From 37da6818d55d11b99629d0921a77ec279ac43a00 Mon Sep 17 00:00:00 2001 From: Paul Schaub Date: Tue, 21 Oct 2025 17:24:46 +0200 Subject: [PATCH 1/2] Add test for NPE in OpenPGPKey.getEncoded() for v3 keys --- .../openpgp/api/test/OpenPGPV3KeyTest.java | 54 +++++++++++++++++++ 1 file changed, 54 insertions(+) create mode 100644 pg/src/test/java/org/bouncycastle/openpgp/api/test/OpenPGPV3KeyTest.java diff --git a/pg/src/test/java/org/bouncycastle/openpgp/api/test/OpenPGPV3KeyTest.java b/pg/src/test/java/org/bouncycastle/openpgp/api/test/OpenPGPV3KeyTest.java new file mode 100644 index 0000000000..1c3ee817fd --- /dev/null +++ b/pg/src/test/java/org/bouncycastle/openpgp/api/test/OpenPGPV3KeyTest.java @@ -0,0 +1,54 @@ +package org.bouncycastle.openpgp.api.test; + +import org.bouncycastle.openpgp.PGPException; +import org.bouncycastle.openpgp.api.OpenPGPApi; +import org.bouncycastle.openpgp.api.OpenPGPCertificate; +import org.bouncycastle.openpgp.api.OpenPGPKey; + +import java.io.IOException; + +public class OpenPGPV3KeyTest + extends APITest +{ + + private static final String V3Key = "-----BEGIN PGP PRIVATE KEY BLOCK-----\n" + + "\n" + + "lQHYA2JqgDIAAAEEAOYdcIKFQ5ZWBx0D5DKwMMNFcIhFyqmfDJ0v23ehMxOkXN/o\n" + + "HO/43+dq6ZqQn0gNw53Tp9no+EmcCYNrZuN0C4Zu8XHSyY6UB+CqzNkz/CwmV10E\n" + + "dRDipcG1O6scJyy2MWpuOG67til+o+wOLgEkkVkSW8Bl2oqtzVVP4swtKLRZAAUR\n" + + "AAP+JBiyRqt+DYr8GKE85NBX9nlS6DMaxUYgGKgibR5OSVsJjIjNUtG0sNmODjTN\n" + + "sPMZqlNln6wS3l7APMWNoStNGc9JG9Puz3eR2W69lPDzhuxuxrHIUBO+3UlEQB/p\n" + + "N3NPhnwCjh3OWHSMM6rzsX5ExUv0Z4FypnzvMG1x6GRJDVECAO6PyY8NDHsktMVN\n" + + "HAdgC61iIOz+GbLhNGeikuB+DQpSoyckAF0N5reBxRbyjzNZQ7aVvWpxigUp5OdK\n" + + "HMK7YcwTAgD275bcqhd+oWHDhyesi6RVswlqGfix48qahf9wOmDkc0nzp8evy/4V\n" + + "4Qu5zUJGVzi4aEIbFaAnc5lMD9/ydTNjAf485vh4MDFRd3tPvx9mPrHQgaArCBX8\n" + + "9oImPDk0oaKixwSIFzXeg1qZQeLiwv26Fs8gawWsLVZpR4+zZc1nhZlGnrQpSm9o\n" + + "biBRLiBTbWl0aCA8MTIzNDUuNjc4OUBjb21wdXNlcnZlLmNvbT6JAJUDBRBiaoAy\n" + + "VU/izC0otFkBAYIsBACykJ7s82vqCIKewgLpFuqoVGjlfwn9z+G1oa7vr/GxA/mF\n" + + "Dr4E8rZ1ytUFMUCfzy52FfOtDQUVUeOpAraWQ4JfjXkHuDuZcW2VRh2ctT/hVHG7\n" + + "1GgOWUBH3EeXASSnFjvUVE39vEjEsidaMxZtMj5jmtieTMB8pSG1QJXPXGoNyQ==\n" + + "=p7Lr\n" + + "-----END PGP PRIVATE KEY BLOCK-----\n"; + + public static void main(String[] args) + { + runTest(new OpenPGPV3KeyTest()); + } + + @Override + public String getName() + { + return "OpenPGPV3KeyTest"; + } + + @Override + protected void performTestWith(OpenPGPApi api) + throws PGPException, IOException + { + OpenPGPKey key = api.readKeyOrCertificate().parseKey(V3Key); + isNotNull(key.getEncoded()); + + OpenPGPCertificate certificate = key.toCertificate(); + isNotNull(certificate.getEncoded()); + } +} From 5fbc802e6acfae8fc690eb5c88196b98ba3d83d1 Mon Sep 17 00:00:00 2001 From: Paul Schaub Date: Tue, 21 Oct 2025 17:25:22 +0200 Subject: [PATCH 2/2] Fix NPE in PGPSignature.encode() with missing hashed/unhashed area --- pg/src/main/java/org/bouncycastle/openpgp/PGPSignature.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pg/src/main/java/org/bouncycastle/openpgp/PGPSignature.java b/pg/src/main/java/org/bouncycastle/openpgp/PGPSignature.java index f34ec745bb..beddf3abc0 100644 --- a/pg/src/main/java/org/bouncycastle/openpgp/PGPSignature.java +++ b/pg/src/main/java/org/bouncycastle/openpgp/PGPSignature.java @@ -907,7 +907,8 @@ public void encode( throws IOException { // Exportable signatures MUST NOT be exported if forTransfer==true - if (forTransfer && (!getHashedSubPackets().isExportable() || !getUnhashedSubPackets().isExportable())) + if (forTransfer && ((getHashedSubPackets() != null && !getHashedSubPackets().isExportable()) || + (getUnhashedSubPackets() != null && !getUnhashedSubPackets().isExportable()))) { return; }