task on every distributed jar reads the constant pool of each class in the jar and in the sibling BC jars it depends on and fails the build when a member reference does not resolve against the copy of its target that a JDK would pair it with, so the class of defect cannot ship again; the same check runs on arbitrary jars, a published release included, as multiReleaseCheckJar (github #2448).
 - The BCFKS key store derived its scrypt keys with the block size r in place of the parallelization parameter p, while writing the p the caller configured out to the store: BcFKSKeyStoreSpi passed getBlockSize() to SCrypt.generate for both arguments and never read the encoded parallelization parameter at all, so every store whose ScryptConfig gave a p other than its r encoded parameters that do not derive its own keys. The store was self-consistent - BC read back what BC wrote - but a conformant RFC 7914 reader computed a different key and so failed the integrity check and the store decryption, and BC could not open such a store written by anyone else. Derivation now follows RFC 7914. A store written by 1.86 or earlier is still read: the integrity check is retried under the old convention, and where a signature check leaves no MAC to settle it the store decryption is retried instead, in both cases reporting the failure of the encoded parameters rather than of the fallback. The write side is governed by org.bouncycastle.bcfks.scrypt_p_eq_r, default true, which writes p equal to r whatever the ScryptConfig asked for: the two conventions then agree, so a store written here is both RFC 7914 correct and readable by 1.86 and earlier. Clearing the property honours the configured p, which those releases cannot read unless p already equals r; the default is intended to become false in a later release, once enough of the installed base is writing parameters that describe themselves. Loading with a BCFKSLoadStoreParameter carrying a ScryptConfig accepts an encoded p equal to either the configured p or the block size, so a store round trips under the configuration that wrote it whichever way the property was set; every other parameter is compared as before. The parallelization parameter is now bounded alongside the cost parameter before the derivation, as the PKCS#8 and PKCS#12 scrypt paths already bound it.
+- A JKS store shorter than the SHA-1 checksum it ends with threw an unchecked ArrayIndexOutOfBoundsException out of KeyStore.load, which declares IOException for a store it cannot read: JKSKeyStoreSpi.validateStream subtracted the digest size from the raw store length without checking it, so the digest update clamped its negative length to zero and the System.arraycopy that lifted the stored checksum out failed on a negative source index. The length is now checked against the checksum plus the 12-byte header before the checksum position is used, and a store too short to carry either is reported as an EOFException. The JKS store is reached through the compatibility probe in AdaptingKeyStoreSpi, so any key store type that probes for it was exposed, and the legacy jdk1.1 and jdk1.4 provider copies carry the same fix (github #2451).
 
 ### 2.1.3 Additional Features and Functionality
 

prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/util/JKSKeyStoreSpi.java

@@ -2,6 +2,7 @@
 
 import java.io.ByteArrayInputStream;
 import java.io.DataInputStream;
+import java.io.EOFException;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
@@ -364,31 +365,40 @@ private void addPassword(Digest digest, char[] password)
     private ErasableByteStream validateStream(InputStream inputStream, char[] password)
         throws IOException
     {
-        Digest checksumCalculator = DigestFactory.getDigest("SHA-1");
         byte[] rawStore = Streams.readAll(inputStream);
 
+        Digest checksumCalculator = DigestFactory.getDigest("SHA-1");
+        int checksumSize = checksumCalculator.getDigestSize();
+        int checksumPos = getChecksumPos(rawStore, checksumSize);
+
         if (password != null)
         {
             addPassword(checksumCalculator, password);
-            checksumCalculator.update(rawStore, 0, rawStore.length - checksumCalculator.getDigestSize());
-
-            byte[] checksum = new byte[checksumCalculator.getDigestSize()];
+            checksumCalculator.update(rawStore, 0, checksumPos);
 
+            byte[] checksum = new byte[checksumSize];
             checksumCalculator.doFinal(checksum, 0);
 
-            byte[] streamChecksum = new byte[checksum.length];
-            System.arraycopy(rawStore, rawStore.length - checksum.length, streamChecksum, 0, checksum.length);
-
-            if (!Arrays.constantTimeAreEqual(checksum, streamChecksum))
+            if (!Arrays.constantTimeAreEqual(checksumSize, checksum, 0, rawStore, checksumPos))
             {
                 Arrays.fill(rawStore, (byte)0);
                 throw new IOException("password incorrect or store tampered with");
             }
+        }
+
+        return new ErasableByteStream(rawStore, 0, checksumPos);
+    }
 
-            return new ErasableByteStream(rawStore, 0, rawStore.length - checksum.length);
+    private static int getChecksumPos(byte[] rawStore, int checksumSize)
+        throws EOFException
+    {
+        // A store is at least the 12-byte header (magic, version, entry count) plus a checksum
+        if (rawStore.length - checksumSize < 12)
+        {
+            throw new EOFException("Invalid keystore format");
         }
 
