diff --git a/src/share/classes/sun/security/provider/X509Factory.java b/src/share/classes/sun/security/provider/X509Factory.java
index b3d738fb8568fb18021901e1bf51cb725d502ae5..28b7aa556667f4c6d567a5334b65a300b00db9e8 100644
--- a/src/share/classes/sun/security/provider/X509Factory.java
+++ b/src/share/classes/sun/security/provider/X509Factory.java
@@ -670,6 +670,23 @@ public class X509Factory extends CertificateFactorySpi {
                 bout.write(midByte);
                 bout.write(lowByte);
                 length = (highByte << 16) | (midByte << 8) | lowByte;
+            } else if (n == 0x84) {
+                int highByte = is.read();
+                int nextByte = is.read();
+                int midByte = is.read();
+                int lowByte = is.read();
+                if (lowByte == -1) {
+                    throw new IOException("Incomplete BER/DER length info");
+                }
+                if (highByte > 127) {
+                    throw new IOException("Invalid BER/DER data (a little huge?)");
+                }
+                bout.write(highByte);
+                bout.write(nextByte);
+                bout.write(midByte);
+                bout.write(lowByte);
+                length = (highByte << 24 ) | (nextByte << 16) |
+                        (midByte << 8) | lowByte;
             } else { // ignore longer length forms
                 throw new IOException("Invalid BER/DER data (too huge?)");
             }
diff --git a/test/sun/security/provider/X509Factory/BigCRL.java b/test/sun/security/provider/X509Factory/BigCRL.java
new file mode 100644
index 0000000000000000000000000000000000000000..acee51a14348dbcab50f403bf5a80adb475c0613
--- /dev/null
+++ b/test/sun/security/provider/X509Factory/BigCRL.java
@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2011, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 7099399
+ * @summary cannot deal with CRL file larger than 16MB
+ * @run main/othervm -Xmx1024m BigCRL
+ */
+
+import java.io.FileInputStream;
+import java.math.BigInteger;
+import java.security.KeyStore;
+import java.security.cert.Certificate;
+import java.security.PrivateKey;
+import java.security.cert.X509CRLEntry;
+import java.util.Arrays;
+import java.util.Date;
+import sun.security.x509.*;
+import java.security.cert.CertificateFactory;
+import java.io.ByteArrayInputStream;
+
+public class BigCRL {
+
+    public static void main(String[] args) throws Exception {
+        int n = 500000;
+        String ks = System.getProperty("test.src", ".")
+                + "/../../ssl/etc/keystore";
+        String pass = "passphrase";
+        String alias = "dummy";
+
+        KeyStore keyStore = KeyStore.getInstance("JKS");
+        keyStore.load(new FileInputStream(ks), pass.toCharArray());
+        Certificate signerCert = keyStore.getCertificate(alias);
+        byte[] encoded = signerCert.getEncoded();
+        X509CertImpl signerCertImpl = new X509CertImpl(encoded);
+        X509CertInfo signerCertInfo = (X509CertInfo)signerCertImpl.get(
+                X509CertImpl.NAME + "." + X509CertImpl.INFO);
+        X500Name owner = (X500Name)signerCertInfo.get(X509CertInfo.SUBJECT + "."
+                + CertificateSubjectName.DN_NAME);
+
+        Date date = new Date();
+        PrivateKey privateKey = (PrivateKey)
+                keyStore.getKey(alias, pass.toCharArray());
+        String sigAlgName = signerCertImpl.getSigAlgOID();
+
+        X509CRLEntry[] badCerts = new X509CRLEntry[n];
+        CRLExtensions ext = new CRLExtensions();
+        ext.set("Reason", new CRLReasonCodeExtension(1));
+        for (int i = 0; i < n; i++) {
+            badCerts[i] = new X509CRLEntryImpl(
+                    BigInteger.valueOf(i), date, ext);
+        }
+        X509CRLImpl crl = new X509CRLImpl(owner, date, date, badCerts);
+        crl.sign(privateKey, sigAlgName);
+        byte[] data = crl.getEncodedInternal();
+
+        // Make sure the CRL is big enough
+        if ((data[1]&0xff) != 0x84) {
+            throw new Exception("The file should be big enough?");
+        }
+
+        CertificateFactory cf = CertificateFactory.getInstance("X.509");
+        cf.generateCRL(new ByteArrayInputStream(data));
+    }
+}
+