test the returned type in oer getInstance identity guards

Author: rootvector2

docs/releasenotes.html

@@ -23,6 +23,7 @@ <h2>2.0 Release History</h2>
 Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2026, TBD
 <h3>2.1.2 Defects Fixed</h3>
 <ul>
+<li>Four type-coercion helpers in the OER / IEEE 1609.2 (ITS) decoder tested the wrong type in the identity fast path that lets a getInstance() factory return an argument that is already of the target type. org.bouncycastle.oer.its.ieee1609dot2.basetypes.UINT32.getInstance and org.bouncycastle.oer.its.etsi102941.basetypes.Version.getInstance guarded on UINT8 - a sibling of UINT32 under UintBase, and unrelated to Version - so passing a UINT8 threw ClassCastException, while passing an actual UINT32 or Version missed the fast path and fell through to ASN1Integer.getInstance, which rejects them: neither factory accepted its own type. org.bouncycastle.oer.its.etsi103097.EtsiTs103097DataEncryptedUnicast.getInstance guarded on its sibling EtsiTs103097DataEncrypted and then cast to the unicast type, so an EtsiTs103097DataEncrypted threw ClassCastException. org.bouncycastle.oer.OEROptional.getObject(Class) called value.getClass().isInstance(type) with the arguments transposed, which is always false because the argument is a java.lang.Class, so the cast path was dead and every optional field was resolved reflectively, failing with IllegalStateException for a target type with no static getInstance. Each guard now names the type it returns, matching the sibling UINT8 / UINT16 / UINT64 and EtsiTs103097DataEncrypted factories.</li>
 <li>The opt-in key-size validation on CMS key-transport recipients (org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidation(true)) never ran for a message using RFC 9709 CEK derivation (id-alg-cek-hkdf-sha256): the branch that should have selected the actual content-encryption algorithm carried in the KDF AlgorithmIdentifier's parameters compared the encrypted-key byte array against the id-alg-cek-hkdf-sha256 object identifier - a comparison that is always false - so the check fell through to a key-size lookup on the outer KDF OID, which has no registered key size, and silently checked nothing. A key-transport EnvelopedData/AuthEnvelopedData whose transported (and HKDF-derived) content-encryption key did not match the key size of the advertised content-encryption algorithm was therefore accepted even with validation enabled. The recipient now dispatches on the content-encryption AlgorithmIdentifier's algorithm OID, so key-size validation of RFC 9709 messages checks the recovered key against the inner content-encryption algorithm. Messages with a matching key size, non-HKDF messages, and recipients that do not enable validation are unaffected.</li>
 <li>org.bouncycastle.util.BigIntegers.intValueExact (and the byte/short/long variants) delegated to BigInteger.intValueExact from 1.85, a Java 8 method Android only provides from API level 33, so on earlier Android versions any code path using them - most visibly loading a PKCS12 keystore, whose iteration-count validation calls intValueExact - crashed with NoSuchMethodError. The range checks are open-coded again, as they were in 1.84 (github #2369).</li>
 <li>The OpenPGP v6 SEIPD (Symmetrically Encrypted Integrity Protected Data, version 2 / RFC 9580 sec. 5.13.2) packet parser read the AEAD chunk-size octet without bounding it. The chunk length is 2^(chunkSize + 6) bytes and the AEAD decryptor allocates a buffer of that size up front, so a crafted v6 encrypted message (reachable with only the recipient's public key) declaring chunkSize 24 forced a 1 GiB allocation on decrypt, and chunkSize 25 (where the int cast of the chunk length wraps negative) threw a NegativeArraySizeException -- a pre-authentication resource-exhaustion denial of service. This is the version 6 sibling of the version 5 AEADEncDataPacket issue fixed under CVE-2026-3505, which bounded that packet's chunk size at 16 but left the v6 SymmetricEncIntegrityPacket unbounded. SymmetricEncIntegrityPacket now rejects a chunk-size octet outside 0..16 (a 4 MiB chunk, matching the v5 ceiling) with a MalformedPacketException at parse, before any allocation.</li>

util/src/main/java/org/bouncycastle/oer/OEROptional.java

@@ -62,7 +62,7 @@ public <T> T getObject(final Class<T> type)
 
         if (defined)
         {
-            if (value.getClass().isInstance(type))
+            if (type.isInstance(value))
             {
                 return type.cast(value);
             }

util/src/main/java/org/bouncycastle/oer/its/etsi102941/basetypes/Version.java

@@ -5,7 +5,6 @@
 import org.bouncycastle.asn1.ASN1Integer;
 import org.bouncycastle.asn1.ASN1Object;
 import org.bouncycastle.asn1.ASN1Primitive;
-import org.bouncycastle.oer.its.ieee1609dot2.basetypes.UINT8;
 
 public class Version
     extends ASN1Object
@@ -39,7 +38,7 @@ public BigInteger getVersion()
 
     public static Version getInstance(Object o)
     {
-        if (o instanceof UINT8)
+        if (o instanceof Version)
         {
             return (Version)o;
         }

util/src/main/java/org/bouncycastle/oer/its/etsi103097/EtsiTs103097DataEncryptedUnicast.java