-        return new ErasableByteStream(rawStore, 0, rawStore.length - checksumCalculator.getDigestSize());
+        return rawStore.length - checksumSize;
     }
 
     /**

prov/src/main/jdk1.1/org/bouncycastle/jcajce/provider/keystore/util/JKSKeyStoreSpi.java

@@ -2,6 +2,7 @@
 
 import java.io.ByteArrayInputStream;
 import java.io.DataInputStream;
+import java.io.EOFException;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
@@ -344,31 +345,40 @@ private void addPassword(Digest digest, char[] password)
     private ErasableByteStream validateStream(InputStream inputStream, char[] password)
         throws IOException
     {
-        Digest checksumCalculator = DigestFactory.getDigest("SHA-1");
         byte[] rawStore = Streams.readAll(inputStream);
 
+        Digest checksumCalculator = DigestFactory.getDigest("SHA-1");
+        int checksumSize = checksumCalculator.getDigestSize();
+        int checksumPos = getChecksumPos(rawStore, checksumSize);
+
         if (password != null)
         {
             addPassword(checksumCalculator, password);
-            checksumCalculator.update(rawStore, 0, rawStore.length - checksumCalculator.getDigestSize());
-
-            byte[] checksum = new byte[checksumCalculator.getDigestSize()];
+            checksumCalculator.update(rawStore, 0, checksumPos);
 
+            byte[] checksum = new byte[checksumSize];
             checksumCalculator.doFinal(checksum, 0);
 
-            byte[] streamChecksum = new byte[checksum.length];
-            System.arraycopy(rawStore, rawStore.length - checksum.length, streamChecksum, 0, checksum.length);
-
-            if (!Arrays.constantTimeAreEqual(checksum, streamChecksum))
+            if (!Arrays.constantTimeAreEqual(checksumSize, checksum, 0, rawStore, checksumPos))
             {
                 Arrays.fill(rawStore, (byte)0);
                 throw new IOException("password incorrect or store tampered with");
             }
+        }
+
+        return new ErasableByteStream(rawStore, 0, checksumPos);
+    }
 
-            return new ErasableByteStream(rawStore, 0, rawStore.length - checksum.length);
+    private static int getChecksumPos(byte[] rawStore, int checksumSize)
+        throws EOFException
+    {
+        // A store is at least the 12-byte header (magic, version, entry count) plus a checksum
+        if (rawStore.length - checksumSize < 12)
+        {
+            throw new EOFException("Invalid keystore format");
         }
 
-        return new ErasableByteStream(rawStore, 0, rawStore.length - checksumCalculator.getDigestSize());
+        return rawStore.length - checksumSize;
     }
 
     /**

prov/src/main/jdk1.4/org/bouncycastle/jcajce/provider/keystore/util/JKSKeyStoreSpi.java

@@ -2,6 +2,7 @@
 
 import java.io.ByteArrayInputStream;
 import java.io.DataInputStream;
+import java.io.EOFException;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
@@ -343,31 +344,40 @@ private void addPassword(Digest digest, char[] password)
     private ErasableByteStream validateStream(InputStream inputStream, char[] password)
         throws IOException
     {
-        Digest checksumCalculator = DigestFactory.getDigest("SHA-1");
         byte[] rawStore = Streams.readAll(inputStream);
 
+        Digest checksumCalculator = DigestFactory.getDigest("SHA-1");
+        int checksumSize = checksumCalculator.getDigestSize();
+        int checksumPos = getChecksumPos(rawStore, checksumSize);
+
         if (password != null)
         {
             addPassword(checksumCalculator, password);
-            checksumCalculator.update(rawStore, 0, rawStore.length - checksumCalculator.getDigestSize());
-
-            byte[] checksum = new byte[checksumCalculator.getDigestSize()];
+            checksumCalculator.update(rawStore, 0, checksumPos);
 
+            byte[] checksum = new byte[checksumSize];
             checksumCalculator.doFinal(checksum, 0);
 
-            byte[] streamChecksum = new byte[checksum.length];
-            System.arraycopy(rawStore, rawStore.length - checksum.length, streamChecksum, 0, checksum.length);
-
-            if (!Arrays.constantTimeAreEqual(checksum, streamChecksum))
+            if (!Arrays.constantTimeAreEqual(checksumSize, checksum, 0, rawStore, checksumPos))
             {
                 Arrays.fill(rawStore, (byte)0);
                 throw new IOException("password incorrect or store tampered with");
             }
+        }
+
+        return new ErasableByteStream(rawStore, 0, checksumPos);
+    }
 
