Mailing-List: contact harmony-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: harmony-dev@incubator.apache.org
Received-SPF: pass (asf.osuosl.org: domain of yurikropachev@gmail.com
 designates 64.233.182.184 as permitted sender)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
        s=beta; d=gmail.com;
        h=received:message-id:date:from:to:subject:mime-version:content-type;
        b=TzYxl8f/naU5VGLiFI0wbFuJudF1MbMq0GdZHIV/19D4smwmDreqdb7H/mpnJXoeYybSlXaF1L53W4gZXVrecFr+VndqsSKzwPbcB019I6LyxtjCyJfThjRKLktwu/52/CrttEx/sHkblYc+fRRSbLxBehQRoS/5eW+n3MG6tmE=
Message-ID: <8e0d2d0609130331v4c6ae44kd9f6833a82299054@mail.gmail.com>
Date: Wed, 13 Sep 2006 17:31:50 +0700
From: "Yuri Kropachev" <yurikropachev@gmail.com>
To: harmony-dev@incubator.apache.org
Subject: Re: [classlib][security] problem processing SHA signatures in JBoss
 installer manifest
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_Part_3734_6569222.1158143510469"

------=_Part_3734_6569222.1158143510469
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Collegues, thanks a lot for identifying the bug !!!

The fix you propose is correct.


Thanks,

Yuri


> Nice work all. You guys are amazing. Definitely create that patch and

> attach to the initial JIRA.

> geir

> Jimmy, Jing Lv wrote:

>> Richard Liang wrote:

>>> After two-day struggling with JarFile, ObjectInputStream and

>>> MessageDigest, in the end, I have identified the root cause. And now I

>>> have two panda-eyes[1] ;-)

>>>

>>> It seems a bug of

>>> org.apache.harmony.security.provider.crypto.SHA1Impl. As I have no

>>> idea about SHA1. Could any one have a look at this problem?

>>>

>>> The following test case passes on RI, but fails on Harmony.

>>>

>>> public void testUpdate() throws NoSuchAlgorithmException {

>>> byte[] bytes = { 0x6e, 0x61, 0x6d, 0x65};

>>> MessageDigest sha1 = MessageDigest.getInstance("SHA1");

>>> byte[] digest1 = sha1.digest();

>>> byte b = 0x04;

>>> sha1.update(b);

>>>

>>> for (int i = 0; i < bytes.length; i++) {

>>> sha1.update(bytes[i]);

>>> }

>>> byte[] digest2 = sha1.digest();

>>>

>>> sha1.reset();

>>> byte[] digest3 = sha1.digest();

>>> assertTrue(MessageDigest.isEqual(digest1, digest3));

>>>

>>> sha1.update(b);

>>> sha1.update(bytes, 0, bytes.length);

>>> byte[] digest4 = sha1.digest();

>>>

>>> assertTrue(MessageDigest.isEqual(digest2, digest4));

>>> }

>>>

>>> [1]http://www.panda.org.cn/zhuye/bbe.jpg

>>>

>>

>> Poor Richard! Looking for a needle in a bottle of hay, right? ;)

>>

>> A closer study on SHA1Impl, I find these lines(line 194) may be wrong:

>> for ( ; ( i <= toByte ) && ( byteIndex < 4 ) ; i++ ) { // *NOTE* it use

>> // "<=" here

>> intArray[wordIndex] |=

>> ( byteInput[i] & 0xFF ) << ((3 - byteIndex)<<3) ;

>> byteIndex++;

>> }

>> if ( byteIndex == 4 ) {

>> wordIndex++;

>> if ( wordIndex == 16 ) {

>> computeHash(intArray);

>> wordIndex = 0;

>> }

>> }

>> if ( i >= toByte ) { // *NOTE* it use ">=" here

>> return ;

>> }

>> Though I don't know SHA1 well, I guess it must be ">" in the line of

>> second *NOTE*.

>>

>> This bug happens when byteIndex==1, and fromByte==0, toByte==3(that is,

>> input byte number is 4). The first circle inputs 3 bytes into array,

>> leaving the last byte for next step. But at that time i==toByte, so the

>> last byte is omitted, which is properly an mistake.

>>

>> Change it to "if (i > toByte)" will solve the problem, I've run all

>> tests, including Richard's test, and they all passes. It'll be better

>> someone knows SHA1 check it.

>>

>> If no objection, we can create a patch.

>>

>>> Best regards,

>>> Richard

>>>

>>>> On 9/11/06, Richard Liang <richard.liangyx@gmail.com> wrote:

>>>> On 9/9/06, Geir Magnusson Jr. <geir@pobox.com> wrote:

>>>> > I was trying the latest snapshot with the JBoss installer (4.0.1) and

>>>> > found a problem processing the SHA signatures int the jar manifest.

>>>> >

>>>> > I've entered a JIRA - HARMONY-1412

>>>> >

>>>>

>>>> I will have a look at it. ;-)

>>>>

>>>> > geir

>>>> >

>>>> > ---------------------------------------------------------------------

>>>> > Terms of use :
*http://incubator.apache.org/harmony/mailing.html*<http://incubator.apache.org/harmony/mailing.html>

>>>> > To unsubscribe, e-mail: harmony-dev-unsubscribe@incubator.apache.org

>>>> > For additional commands, e-mail:
harmony-dev-help@incubator.apache.org

>>>> >

>>>> >

>>>>

>>>>

>>>> --

>>>> Richard Liang

>>>> China Software Development Lab, IBM

>>>>

>>>

>>>

>>

>>

> ---------------------------------------------------------------------

> Terms of use :
*http://incubator.apache.org/harmony/mailing.html*<http://incubator.apache.org/harmony/mailing.html>

> To unsubscribe, e-mail: harmony-dev-unsubscribe@incubator.apache.org

> For additional commands, e-mail: harmony-dev-help@incubator.apache.org

------=_Part_3734_6569222.1158143510469--