@@ -18,7 +18,7 @@ protected EtsiTs103097DataEncryptedUnicast(ASN1Sequence src)
 
     public static EtsiTs103097DataEncryptedUnicast getInstance(Object o)
     {
-        if (o instanceof EtsiTs103097DataEncrypted)
+        if (o instanceof EtsiTs103097DataEncryptedUnicast)
         {
             return (EtsiTs103097DataEncryptedUnicast)o;
         }

util/src/main/java/org/bouncycastle/oer/its/ieee1609dot2/basetypes/UINT32.java

@@ -32,7 +32,7 @@ protected UINT32(ASN1Integer integer)
 
     public static UINT32 getInstance(Object o)
     {
-        if (o instanceof UINT8)
+        if (o instanceof UINT32)
         {
             return (UINT32)o;
         }

util/src/test/java/org/bouncycastle/oer/test/AllTests.java

@@ -41,6 +41,7 @@ public static Test suite()
         suite.addTestSuite(TestBuilders.class);
         suite.addTestSuite(OERExtensionTest.class);
         suite.addTestSuite(OERInputStreamLimitTest.class);
+        suite.addTestSuite(OERTypeGuardTest.class);
 
         return new BCTestSetup(suite);
     }

util/src/test/java/org/bouncycastle/oer/test/OERTypeGuardTest.java

@@ -0,0 +1,83 @@
+package org.bouncycastle.oer.test;
+
+import java.math.BigInteger;
+
+import junit.framework.TestCase;
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.ASN1Integer;
+import org.bouncycastle.oer.OEROptional;
+import org.bouncycastle.oer.its.etsi102941.basetypes.Version;
+import org.bouncycastle.oer.its.etsi103097.EtsiTs103097DataEncrypted;
+import org.bouncycastle.oer.its.etsi103097.EtsiTs103097DataEncryptedUnicast;
+import org.bouncycastle.oer.its.ieee1609dot2.Ieee1609Dot2Content;
+import org.bouncycastle.oer.its.ieee1609dot2.basetypes.UINT32;
+import org.bouncycastle.oer.its.ieee1609dot2.basetypes.UINT8;
+
+/**
+ * The identity fast path in the OER getInstance factories has to test the type it returns.
+ */
+public class OERTypeGuardTest
+    extends TestCase
+{
+    public void testUINT32GetInstance()
+    {
+        UINT32 uint32 = new UINT32(7);
+
+        assertSame(uint32, UINT32.getInstance(uint32));
+        assertEquals(BigInteger.valueOf(7), UINT32.getInstance(new ASN1Integer(7)).getValue());
+
+        // a UINT8 is a sibling of UINT32 under UintBase, not a UINT32
+        try
+        {
+            UINT32.getInstance(new UINT8(7));
+            fail("UINT8 accepted as UINT32");
+        }
+        catch (IllegalArgumentException e)
+        {
+            // expected
+        }
+    }
+
+    public void testVersionGetInstance()
+    {
+        Version version = new Version(1);
+
+        assertSame(version, Version.getInstance(version));
+        assertEquals(BigInteger.ONE, Version.getInstance(new ASN1Integer(1)).getVersion());
+
+        try
+        {
+            Version.getInstance(new UINT8(1));
+            fail("UINT8 accepted as Version");
+        }
+        catch (IllegalArgumentException e)
+        {
+            // expected
+        }
+    }
+
+    public void testEtsiTs103097DataEncryptedUnicastGetInstance()
+    {
+        Ieee1609Dot2Content content = Ieee1609Dot2Content.unsecuredData(new byte[]{1, 2, 3});
+
+        EtsiTs103097DataEncryptedUnicast unicast = new EtsiTs103097DataEncryptedUnicast(content);
+
+        assertSame(unicast, EtsiTs103097DataEncryptedUnicast.getInstance(unicast));
+
+        // EtsiTs103097DataEncrypted is a sibling under EtsiTs103097Data, so it has to be decoded
+        // rather than cast
+        EtsiTs103097DataEncrypted encrypted = new EtsiTs103097DataEncrypted(content);
+
+        assertEquals(encrypted, EtsiTs103097DataEncryptedUnicast.getInstance(encrypted));
+    }
+
+    public void testOEROptionalGetObject()
+    {
+        ASN1Integer value = new ASN1Integer(3);
+
+        assertSame(value, OEROptional.getInstance(value).getObject(ASN1Integer.class));
+
+        // ASN1Encodable has no getInstance, so only the cast path can satisfy this
+        assertSame(value, OEROptional.getValue(ASN1Encodable.class, value));
+    }
+}