-            return new ErasableByteStream(rawStore, 0, rawStore.length - checksum.length);
+    private static int getChecksumPos(byte[] rawStore, int checksumSize)
+        throws EOFException
+    {
+        // A store is at least the 12-byte header (magic, version, entry count) plus a checksum
+        if (rawStore.length - checksumSize < 12)
+        {
+            throw new EOFException("Invalid keystore format");
         }
 
-        return new ErasableByteStream(rawStore, 0, rawStore.length - checksumCalculator.getDigestSize());
+        return rawStore.length - checksumSize;
     }
 
     /**

prov/src/test/java/org/bouncycastle/jce/provider/test/JKSStoreTest.java

@@ -0,0 +1,117 @@
+package org.bouncycastle.jce.provider.test;
+
+import java.io.ByteArrayInputStream;
+import java.io.EOFException;
+import java.io.IOException;
+import java.security.KeyStore;
+import java.security.Security;
+
+import org.bouncycastle.jcajce.provider.keystore.util.AdaptingKeyStoreSpi;
+import org.bouncycastle.jcajce.provider.keystore.util.JKSKeyStoreSpi;
+import org.bouncycastle.jcajce.util.BCJcaJceHelper;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.bouncycastle.util.Arrays;
+import org.bouncycastle.util.test.SimpleTest;
+
+public class JKSStoreTest
+    extends SimpleTest
+{
+    public String getName()
+    {
+        return "JKSStore";
+    }
+
+    public void performTest()
+        throws Exception
+    {
+        testLoadTruncatedStore();
+        testLoadTruncatedStoreThroughKeyStore();
+    }
+
+    private void testLoadTruncatedStore()
+        throws Exception
+    {
+        // shorter than the checksum alone, and shorter than the header plus the checksum
+        int[] lengths = new int[]{ 0, 4, 19, 31 };
+
+        for (int i = 0; i != lengths.length; i++)
+        {
+            byte[] store = Arrays.copyOfRange(PKCS12StoreTest.JKS_Store, 0, lengths[i]);
+
+            implLoadTruncatedStore(store, null);
+            implLoadTruncatedStore(store, PKCS12StoreTest.JKS_TEST_PWD);
+        }
+    }
+
+    private void implLoadTruncatedStore(byte[] store, char[] password)
+        throws Exception
+    {
+        JKSKeyStoreSpi jksStore = new JKSKeyStoreSpi(new BCJcaJceHelper());
+
+        try
+        {
+            jksStore.engineLoad(new ByteArrayInputStream(store), password);
+
+            fail("truncated store of " + store.length + " bytes accepted");
+        }
+        catch (EOFException e)
+        {
+            // expected
+        }
+    }
+
+    /**
+     * The JKS store is reached through the compatibility probe in AdaptingKeyStoreSpi, so a
+     * truncated store has to leave KeyStore.load() by way of its declared IOException rather
+     * than an ArrayIndexOutOfBoundsException (github #2451).
+     */
+    private void testLoadTruncatedStoreThroughKeyStore()
+        throws Exception
+    {
+        String compatValue = System.getProperty(AdaptingKeyStoreSpi.COMPAT_OVERRIDE);
+
+        System.setProperty(AdaptingKeyStoreSpi.COMPAT_OVERRIDE, "true");
+
+        try
+        {
+            int[] lengths = new int[]{ 0, 4, 19, 31 };
+
+            for (int i = 0; i != lengths.length; i++)
+            {
+                byte[] store = Arrays.copyOfRange(PKCS12StoreTest.JKS_Store, 0, lengths[i]);
+
+                KeyStore ks = KeyStore.getInstance("PKCS12", "BC");
+
+                try
+                {
+                    ks.load(new ByteArrayInputStream(store), PKCS12StoreTest.JKS_TEST_PWD);
+
+                    fail("truncated store of " + store.length + " bytes accepted");
+                }
+                catch (IOException e)
+                {
+                    // expected
+                }
+            }
+        }
+        finally
+        {
+            if (compatValue == null)
+            {
+                System.getProperties().remove(AdaptingKeyStoreSpi.COMPAT_OVERRIDE);
+            }
+            else
+            {
+                System.setProperty(AdaptingKeyStoreSpi.COMPAT_OVERRIDE, compatValue);
+            }
+        }
+    }
+
+    public static void main(
+        String[] args)
+    {
+        Security.addProvider(new BouncyCastleProvider());
+
+        runTest(new JKSStoreTest());
+    }
+}

prov/src/test/java/org/bouncycastle/jce/provider/test/RegressionTest.java

@@ -61,6 +61,7 @@ public class RegressionTest
         new HardwareKeyInvalidKeyExceptionTest(),
         new IESTest(),
         new ImplicitlyCaTest(),
+        new JKSStoreTest(),
         new KeccakTest(),
         new KeyAgreementKeySizeTest(),
         new Argon2KeyFactoryTest(),