--- a/src/java.base/share/classes/sun/security/util/DerIndefLenConverter.java	Thu Apr 11 17:58:18 2019 -0700
+++ b/src/java.base/share/classes/sun/security/util/DerIndefLenConverter.java	Tue Apr 23 08:34:51 2019 +0800
@@ -92,43 +92,37 @@
      * add the current position to the <code>eocList</code> vector.
      */
     private void parseTag() throws IOException {
-        if (dataPos == dataSize)
-            return;
-        try {
-            if (isEOC(data[dataPos]) && (data[dataPos + 1] == 0)) {
-                int numOfEncapsulatedLenBytes = 0;
-                Object elem = null;
-                int index;
-                for (index = ndefsList.size()-1; index >= 0; index--) {
-                    // Determine the first element in the vector that does not
-                    // have a matching EOC
-                    elem = ndefsList.get(index);
-                    if (elem instanceof Integer) {
-                        break;
-                    } else {
-                        numOfEncapsulatedLenBytes += ((byte[])elem).length - 3;
-                    }
+        if (isEOC(data[dataPos]) && (data[dataPos + 1] == 0)) {
+            int numOfEncapsulatedLenBytes = 0;
+            Object elem = null;
+            int index;
+            for (index = ndefsList.size()-1; index >= 0; index--) {
+                // Determine the first element in the vector that does not
+                // have a matching EOC
+                elem = ndefsList.get(index);
+                if (elem instanceof Integer) {
+                    break;
+                } else {
+                    numOfEncapsulatedLenBytes += ((byte[])elem).length - 3;
                 }
-                if (index < 0) {
-                    throw new IOException("EOC does not have matching " +
-                                          "indefinite-length tag");
-                }
-                int sectionLen = dataPos - ((Integer)elem).intValue() +
-                                 numOfEncapsulatedLenBytes;
-                byte[] sectionLenBytes = getLengthBytes(sectionLen);
-                ndefsList.set(index, sectionLenBytes);
-                unresolved--;
+            }
+            if (index < 0) {
+                throw new IOException("EOC does not have matching " +
+                                      "indefinite-length tag");
+            }
+            int sectionLen = dataPos - ((Integer)elem).intValue() +
+                             numOfEncapsulatedLenBytes;
+            byte[] sectionLenBytes = getLengthBytes(sectionLen);
+            ndefsList.set(index, sectionLenBytes);
+            unresolved--;
 
-                // Add the number of bytes required to represent this section
-                // to the total number of length bytes,
-                // and subtract the indefinite-length tag (1 byte) and
-                // EOC bytes (2 bytes) for this section
-                numOfTotalLenBytes += (sectionLenBytes.length - 3);
-            }
-            dataPos++;
-        } catch (IndexOutOfBoundsException iobe) {
-            throw new IOException(iobe);
+            // Add the number of bytes required to represent this section
+            // to the total number of length bytes,
+            // and subtract the indefinite-length tag (1 byte) and
+            // EOC bytes (2 bytes) for this section
+            numOfTotalLenBytes += (sectionLenBytes.length - 3);
         }
+        dataPos++;
     }
 
     /**
@@ -336,6 +330,10 @@
 
         // parse and set up the vectors of all the indefinite-lengths
         while (dataPos < dataSize) {
+            if (dataPos + 2 > dataSize) {
+                // There should be at least one tag and one length
+                return null;
+            }
             parseTag();
             len = parseLength();
             if (len < 0) {

--- a/src/java.base/share/classes/sun/security/util/KeyStoreDelegator.java	Thu Apr 11 17:58:18 2019 -0700
+++ b/src/java.base/share/classes/sun/security/util/KeyStoreDelegator.java	Tue Apr 23 08:34:51 2019 +0800
@@ -269,6 +269,8 @@
                         throw (CertificateException)e;
                     } else if (e instanceof NoSuchAlgorithmException) {
                         throw (NoSuchAlgorithmException)e;
+                    } else if (e instanceof RuntimeException){
+                        throw (RuntimeException)e;
                     }
                 }
             }