Test the returned type in the OER getInstance identity guards: UINT32.getInstance and etsi102941 Version.getInstance guarded on UINT8, EtsiTs103097DataEncryptedUnicast.getInstance on its sibling EtsiTs103097DataEncrypted, and OEROptional.getObject had its isInstance arguments transposed, so the first two rejected their own type and the others threw ClassCastException or resolved every optional field reflectively, relates to github #2373.

Author: dghgit

CONTRIBUTORS.html

@@ -594,7 +594,7 @@
 <li>subbudvk &lt;https://github.com/subbudvk&gt; - initial author on S2K parser hardening work for OpenPGP API.</li>
 <li>mkarasik &lt;https://github.com/mkarasik&gt; - initial work on EST server-side key generation (RFC 7030 4.4).</li>
 <li>Bernd Pr&uuml;nster (A-SIT Plus) &lt;bernd.pruenster&#064;a-sit.at&gt; - reported lenient ASN.1 UTCTime/GeneralizedTime parsing accepting structurally malformed content, with fuzzing-derived test cases.</li>
-<li>Naveed Khan &lt;https://github.com/rootvector2&gt; - constant time comparison of membership and confirmation tags in the MLS API. Reported unbounded array allocation in the BKS/UBER keystore load path (OutOfMemoryError DoS from a crafted keystore) and introduction of a capped decompression limit in PGPCompressedData.getDataStream(), both with POC. Original submission creating S/MIME backing temp files with owner-only permissions (PR #2326). Rejecting empty sequences in the X.509 extension parsers whose RFC 5280 syntax is SEQUENCE SIZE (1..MAX) - CRLDistPoint, CertificatePolicies, ExtendedKeyUsage, PolicyMappings, and SubjectDirectoryAttributes (PR #2331). Hardening asn1.cms.SignerInfo decode to reject a non-INTEGER version or non-tagged unsignedAttrs via getInstance rather than leaking a ClassCastException (PR #2342). Fixing an off-by-4 header-length guard in the OpenPGP NotationData signature subpacket parser (PR #2346). Rejecting CR/LF in the S/MIME streaming writer header names and values (SMIMEEnvelopedWriter/SMIMESignedWriter withHeader) to prevent MIME header injection (PR #2348). Adding minimum-length guards to the SM2 decrypt and GOST28147/DSTU7624/DESede/RC2 key-wrap unwrap paths (PR #2359). Guarding the ECDH session-key length in the JCE OpenPGP decryptor (PR #2383).</li>
+<li>Naveed Khan &lt;https://github.com/rootvector2&gt; - constant time comparison of membership and confirmation tags in the MLS API. Reported unbounded array allocation in the BKS/UBER keystore load path (OutOfMemoryError DoS from a crafted keystore) and introduction of a capped decompression limit in PGPCompressedData.getDataStream(), both with POC. Original submission creating S/MIME backing temp files with owner-only permissions (PR #2326). Rejecting empty sequences in the X.509 extension parsers whose RFC 5280 syntax is SEQUENCE SIZE (1..MAX) - CRLDistPoint, CertificatePolicies, ExtendedKeyUsage, PolicyMappings, and SubjectDirectoryAttributes (PR #2331). Hardening asn1.cms.SignerInfo decode to reject a non-INTEGER version or non-tagged unsignedAttrs via getInstance rather than leaking a ClassCastException (PR #2342). Fixing an off-by-4 header-length guard in the OpenPGP NotationData signature subpacket parser (PR #2346). Rejecting CR/LF in the S/MIME streaming writer header names and values (SMIMEEnvelopedWriter/SMIMESignedWriter withHeader) to prevent MIME header injection (PR #2348). Adding minimum-length guards to the SM2 decrypt and GOST28147/DSTU7624/DESede/RC2 key-wrap unwrap paths (PR #2359). Guarding the ECDH session-key length in the JCE OpenPGP decryptor (PR #2383). Fixing the identity fast-path type guards in the OER getInstance factories and the transposed isInstance arguments in OEROptional.getObject (PR #2373).</li>
 <li>suraj0208 &lt;https://github.com/suraj0208&gt; - initial work on auto-detecting private key reader (JcaPrivateKeyReader).</li>
 <li>liamgilligan &lt;https://github.com/liamgilligan&gt; - noticing the BIP-340 step numbering in the BIP340Signer signing comments was incorrect (PR #2340).</li>
 <li>digi-scrypt &lt;https://github.com/digi-scrypt&gt; - disabling DTD and external-entity resolution in KMIPInputStream to close an XXE (local file disclosure / SSRF) exposure in KMIP XML parsing (PR #2315).</li>

