IJ40871: KERBEROS ARRAYINDEXOUTOFBOUNDSEXCEPTION IN STREAMAES256WRAPTOKEN.DECODE().

APAR status

• Closed as program error.

Error description

• Error Message: N/A
  .
  Stack Trace: Java callstack:
  org.ietf.jgss.GSSException, major code: 11, minor code: 0
  major string: General failure, unspecified at GSSAPI level
  minor string: Error while decoding token:
  java.lang.ArrayIndexOutOfBoundsException: Array index out of
  range: 0
  at
  com.ibm.security.jgss.i18n.I18NException.throwGSSException(I18NE
  xception.java:76)
  at
  com.ibm.security.jgss.mech.krb5.AES256WrapToken.decode(AES256Wra
  pToken.java:416)
  at
  com.ibm.security.jgss.mech.krb5.StreamAES256WrapToken.decode(Str
  eamAES256WrapToken.java:73)
  at
  com.ibm.security.jgss.mech.krb5.Krb5Context.unwrap(Krb5Context.j
  ava:1142)
  at
  com.ibm.security.jgss.GSSContextImpl.unwrap(GSSContextImpl.java:
  705)
  at
  javasoft.sqe.tests.api.org.ietf.jgss.GSSContext.wrapUnwrapIOServ
  er$Action.run(wrapUnwrapIO.java:257)
  at
  java.security.AccessController.doPrivileged(AccessController.jav
  a:708)
  at javax.security.auth.Subject.doAsPrivileged(Subject.java:644)
  at
  javasoft.sqe.tests.api.org.ietf.jgss.GSSContext.wrapUnwrapIOServ
  er.thisRun(wrapUnwrapIO.java:169)
  at
  javasoft.sqe.tests.api.org.ietf.jgss.GSSContext.wrapUnwrapIOServ
  er.run(wrapUnwrapIO.java:116)
  Exception in Action org.ietf.jgss.GSSException, major code: 11,
  minor code: 0
  major string: General failure, unspecified at GSSAPI level
  minor string: Error while decoding token:
  java.lang.ArrayIndexOutOfBoundsException: Array index out of
  range: 0
  .
  

Local fix

• N/A
  

Problem summary

• The issue is with the IBM WrapTokenV2 (AES-256) classes, and is
  caused by timing issues related to an apparent
  delay in data transfer initialization of the input stream passed
  to ?GSSContext.unwrap(inStream, pos, prop)?
  following the Security Context establishment phase.
  

Problem conclusion

• Modified StreamAES128WrapToken.decode(), and
  StreamAES256WrapToken.decode() to add a check for
  InputStream.available()
  prior to attempting to read from the input stream, which allows
  for potential delays in data transfer initialization
  of the input stream.
  The files affected by this APAR are: ibmjgssprovider.jar (Java
  8: build_20220615--153).
  The associated Hursley RTC Problem Report is: PR146707.
  The associated Austin Git issue is: Issue #48 for IBMJGSS.
  The associated Austin APAR issue is: N/A.
  .
  This APAR will be fixed in the following Releases:
  .
  IBM SDK, Java Technology Edition
     8    SR7 FP15  (8.0.7.15)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  maintenance can be found at:
             https://www.ibm.com/support/pages/java-sdk
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels