fixing NPE in IceSSL for Java & updating IceSSL test

4 files changed, 33 insertions, 2 deletions

diff --git a/java/CHANGES b/java/CHANGES
index 8ba6d2d3f17..5ef9c60c4fb 100644
--- a/java/CHANGES
+++ b/java/CHANGES
@@ -50,6 +50,9 @@ Changes since version 3.2.X (binary incompatible)
 Changes since version 3.2.0
 ---------------------------     
 
+- Fixed a bug in IceSSL that could cause a NullPointerException when
+  using TrustOnly properties.
+
 - Added support for protected class data members using the new
   metadata tag ["protected"]. The tag can be applied to a Slice class
   or to individual data members.
diff --git a/java/ssl/jdk1.4/IceSSL/TrustManager.java b/java/ssl/jdk1.4/IceSSL/TrustManager.java
index 1374b99dfec..d53cdf74273 100644
--- a/java/ssl/jdk1.4/IceSSL/TrustManager.java
+++ b/java/ssl/jdk1.4/IceSSL/TrustManager.java
@@ -87,7 +87,7 @@ class TrustManager
         //
         // If there is no certificate then we match false.
         //
-        if(info.certs.length != 0)
+        if(info.certs != null && info.certs.length > 0)
         {
             javax.security.auth.x500.X500Principal subjectDN = (javax.security.auth.x500.X500Principal)
                 ((java.security.cert.X509Certificate)info.certs[0]).getSubjectX500Principal();
diff --git a/java/ssl/jdk1.5/IceSSL/TrustManager.java b/java/ssl/jdk1.5/IceSSL/TrustManager.java
index ca4a43c0596..8598c1ac7e6 100644
--- a/java/ssl/jdk1.5/IceSSL/TrustManager.java
+++ b/java/ssl/jdk1.5/IceSSL/TrustManager.java
@@ -87,7 +87,7 @@ class TrustManager
         //
         // If there is no certificate then we match false.
         //
-        if(info.certs.length != 0)
+        if(info.certs != null && info.certs.length > 0)
         {
             javax.security.auth.x500.X500Principal subjectDN = (javax.security.auth.x500.X500Principal)
                 ((java.security.cert.X509Certificate)info.certs[0]).getSubjectX500Principal();
diff --git a/java/test/IceSSL/configuration/AllTests.java b/java/test/IceSSL/configuration/AllTests.java
index 96d3444dcaa..edf27399047 100644
--- a/java/test/IceSSL/configuration/AllTests.java
+++ b/java/test/IceSSL/configuration/AllTests.java
@@ -1224,6 +1224,34 @@ public class AllTests
             fact.destroyServer(server);
             comm.destroy();
         }
+        {
+            //
+            // Test rejection when client does not supply a certificate.
+            //
+            Ice.InitializationData initData = createClientProps(defaultDir, defaultHost, threadPool);
+            initData = createClientProps(defaultDir, defaultHost, threadPool);
+            initData.properties.setProperty("IceSSL.Ciphers", "NONE (.*DH_anon.*)");
+            initData.properties.setProperty("IceSSL.VerifyPeer", "0");
+            Ice.Communicator comm = Ice.Util.initialize(args, initData);
+            Test.ServerFactoryPrx fact = Test.ServerFactoryPrxHelper.checkedCast(comm.stringToProxy(factoryRef));
+            test(fact != null);
+            java.util.Map d = createServerProps(defaultDir, defaultHost, threadPool);
+            d.put("IceSSL.TrustOnly",
+                  "C=US, ST=Florida, O=ZeroC\\, Inc.,OU=Ice, emailAddress=info@zeroc.com, CN=Client");
+            d.put("IceSSL.Ciphers", "NONE (.*DH_anon.*)");
+            d.put("IceSSL.VerifyPeer", "0");
+            Test.ServerPrx server = fact.createServer(d);
+            try
+            {
+                server.ice_ping();
+                test(false);
+            }
+            catch(Ice.LocalException ex)
+            {
+            }
+            fact.destroyServer(server);
+            comm.destroy();
+        }
         System.out.println("ok");
 
         System.out.print("testing IceSSL.TrustOnly.Client... ");