BC vs. Java(SUN) handling of non-NULL empty input

[dmansfie-qti]

Hello!

I've NOT been keeping current with (Java) BC releases. As we align our code base atop JRE25, we have encountered a change in behavior with BC when compared to default Java (SUN) provider.

The item that is unclear is the handling of a non-NULL empty InputStream. The overall sequence is best represented by the following code-snippet that is using a CertificateFactory to generate one (X509)Certificate using an InputStream as the input resource. The setup here should assume that the InputStream is object is a non-NULL but empty InputStream:

public static X509Certificate getCertificate(final InputStream is)
   throws CertificateException, IOException
{
   X509Certificate cert = null;
    if (is != null) // Check for null input.
   {
      // Adding a buffered input stream to allow for files that may have
      // more than one cert. (See JavaDoc for CertificateFactory.)
      try (BufferedInputStream bis = new BufferedInputStream(is))
      {
         final CertificateFactory certFactory = 
            CertificateFactory.getInstance("X509");
         cert = (X509Certificate)certFactory.generateCertificate(bis);
      }
   }
   return cert;
}

With JRE25/SUN CertificateFactory, a non-NULL empty InputStream will first throw an IOException (empty input resource) and then a CertificateException (unable to be parse input - reason? empty input stream). Thus, there is an exception vs. a return from the above method.

With BC 1.81 (and 1.83) these same conditions now return a NULL certificate. In other words, it appears that on the BC side, a non-NULL but empty InputStream no longer creates an exception and instead, now returns a NULL entity (in this case, an X509Certificate).

I'm writing this generally as I suspect the underlying behavior is a more uniform handling by all BC classes that utilize a common I/O library to handle the lower-level details (i.e., CertificateFactory, KeyFactory, etc.) when an InputStream is presented as an input source.

Is the divergence of this behavior (BC will NOT throw an exception for non-NULL but empty input resource) expected, and if so, is it documented?

Tks!!

--- Dave

[JuanTorchia]

I checked BC 1.83: doGenerateCertificate returns null if its first read hits EOF. generateCertificates uses the same helper and stops collecting certificates when it gets null.

That branch is in 1.83 and was already there in 1.60, so this behavior predates the versions you tested.

I also ran a small comparison on Temurin 25.0.3 with BC 1.83, selecting SUN and BC explicitly and passing a fresh empty ByteArrayInputStream to each call. Results, summarized:

SUN generateCertificate: CertificateException (Empty input)
BC  generateCertificate: null
SUN generateCertificates: empty collection
BC  generateCertificates: empty collection

On the documentation question, the Java 25 Javadoc doesn't mention a null return at EOF for generateCertificate. It does allow an empty collection for generateCertificates. The source alone doesn't establish whether BC guarantees this behavior. A maintainer may be able to clarify that part.

For your helper, checking for null after generateCertificate and throwing CertificateException would make both providers reject empty input. I haven't checked whether other BC APIs handle EOF the same way.