On Tue, 4 Aug 2026 12:56:03 GMT, Weijun Wang <[email protected]> wrote:
> Fix looks straightforward, but this means `crl` is more likely to be null. If > `getMatchingCRLs(null, null)` is called, then > `Collections.singletonList(null)` is returned. This looks a little abnormal > and I wonder if it will lead to unexpected NPE. It is a little odd that `getMatchingCRLs(crl, selector)` will return a singleton list with the crl simply because the selector is null. Perhaps there was an earlier assumption that null selectors would always have non-null CRLs. I wonder if an additional check here for a null CRL in this method would be warranted. It could return Collections.emptyList() like the else branch does. If we change the check to something like `if (crl != null && (selector == null || selector.match(crl)))` I think we preserve the existing behavior for all other input patterns and return the empty list for null/null input (which is what we'd want, I think). I can give it a spin and see how it works for the regression test and larger cert path checking. ------------- PR Comment: https://git.openjdk.org/jdk/pull/32164#issuecomment-5180345502
