IJ54991: MESSAGEDIGEST.UPDATE API DOES NOT THROW THE CORRECT EXCEPTION.

APAR status

• Closed as program error.

Error description

• Error Message: None
  .
  Stack Trace: Exception in thread "main"
   java.security.ProviderException: Failure in
  engineUpdate
   at
  com.ibm.crypto.plus.provider.IBMJCEPlus.a(IBMJCEPlus.java:128)
   at
  com.ibm.crypto.plus.provider.v.engineUpdate(v.java:39)
   at
  java.security.MessageDigest$Delegate.engineUpdate(MessageDigest.
  java:612)
   at
  java.security.MessageDigest.update(MessageDigest.java:336)
   at MD.getDigestWithNegativeLength(MD.java:45) at
  MD.main(MD.java:22
  .
  None
  

Local fix

Problem summary

• IBMJCEPlus and IBMJCE does not throw the
   correct exception when a negative length parameter
  is passed to the
   MessageDigest.update(byteArray, offset, length) API.
  

Problem conclusion

• The JVM has been updated to throw the correct
   ArrayIndexOutOfBoundsException when a negative
  length parameter is
   passed during a Message Digest update operation for
  both component
   IBMJCE and IBMJCEPlus
   GIT issues: IBMJCE:294, IBMJCEPlus:783
   RTC
   problem report: 152710
   The affected files:
   ibmjceprovider.jar and ibmjceplus.jar
   ibmjceprovider.jar build dates:
   ibmjceprovider.jar - 20250501
   Build: Java 8 - build_20250501-391
   ibmjceplus.jar build dates:
   FIPS140-2 - Build-Date: 20250430
   FIPS140-3 - Build-Date:20250430
   Build for FIPS140-2: Java 8 - build_20250430
   Build for FIPS140-3: Java 8 - build_20250430
   The fixes were delivered for: Java 8.0 SR8 FP50.
  
  .
  This APAR will be fixed in the following Releases:
  .
  IBM Semeru Runtimes
  IBM SDK, Java Technology Edition
   8 SR8 FP50 (8.0.8.50)
  .
  Downloads and supplementary documentation can be found at the
  following locations:
  - For non z/OS operating systems:
   - IBM Semeru Runtimes, Version 11 and later
   https://www.ibm.com/semeru-runtimes/downloads/
   - IBM SDK, Java Technology Edition, Version 8
   https://www.ibm.com/support/pages/java-sdk-downloads/
  - For the z/OS operating system:
   - Java SDK Products on z/OS
   https://www.ibm.com/support/pages/java-sdk-products-zos
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels