[jboss-jira] [JBoss JIRA] (WFLY-7960) Coverity static analysis: Dereference null return value in KeyUtil (Elytron)

[Martin Choma (JIRA)]

Martin Choma created WFLY-7960:
----------------------------------

             Summary: Coverity static analysis: Dereference null return value in KeyUtil (Elytron)
                 Key: WFLY-7960
                 URL: https://issues.jboss.org/browse/WFLY-7960
             Project: WildFly
          Issue Type: Bug
          Components: Security
            Reporter: Martin Choma
            Assignee: Darran Lofthouse


Coverity static analysis found possible use of null object comming from {{RawPBEKey.getSalt()}} passed into {{javax.crypto.spec.PBEParameterSpec.PBEParameterSpec}}

{code:java|title=javax.crypto.spec.PBEParameterSpec.java}
public PBEParameterSpec(byte[] salt, int iterationCount) {
    this.salt = salt.clone();
    this.iterationCount = iterationCount;
}
{code}

Responsible elytron code:
{code:java|title=KeyUtils.java}
if (key instanceof PBEKey && paramSpecClass.isAssignableFrom(PBEParameterSpec.class)) {
            final PBEKey pbeKey = (PBEKey) key;
            // TODO: we miss the IV here
            return paramSpecClass.cast(new PBEParameterSpec(pbeKey.getSalt(), pbeKey.getIterationCount()));
        }
{code}

https://scan7.coverity.com/reports.htm#v23632/p11778/fileInstanceId=8490615&defectInstanceId=2123254&mergedDefectId=1389515



--
This message was sent by Atlassian JIRA
(v7.2.3#72005)