docs/releasenotes.html

@@ -23,6 +23,7 @@ <h2>2.0 Release History</h2>
 Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2026, TBD
 <h3>2.1.2 Defects Fixed</h3>
 <ul>
+<li>Four type-coercion helpers in the OER / IEEE 1609.2 (ITS) decoder tested the wrong type in the identity fast path that lets a getInstance() factory return an argument that is already of the target type. org.bouncycastle.oer.its.ieee1609dot2.basetypes.UINT32.getInstance and org.bouncycastle.oer.its.etsi102941.basetypes.Version.getInstance guarded on UINT8 - a sibling of UINT32 under UintBase, and unrelated to Version - so passing a UINT8 threw ClassCastException, while passing an actual UINT32 or Version missed the fast path and fell through to ASN1Integer.getInstance, which rejects them: neither factory accepted its own type. org.bouncycastle.oer.its.etsi103097.EtsiTs103097DataEncryptedUnicast.getInstance guarded on its sibling EtsiTs103097DataEncrypted and then cast to the unicast type, so an EtsiTs103097DataEncrypted threw ClassCastException. org.bouncycastle.oer.OEROptional.getObject(Class) called value.getClass().isInstance(type) with the arguments transposed, which is always false because the argument is a java.lang.Class, so the cast path was dead and every optional field was resolved reflectively, failing with IllegalStateException for a target type with no static getInstance. Each guard now names the type it returns, matching the sibling UINT8 / UINT16 / UINT64 and EtsiTs103097DataEncrypted factories (github #2373).</li>
 <li>DefaultAlgorithmNameFinder and DefaultSignatureNameFinder had no entries at all for the ShangMi algorithms, so an SM2 signature AlgorithmIdentifier that DefaultSignatureAlgorithmIdentifierFinder itself produces came back named only by its OID string - getAlgorithmName(GMObjectIdentifiers.sm2sign_with_sm3) returned "1.2.156.10197.1.501" and hasAlgorithmName returned false. Both finders now name sm2sign_with_sm3 as SM3WITHSM2 and sm2sign_with_sha256 as SHA256WITHSM2, and DefaultAlgorithmNameFinder additionally names the sm3 digest. All three resolve through the BC provider, as Signature and MessageDigest respectively. The remaining GM arc - the SM4 cipher modes, the sm2encrypt variants, and the SM1 / SM6 / SSF33 ciphers BC does not implement - is still unnamed (github #2377).</li>
 <li>The RFC 4998 evidence-record classes compared the digest AlgorithmIdentifier named by a time-stamp authority with the one their own DigestCalculator uses, and did so with AlgorithmIdentifier.equals(), which compares the encodings. A TSA that names SHA-256 with an explicit NULL parameters field - DigiCert among them - therefore failed against BC's own calculator, which names it with the parameters absent, and ERSArchiveTimeStampGenerator.generateArchiveTimeStamp rejected the response with "time stamp imprint for wrong algorithm". Both spellings name the same digest and RFC 5754 sec. 2 requires a receiver to accept either, while requiring that identifiers be generated with the parameters absent, which BC already does. The three affected comparisons - the two in ERSArchiveTimeStampGenerator and the digest check in ERSEvidenceRecord.renew - now use the new AlgorithmIdentifier.areEquivalent, which matches on the algorithm and treats an absent parameters field and NULL as the same, and the consistency check across an evidence record's archive time stamp chain uses it too. An identifier carrying an actual parameter structure is never equivalent to one carrying none (github #2379).</li>
 <li>EDIPartyName.toASN1Primitive emitted the nameAssigner and partyName DirectoryStrings without their context tags, so an EDIPartyName built through its public constructor could not be parsed back by EDIPartyName.getInstance, which correctly requires them. RFC 5280 sec. 4.2.1.6 tags both members [0] and [1], and those tags are explicit despite the module's IMPLICIT TAGS because DirectoryString is a CHOICE, which X.680 does not allow to be tagged implicitly - the decoder already had this right. The encoder now matches it. Note the type was added during the 1.85 cycle and GeneralName validates its ediPartyName alternative through it, so a GeneralName carrying an untagged ediPartyName - including one BC itself produced - is rejected where 1.84 passed it through unexamined; the untagged form is not read leniently (github #2380).</li>

util/src/main/java/org/bouncycastle/oer/OEROptional.java

@@ -62,7 +62,7 @@ public <T> T getObject(final Class<T> type)
 
         if (defined)
         {
-            if (value.getClass().isInstance(type))
+            if (type.isInstance(value))
             {
                 return type.cast(value);
             }

util/src/main/java/org/bouncycastle/oer/its/etsi102941/basetypes/Version.java

@@ -5,7 +5,6 @@
 import org.bouncycastle.asn1.ASN1Integer;
 import org.bouncycastle.asn1.ASN1Object;
 import org.bouncycastle.asn1.ASN1Primitive;
-import org.bouncycastle.oer.its.ieee1609dot2.basetypes.UINT8;
 
 public class Version
     extends ASN1Object
@@ -39,7 +38,7 @@ public BigInteger getVersion()
 
     public static Version getInstance(Object o)
     {
-        if (o instanceof UINT8)
+        if (o instanceof Version)
         {
             return (Version)o;
         }

util/src/main/java/org/bouncycastle/oer/its/etsi103097/EtsiTs103097DataEncryptedUnicast.java

