6850783: InvalidityDateExtension returns reference to internal mutable state
Summary: return cloned instead of referenced object
Reviewed-by: weijun
--- a/jdk/src/share/classes/sun/security/x509/CertificateVersion.java Sun Jun 14 14:33:30 2009 -0700
+++ b/jdk/src/share/classes/sun/security/x509/CertificateVersion.java Tue Jun 16 20:46:25 2009 +0800
@@ -28,7 +28,6 @@
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
-import java.util.Date;
import java.util.Enumeration;
import sun.security.util.*;
--- a/jdk/src/share/classes/sun/security/x509/InvalidityDateExtension.java Sun Jun 14 14:33:30 2009 -0700
+++ b/jdk/src/share/classes/sun/security/x509/InvalidityDateExtension.java Tue Jun 16 20:46:25 2009 +0800
@@ -140,7 +140,11 @@
*/
public Object get(String name) throws IOException {
if (name.equalsIgnoreCase(DATE)) {
- return date;
+ if (date == null) {
+ return null;
+ } else {
+ return (new Date(date.getTime())); // clone
+ }
} else {
throw new IOException
("Name not supported by InvalidityDateExtension");