From e9d09283c53654f19d23441c515ee129dc5e04d8 Mon Sep 17 00:00:00 2001 From: mullan Date: Fri, 15 Jan 2010 09:48:21 -0500 Subject: [PATCH] 6915939: Exception should be thrown if OCSP SingleResponses contain unresolved critical extensions Reviewed-by: xuelei --- .../sun/security/provider/certpath/OCSPResponse.java | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/share/classes/sun/security/provider/certpath/OCSPResponse.java b/src/share/classes/sun/security/provider/certpath/OCSPResponse.java index e7b148fbc..c80888f9c 100644 --- a/src/share/classes/sun/security/provider/certpath/OCSPResponse.java +++ b/src/share/classes/sun/security/provider/certpath/OCSPResponse.java @@ -574,10 +574,18 @@ public final class OCSPResponse { (singleExtDer.length); for (int i = 0; i < singleExtDer.length; i++) { Extension ext = new Extension(singleExtDer[i]); - singleExtensions.put(ext.getId(), ext); if (DEBUG != null) { DEBUG.println("OCSP single extension: " + ext); } + // We don't support any extensions yet. Therefore, if it + // is critical we must throw an exception because we + // don't know how to process it. + if (ext.isCritical()) { + throw new IOException( + "Unsupported OCSP critical extension: " + + ext.getExtensionId()); + } + singleExtensions.put(ext.getId(), ext); } } else { singleExtensions = Collections.emptyMap(); -- GitLab