@@ -18,7 +18,7 @@ protected EtsiTs103097DataEncryptedUnicast(ASN1Sequence src)
 
     public static EtsiTs103097DataEncryptedUnicast getInstance(Object o)
     {
-        if (o instanceof EtsiTs103097DataEncrypted)
+        if (o instanceof EtsiTs103097DataEncryptedUnicast)
         {
             return (EtsiTs103097DataEncryptedUnicast)o;
         }

util/src/main/java/org/bouncycastle/oer/its/ieee1609dot2/basetypes/UINT32.java

@@ -32,7 +32,7 @@ protected UINT32(ASN1Integer integer)
 
     public static UINT32 getInstance(Object o)
     {
-        if (o instanceof UINT8)
+        if (o instanceof UINT32)
         {
             return (UINT32)o;
         }

util/src/test/java/org/bouncycastle/oer/test/AllTests.java

@@ -42,6 +42,7 @@ public static Test suite()
         suite.addTestSuite(OERExtensionTest.class);
         suite.addTestSuite(OERInputStreamLimitTest.class);
         suite.addTestSuite(OERInputStreamMalformedTest.class);
+        suite.addTestSuite(OERTypeGuardTest.class);
 
         return new BCTestSetup(suite);
     }

util/src/test/java/org/bouncycastle/oer/test/OERTypeGuardTest.java

@@ -0,0 +1,84 @@
+package org.bouncycastle.oer.test;
+
+import java.math.BigInteger;
+
+import junit.framework.TestCase;
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.ASN1Integer;
+import org.bouncycastle.oer.OEROptional;
+import org.bouncycastle.oer.its.etsi102941.basetypes.Version;
+import org.bouncycastle.oer.its.etsi103097.EtsiTs103097DataEncrypted;
+import org.bouncycastle.oer.its.etsi103097.EtsiTs103097DataEncryptedUnicast;
+import org.bouncycastle.oer.its.ieee1609dot2.Ieee1609Dot2Content;
+import org.bouncycastle.oer.its.ieee1609dot2.basetypes.UINT32;
+import org.bouncycastle.oer.its.ieee1609dot2.basetypes.UINT8;
+import org.bouncycastle.util.BigIntegers;
+
+/**
+ * The identity fast path in the OER getInstance factories has to test the type it returns.
+ */
+public class OERTypeGuardTest
+    extends TestCase
+{
+    public void testUINT32GetInstance()
+    {
+        UINT32 uint32 = new UINT32(7);
+
+        assertSame(uint32, UINT32.getInstance(uint32));
+        assertEquals(BigInteger.valueOf(7), UINT32.getInstance(new ASN1Integer(7)).getValue());
+
+        // a UINT8 is a sibling of UINT32 under UintBase, not a UINT32
+        try
+        {
+            UINT32.getInstance(new UINT8(7));
+            fail("UINT8 accepted as UINT32");
+        }
+        catch (IllegalArgumentException e)
+        {
+            // expected
+        }
+    }
+
+    public void testVersionGetInstance()
+    {
+        Version version = new Version(1);
+
+        assertSame(version, Version.getInstance(version));
+        assertEquals(BigIntegers.ONE, Version.getInstance(new ASN1Integer(1)).getVersion());
+
+        try
+        {
+            Version.getInstance(new UINT8(1));
+            fail("UINT8 accepted as Version");
+        }
+        catch (IllegalArgumentException e)
+        {
+            // expected
+        }
+    }
+
+    public void testEtsiTs103097DataEncryptedUnicastGetInstance()
+    {
+        Ieee1609Dot2Content content = Ieee1609Dot2Content.unsecuredData(new byte[]{1, 2, 3});
+
+        EtsiTs103097DataEncryptedUnicast unicast = new EtsiTs103097DataEncryptedUnicast(content);
+
+        assertSame(unicast, EtsiTs103097DataEncryptedUnicast.getInstance(unicast));
+
+        // EtsiTs103097DataEncrypted is a sibling under EtsiTs103097Data, so it has to be decoded
+        // rather than cast
+        EtsiTs103097DataEncrypted encrypted = new EtsiTs103097DataEncrypted(content);
+
+        assertEquals(encrypted, EtsiTs103097DataEncryptedUnicast.getInstance(encrypted));
+    }
+
+    public void testOEROptionalGetObject()
+    {
+        ASN1Integer value = new ASN1Integer(3);
+
+        assertSame(value, OEROptional.getInstance(value).getObject(ASN1Integer.class));
+
+        // ASN1Encodable has no getInstance, so only the cast path can satisfy this
+        assertSame(value, OEROptional.getValue(ASN1Encodable.class, value));
+    }
+}