BC v1.85 fails to load CMS containing invalid UTC time, instead of skipping the malformed property

[bsanchezb]

Since the update to BC v1.85 we have faced with inability to process CMS signatures with malformed UTCTime fields, resulting to an exception:

Caused by: java.lang.IllegalStateException: invalid UTCTime format
	at org.bouncycastle.util.Exceptions.illegalStateException(Unknown Source)
	at org.bouncycastle.asn1.DLSequenceParser.toASN1Primitive(Unknown Source)
	at org.bouncycastle.cms.CMSSignedDataParser.getSignerInfos(Unknown Source)
	... 56 more
Caused by: org.bouncycastle.asn1.ASN1Exception: invalid UTCTime format
	at org.bouncycastle.asn1.ASN1InputStream.createPrimitiveDERObject(Unknown Source)
	at org.bouncycastle.asn1.ASN1StreamParser.parseImplicitPrimitive(Unknown Source)
	at org.bouncycastle.asn1.ASN1StreamParser.implParseObject(Unknown Source)
	at org.bouncycastle.asn1.ASN1StreamParser.readVector(Unknown Source)
	at org.bouncycastle.asn1.DLSetParser.getLoadedObject(Unknown Source)
	at org.bouncycastle.asn1.ASN1StreamParser.readVector(Unknown Source)
	at org.bouncycastle.asn1.DLSequenceParser.getLoadedObject(Unknown Source)
	at org.bouncycastle.asn1.ASN1StreamParser.readVector(Unknown Source)
	at org.bouncycastle.asn1.ASN1StreamParser.loadTaggedDL(Unknown Source)
	at org.bouncycastle.asn1.DLTaggedObjectParser.getLoadedObject(Unknown Source)
	at org.bouncycastle.asn1.ASN1StreamParser.readVector(Unknown Source)
	at org.bouncycastle.asn1.DLSequenceParser.getLoadedObject(Unknown Source)
	... 63 more
Caused by: java.lang.IllegalArgumentException: invalid UTCTime format
	at org.bouncycastle.asn1.ASN1UTCTime.createPrimitive(Unknown Source)
	... 75 more

We think it is a bit too harsh to fail a complete CMS loading because of a single malformed field. We would prefer to have the malformed field to be skipped instead and an error or warning to be logged, instead of a complete failure. With the current behavior we are not able to produce a validation report for the concerned signatures.

A test file is attached to the ticket.

BC185_UTCTime.zip

[roy-basmacier]

Hi @bsanchezb,

Added a property to allow zoneless utctime. The beta is available at https://downloads.bouncycastle.org/betas

Set org.bouncycastle.asn1.allow_zoneless_utctime to true and check if everything works.