Skip to content

BC v1.85 fails to load CMS containing invalid UTC time, instead of skipping the malformed property #2411

Description

@bsanchezb

Since the update to BC v1.85 we have faced with inability to process CMS signatures with malformed UTCTime fields, resulting to an exception:

Caused by: java.lang.IllegalStateException: invalid UTCTime format
	at org.bouncycastle.util.Exceptions.illegalStateException(Unknown Source)
	at org.bouncycastle.asn1.DLSequenceParser.toASN1Primitive(Unknown Source)
	at org.bouncycastle.cms.CMSSignedDataParser.getSignerInfos(Unknown Source)
	... 56 more
Caused by: org.bouncycastle.asn1.ASN1Exception: invalid UTCTime format
	at org.bouncycastle.asn1.ASN1InputStream.createPrimitiveDERObject(Unknown Source)
	at org.bouncycastle.asn1.ASN1StreamParser.parseImplicitPrimitive(Unknown Source)
	at org.bouncycastle.asn1.ASN1StreamParser.implParseObject(Unknown Source)
	at org.bouncycastle.asn1.ASN1StreamParser.readVector(Unknown Source)
	at org.bouncycastle.asn1.DLSetParser.getLoadedObject(Unknown Source)
	at org.bouncycastle.asn1.ASN1StreamParser.readVector(Unknown Source)
	at org.bouncycastle.asn1.DLSequenceParser.getLoadedObject(Unknown Source)
	at org.bouncycastle.asn1.ASN1StreamParser.readVector(Unknown Source)
	at org.bouncycastle.asn1.ASN1StreamParser.loadTaggedDL(Unknown Source)
	at org.bouncycastle.asn1.DLTaggedObjectParser.getLoadedObject(Unknown Source)
	at org.bouncycastle.asn1.ASN1StreamParser.readVector(Unknown Source)
	at org.bouncycastle.asn1.DLSequenceParser.getLoadedObject(Unknown Source)
	... 63 more
Caused by: java.lang.IllegalArgumentException: invalid UTCTime format
	at org.bouncycastle.asn1.ASN1UTCTime.createPrimitive(Unknown Source)
	... 75 more

We think it is a bit too harsh to fail a complete CMS loading because of a single malformed field. We would prefer to have the malformed field to be skipped instead and an error or warning to be logged, instead of a complete failure. With the current behavior we are not able to produce a validation report for the concerned signatures.

A test file is attached to the ticket.

BC185_UTCTime.zip

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions