>From 56a65d62566bd3ed189496b32ccad38dc1f3e9dd Mon Sep 17 00:00:00 2001
From: Abhishek Koneru <akoneru@redhat.com>
Date: Wed, 6 Jun 2012 16:55:54 -0400
Subject: [PATCH] Fixes for NULL_RETURNS Coverity Issues - Part 2

---
 .classpath                                         |    2 +-
 .../netscape/certsrv/authentication/AuthToken.java |   14 +++++------
 .../certsrv/authentication/IAuthToken.java         |   16 +++++++++----
 .../src/com/netscape/certsrv/request/IService.java |    5 +++-
 .../com/netscape/cms/authentication/CMCAuth.java   |    7 +++++-
 .../cms/policy/extensions/SubjAltNameExt.java      |    6 +++--
 .../cms/servlet/base/DisplayHtmlServlet.java       |    3 +--
 .../servlet/cert/ChallengeRevocationServlet1.java  |    3 ++-
 .../com/netscape/cms/servlet/cert/UpdateCRL.java   |    3 ++-
 .../csadmin/LDAPSecurityDomainSessionTable.java    |   12 ++++++++--
 .../cmscore/authentication/AuthSubsystem.java      |    3 +++
 .../authentication/PasswdUserDBAuthentication.java |    5 +++-
 .../src/com/netscape/cmscore/dbs/DBSubsystem.java  |    3 +++
 .../com/netscape/cmscore/dbs/KeyRepository.java    |    6 +++++
 .../netscape/cmscore/profile/ProfileSubsystem.java |    3 +++
 .../netscape/cmscore/request/ARequestQueue.java    |   10 ++++++--
 .../certsrv/authentication/AuthTokenTest.java      |   12 +++++++---
 .../cmscore/dbs/DBSubsystemDefaultStub.java        |    3 +--
 .../com/netscape/cmscore/test/CMSBaseTestCase.java |    3 +--
 .../src/com/netscape/cmstools/DRMTool.java         |    4 +++-
 .../src/com/netscape/cmstools/OCSPClient.java      |    3 +++
 .../src/com/netscape/cmstools/PKCS12Export.java    |    6 +++++
 base/kra/src/com/netscape/kra/KRAService.java      |    9 +++++++
 base/kra/src/com/netscape/kra/RecoveryService.java |   11 ++++++---
 .../netscape/pkisilent/argparser/ArgParser.java    |    6 +++--
 .../src/com/netscape/pkisilent/common/CMSLDAP.java |    4 ++--
 .../com/netscape/pkisilent/http/HTTPClient.java    |   25 ++++++++++----------
 .../cmsutil/radius/ChallengeException.java         |   15 +++++++++---
 .../netscape/cmsutil/radius/RejectException.java   |    8 +++++--
 .../security/extensions/NSCertTypeExtension.java   |    8 +++++--
 .../src/netscape/security/util/DerInputBuffer.java |    4 ++--
 .../src/netscape/security/util/DerInputStream.java |    3 ++-
 .../x509/IssuingDistributionPointExtension.java    |    3 +++
 .../test/com/netscape/security/util/JSSUtil.java   |    6 ++++-
 34 files changed, 170 insertions(+), 64 deletions(-)

diff --git a/.classpath b/.classpath
index c34b7f4c054659b6ea28e3b91d05456771ccb162..7d84d45c3f3e6f469b65ad37874dc0ddbcf6521d 100644
--- a/.classpath
+++ b/.classpath
@@ -41,7 +41,7 @@
 	<classpathentry kind="lib" path="/usr/share/java/xml-commons-apis.jar"/>
 	<classpathentry kind="lib" path="/usr/share/tomcat6/lib/catalina.jar"/>
 	<classpathentry kind="lib" path="/usr/share/java/istack-commons-runtime.jar"/>
-	<classpathentry kind="lib" path="/usr/share/java/jss/jss4.jar"/>
+	<classpathentry kind="lib" path="/usr/share/java/jss4.jar"/>
 	<classpathentry kind="lib" path="/usr/share/java/apache-commons-lang.jar"/>
 	<classpathentry kind="lib" path="/usr/share/java/resteasy/resteasy-atom-provider.jar"/>
 	<classpathentry kind="output" path="build/classes"/>
diff --git a/base/common/src/com/netscape/certsrv/authentication/AuthToken.java b/base/common/src/com/netscape/certsrv/authentication/AuthToken.java
index d934f62e88b8f1ac30a776cbebb8ef0975715b67..110b30485aa195caea2eb4e40fddd111d0f68848 100644
--- a/base/common/src/com/netscape/certsrv/authentication/AuthToken.java
+++ b/base/common/src/com/netscape/certsrv/authentication/AuthToken.java
@@ -291,7 +291,7 @@ public class AuthToken implements IAuthToken {
         return set(name, out.toByteArray());
     }
 
-    public CertificateExtensions getInCertExts(String name) {
+    public CertificateExtensions getInCertExts(String name) throws IOException {
         CertificateExtensions exts = null;
         byte[] data = getInByteArray(name);
         if (data != null) {
@@ -300,7 +300,7 @@ public class AuthToken implements IAuthToken {
                 // exts.decode() doesn't work for empty CertExts
                 exts.decodeEx(new ByteArrayInputStream(data));
             } catch (IOException e) {
-                return null;
+                throw new IOException(e.toString());
             }
         }
         return exts;
@@ -321,7 +321,7 @@ public class AuthToken implements IAuthToken {
         return set(name, out.toByteArray());
     }
 
-    public Certificates getInCertificates(String name) {
+    public Certificates getInCertificates(String name) throws IOException, CertificateException {
         X509CertImpl[] certArray;
 
         byte[] byteValue = getInByteArray(name);
@@ -338,9 +338,9 @@ public class AuthToken implements IAuthToken {
                 certArray[i] = new X509CertImpl(certData);
             }
         } catch (IOException e) {
-            return null;
+            throw new IOException(e.toString());
         } catch (CertificateException e) {
-            return null;
+            throw new CertificateException(e.toString());
         }
         return new Certificates(certArray);
     }
@@ -372,7 +372,7 @@ public class AuthToken implements IAuthToken {
         }
     }
 
-    public byte[][] getInByteArrayArray(String name) {
+    public byte[][] getInByteArrayArray(String name) throws IOException {
         byte[][] retval;
 
         byte[] byteValue = getInByteArray(name);
@@ -387,7 +387,7 @@ public class AuthToken implements IAuthToken {
                 retval[i] = derValues[i].getOctetString();
             }
         } catch (IOException e) {
-            return null;
+            throw new IOException(e.toString());
         }
         return retval;
     }
diff --git a/base/common/src/com/netscape/certsrv/authentication/IAuthToken.java b/base/common/src/com/netscape/certsrv/authentication/IAuthToken.java
index 25a73b8f15466b3c9ca986fc64b6e0e20a22c90b..e2044494e85e7c8529c20e3c5c34d3f93a99d5fa 100644
--- a/base/common/src/com/netscape/certsrv/authentication/IAuthToken.java
+++ b/base/common/src/com/netscape/certsrv/authentication/IAuthToken.java
@@ -17,7 +17,9 @@
 // --- END COPYRIGHT BLOCK ---
 package com.netscape.certsrv.authentication;
 
+import java.io.IOException;
 import java.math.BigInteger;
+import java.security.cert.CertificateException;
 import java.util.Date;
 import java.util.Enumeration;
 
@@ -176,9 +178,10 @@ public interface IAuthToken {
      * Retrieves the CertificateExtensions value for name.
      *
      * @param name The attribute name.
-     * @return The value or null on error.
+     * @return The value.
+     * @throws IOException
      */
-    public CertificateExtensions getInCertExts(String name);
+    public CertificateExtensions getInCertExts(String name) throws IOException;
 
     /**
      * Stores the CertificateExtensions with the associated key.
@@ -193,9 +196,11 @@ public interface IAuthToken {
      * Retrieves the Certificates value for name.
      *
      * @param name The attribute name.
-     * @return The value or null on error.
+     * @return The value.
+     * @throws IOException
+     * @throws CertificateException
      */
-    public Certificates getInCertificates(String name);
+    public Certificates getInCertificates(String name) throws IOException, CertificateException;
 
     /**
      * Stores the Certificates with the associated key.
@@ -211,8 +216,9 @@ public interface IAuthToken {
      *
      * @param name The attribute name.
      * @return The value or null on error.
+     * @throws IOException
      */
-    public byte[][] getInByteArrayArray(String name);
+    public byte[][] getInByteArrayArray(String name) throws IOException;
 
     /**
      * Stores the byte[][] with the associated key.
diff --git a/base/common/src/com/netscape/certsrv/request/IService.java b/base/common/src/com/netscape/certsrv/request/IService.java
index 0756be8932f046e0919a31b98754f50409299798..0dd7ab52cf0a4419a864f7b70b0076059c261545 100644
--- a/base/common/src/com/netscape/certsrv/request/IService.java
+++ b/base/common/src/com/netscape/certsrv/request/IService.java
@@ -17,6 +17,8 @@
 // --- END COPYRIGHT BLOCK ---
 package com.netscape.certsrv.request;
 
+import java.security.cert.CertificateException;
+
 import com.netscape.certsrv.base.EBaseException;
 
 /**
@@ -42,7 +44,8 @@ public interface IService {
      *         an indication of whether this request is still pending.
      *         'false' means the request will wait for further notification.
      * @exception EBaseException indicates major processing failure.
+     * @throws CertificateException
      */
     boolean serviceRequest(IRequest request)
-            throws EBaseException;
+            throws EBaseException, CertificateException;
 }
diff --git a/base/common/src/com/netscape/cms/authentication/CMCAuth.java b/base/common/src/com/netscape/cms/authentication/CMCAuth.java
index d15f445f327043d6fa726cccd109af91f0f00b5e..1b8857ba85bafbb663b455faaaa3b370cbca8ac2 100644
--- a/base/common/src/com/netscape/cms/authentication/CMCAuth.java
+++ b/base/common/src/com/netscape/cms/authentication/CMCAuth.java
@@ -768,7 +768,7 @@ public class CMCAuth implements IAuthManager, IExtendedPluginInfo,
                 level, "CMC Authentication: " + msg);
     }
 
-    protected IAuthToken verifySignerInfo(AuthToken authToken, SignedData cmcFullReq) throws EInvalidCredentials {
+    protected IAuthToken verifySignerInfo(AuthToken authToken, SignedData cmcFullReq) throws EBaseException {
 
         EncapsulatedContentInfo ci = cmcFullReq.getContentInfo();
         OBJECT_IDENTIFIER id = ci.getContentType();
@@ -875,6 +875,9 @@ public class CMCAuth implements IAuthManager, IExtendedPluginInfo,
                         IAuthSubsystem authSS = (IAuthSubsystem) CMS.getSubsystem(CMS.SUBSYSTEM_AUTH);
 
                         IAuthManager agentAuth = authSS.getAuthManager(IAuthSubsystem.CERTUSERDB_AUTHMGR_ID);//AGENT_AUTHMGR_ID);
+                        if (agentAuth == null) {
+                            throw new EBaseException("No Authentication Manager with name "+IAuthSubsystem.CERTUSERDB_AUTHMGR_ID);
+                        }
                         IAuthCredentials agentCred = new com.netscape.certsrv.authentication.AuthCredentials();
 
                         agentCred.set(IAuthManager.CRED_SSL_CLIENT_CERT, x509Certs);
@@ -901,6 +904,8 @@ public class CMCAuth implements IAuthManager, IExtendedPluginInfo,
             CMS.debug("CMCAuth: " + e.toString());
         } catch (IOException e) {
             CMS.debug("CMCAuth: " + e.toString());
+        } catch (EBaseException e) {
+            throw new EBaseException(e.getMessage());
         } catch (Exception e) {
             throw new EInvalidCredentials(CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL"));
         }
diff --git a/base/common/src/com/netscape/cms/policy/extensions/SubjAltNameExt.java b/base/common/src/com/netscape/cms/policy/extensions/SubjAltNameExt.java
index e1ae7d074f26261ae03bace356d3ff9b7084a71d..944846273373d0a789285f5804191a79d815aef0 100644
--- a/base/common/src/com/netscape/cms/policy/extensions/SubjAltNameExt.java
+++ b/base/common/src/com/netscape/cms/policy/extensions/SubjAltNameExt.java
@@ -250,9 +250,10 @@ public class SubjAltNameExt extends APolicyRule
     /**
      * Generate a String Vector containing all the email addresses
      * found in this Authentication token
+     * @throws IOException
      */
     protected Vector /* of String */<String>
-            getEmailList(IAuthToken tok) {
+            getEmailList(IAuthToken tok) throws IOException {
 
         Vector<String> v = new Vector<String>();
 
@@ -267,9 +268,10 @@ public class SubjAltNameExt extends APolicyRule
 
     /**
      * Add attribute values from an LDAP attribute to a vector
+     * @throws IOException
      */
     protected void
-            addValues(IAuthToken tok, String attrName, Vector<String> v) {
+            addValues(IAuthToken tok, String attrName, Vector<String> v) throws IOException {
         String attr[] = tok.getInStringArray(attrName);
 
         if (attr == null)
diff --git a/base/common/src/com/netscape/cms/servlet/base/DisplayHtmlServlet.java b/base/common/src/com/netscape/cms/servlet/base/DisplayHtmlServlet.java
index a6cb97908f52ef657b7d481105d3732313738414..05f0a8b59c697227fdc5fc6c299c8a89810476df 100644
--- a/base/common/src/com/netscape/cms/servlet/base/DisplayHtmlServlet.java
+++ b/base/common/src/com/netscape/cms/servlet/base/DisplayHtmlServlet.java
@@ -62,9 +62,8 @@ public class DisplayHtmlServlet extends CMSServlet {
     public void process(CMSRequest cmsReq) throws EBaseException {
         CMS.debug("DisplayHtmlServlet about to service ");
 
-        authenticate(cmsReq);
-
         try {
+            authenticate(cmsReq);
             String realpath =
                     mServletConfig.getServletContext().getRealPath("/" + mHTMLPath);
 
diff --git a/base/common/src/com/netscape/cms/servlet/cert/ChallengeRevocationServlet1.java b/base/common/src/com/netscape/cms/servlet/cert/ChallengeRevocationServlet1.java
index e820bb87a8398346cc2ef3e97789af76674132e3..9615320776f25e83d307d7621935121e9b91fb92 100644
--- a/base/common/src/com/netscape/cms/servlet/cert/ChallengeRevocationServlet1.java
+++ b/base/common/src/com/netscape/cms/servlet/cert/ChallengeRevocationServlet1.java
@@ -132,9 +132,10 @@ public class ChallengeRevocationServlet1 extends CMSServlet {
      * </ul>
      *
      * @param cmsReq the object holding the request and response information
+     * @throws IOException
      */
     protected void process(CMSRequest cmsReq)
-            throws EBaseException {
+            throws EBaseException{
         IArgBlock httpParams = cmsReq.getHttpParams();
         HttpServletRequest req = cmsReq.getHttpReq();
         HttpServletResponse resp = cmsReq.getHttpResp();
diff --git a/base/common/src/com/netscape/cms/servlet/cert/UpdateCRL.java b/base/common/src/com/netscape/cms/servlet/cert/UpdateCRL.java
index bd12bcfd8f9199f4bec306d5e1fc388f03a87367..433e97f895a0af2eb2ba4cc842df5aef60867af1 100644
--- a/base/common/src/com/netscape/cms/servlet/cert/UpdateCRL.java
+++ b/base/common/src/com/netscape/cms/servlet/cert/UpdateCRL.java
@@ -120,10 +120,11 @@ public class UpdateCRL extends CMSServlet {
             statsSub.startTiming("crl", true /* main action */);
         }
 
-        IAuthToken authToken = authenticate(cmsReq);
+        IAuthToken authToken = null;
         AuthzToken authzToken = null;
 
         try {
+            authToken = authenticate(cmsReq);
             authzToken = authorize(mAclMethod, authToken,
                         mAuthzResourceName, "update");
         } catch (EAuthzAccessDenied e) {
diff --git a/base/common/src/com/netscape/cms/servlet/csadmin/LDAPSecurityDomainSessionTable.java b/base/common/src/com/netscape/cms/servlet/csadmin/LDAPSecurityDomainSessionTable.java
index b9932722e772655fdd25cd632ce3bd11ca121d6c..1933383f8e4e60ee2e8c65e3a68726504217d719 100644
--- a/base/common/src/com/netscape/cms/servlet/csadmin/LDAPSecurityDomainSessionTable.java
+++ b/base/common/src/com/netscape/cms/servlet/csadmin/LDAPSecurityDomainSessionTable.java
@@ -192,6 +192,10 @@ public class LDAPSecurityDomainSessionTable
             LDAPSearchResults res = conn.search(sessionsdn, LDAPv2.SCOPE_SUB, filter, attrs, false);
             while (res.hasMoreElements()) {
                 LDAPEntry entry = res.next();
+                LDAPAttribute sid = entry.getAttribute("cn");
+                if (sid == null) {
+                    throw new Exception("Invalid LDAP Entry. No session id.");
+                }
                 ret.add(entry.getAttribute("cn").getStringValueArray()[0]);
             }
         } catch (LDAPException e) {
@@ -228,10 +232,14 @@ public class LDAPSecurityDomainSessionTable
             LDAPSearchResults res = conn.search(sessionsdn, LDAPv2.SCOPE_SUB, filter, attrs, false);
             if (res.getCount() > 0) {
                 LDAPEntry entry = res.next();
-                ret = entry.getAttribute(attr).getStringValueArray()[0];
+                LDAPAttribute searchAttribute = entry.getAttribute(attr);
+                if (searchAttribute == null) {
+                    throw new Exception("No Attribute " + attr + " for this session");
+                }
+                ret = searchAttribute.getStringValueArray()[0];
             }
         } catch (Exception e) {
-            CMS.debug("SecurityDomainSessionTable: unable to query session " + sessionId + ": " + e);
+            CMS.debug("SecurityDomainSessionTable: unable to query session " + sessionId + ": " + e.getMessage());
         }
 
         try {
diff --git a/base/common/src/com/netscape/cmscore/authentication/AuthSubsystem.java b/base/common/src/com/netscape/cmscore/authentication/AuthSubsystem.java
index fbb589376ea1d7a77450047aff02d671d7ee75d9..43de01ada9f3c4c4916e8d46be235b17708f5dfe 100644
--- a/base/common/src/com/netscape/cmscore/authentication/AuthSubsystem.java
+++ b/base/common/src/com/netscape/cmscore/authentication/AuthSubsystem.java
@@ -461,6 +461,9 @@ public class AuthSubsystem implements IAuthSubsystem {
         for (Enumeration<String> e = mAuthMgrInsts.keys(); e.hasMoreElements();) {
 
             IAuthManager mgr = get(e.nextElement());
+            if (mgr == null) {
+                continue;
+            }
 
             log(ILogger.LL_INFO, CMS.getLogMessage("CMSCORE_AUTH_INSTANCE_SHUTDOWN", mgr.getName()));
 
diff --git a/base/common/src/com/netscape/cmscore/authentication/PasswdUserDBAuthentication.java b/base/common/src/com/netscape/cmscore/authentication/PasswdUserDBAuthentication.java
index 5b6418c00ec81c58c244c3c9be92183136a99854..eddebd88198b7d9d8b8f24e6d83a5ade1e4fcfa3 100644
--- a/base/common/src/com/netscape/cmscore/authentication/PasswdUserDBAuthentication.java
+++ b/base/common/src/com/netscape/cmscore/authentication/PasswdUserDBAuthentication.java
@@ -186,12 +186,15 @@ public class PasswdUserDBAuthentication implements IAuthManager {
 
         try {
             user = ug.getUser(uid);
+            if (user == null) {
+                throw new EInvalidCredentials(uid);
+            }
         } catch (EBaseException e) {
             if (Debug.ON)
                 e.printStackTrace();
             // not a user in our user/group database.
             log(ILogger.LL_SECURITY, CMS.getLogMessage("CMSCORE_AUTH_UID_NOT_FOUND", uid, e.toString()));
-            throw new EInvalidCredentials(CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL"));
+            throw new EInvalidCredentials(CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL") + " " + e.getMessage());
         }
         authToken.set(TOKEN_USERDN, user.getUserDN());
         authToken.set(TOKEN_USERID, user.getUserID());
diff --git a/base/common/src/com/netscape/cmscore/dbs/DBSubsystem.java b/base/common/src/com/netscape/cmscore/dbs/DBSubsystem.java
index 304f5aa94830e1d24fb24ca486407b2efa92cb45..e36f5d9bc22ce55208641bde61a8e403f7258a01 100644
--- a/base/common/src/com/netscape/cmscore/dbs/DBSubsystem.java
+++ b/base/common/src/com/netscape/cmscore/dbs/DBSubsystem.java
@@ -408,6 +408,9 @@ public class DBSubsystem implements IDBSubsystem {
 
             LDAPEntry entry = conn.read(dn);
             LDAPAttribute attr = entry.getAttribute(PROP_NEXT_RANGE);
+            if(attr==null){
+                throw new Exception("No next range LDAPEntry available");
+            }
             nextRange = (String) attr.getStringValues().nextElement();
 
             BigInteger nextRangeNo = new BigInteger(nextRange);
diff --git a/base/common/src/com/netscape/cmscore/dbs/KeyRepository.java b/base/common/src/com/netscape/cmscore/dbs/KeyRepository.java
index 7267466277b7b0224f5521976f1af08865faa521..178b639ff94877b7d476b3910b6a49eaf6855088 100644
--- a/base/common/src/com/netscape/cmscore/dbs/KeyRepository.java
+++ b/base/common/src/com/netscape/cmscore/dbs/KeyRepository.java
@@ -251,6 +251,9 @@ public class KeyRepository extends Repository implements IKeyRepository {
      */
     public IKeyRecord readKeyRecord(BigInteger serialNo)
             throws EBaseException {
+        if(serialNo==null){
+            throw new EBaseException("Invalid Serial Number.");
+        }
         IDBSSession s = mDBService.createSession();
         KeyRecord rec = null;
 
@@ -264,6 +267,9 @@ public class KeyRepository extends Repository implements IKeyRepository {
             if (s != null)
                 s.close();
         }
+        if (rec == null) {
+            throw new EBaseException("Failed to recover Key");
+        }
         return rec;
     }
 
diff --git a/base/common/src/com/netscape/cmscore/profile/ProfileSubsystem.java b/base/common/src/com/netscape/cmscore/profile/ProfileSubsystem.java
index 53d4fa14a0614588f2cc10956e1cee3e2819bdc7..7da1cc33221c2deb9899c91b3e128e698e0b683c 100644
--- a/base/common/src/com/netscape/cmscore/profile/ProfileSubsystem.java
+++ b/base/common/src/com/netscape/cmscore/profile/ProfileSubsystem.java
@@ -96,6 +96,9 @@ public class ProfileSubsystem implements IProfileSubsystem {
             IConfigStore subStore = config.getSubStore(id);
             String classid = subStore.getString(PROP_CLASS_ID);
             IPluginInfo info = registry.getPluginInfo("profile", classid);
+            if (info == null) {
+                throw new EBaseException("No plugins for type : profile with id " + classid);
+            }
             String configPath = subStore.getString(PROP_CONFIG);
 
             CMS.debug("Start Profile Creation - " + id + " " + classid + " " + info.getClassName());
diff --git a/base/common/src/com/netscape/cmscore/request/ARequestQueue.java b/base/common/src/com/netscape/cmscore/request/ARequestQueue.java
index 0a156b003eac2c1b30cf7a634ffb6fe7a080dd3c..df68abfef9a9a6242a3601aee06b5a07b48bb647 100644
--- a/base/common/src/com/netscape/cmscore/request/ARequestQueue.java
+++ b/base/common/src/com/netscape/cmscore/request/ARequestQueue.java
@@ -588,9 +588,15 @@ public abstract class ARequestQueue
 
                 complete = true;
             } else if (rs == RequestStatus.APPROVED) {
-                boolean svcComplete;
+                boolean svcComplete=false;
 
-                svcComplete = mService.serviceRequest(r);
+                try {
+                    svcComplete = mService.serviceRequest(r);
+                } catch (CertificateException e) {
+                    // TODO Auto-generated catch block
+                    e.printStackTrace();
+                    throw new EBaseException("Cannot service the Request.");
+                }
 
                 // Completed requests call the notifier and are done. Others
                 // wait for the serviceComplete call.
diff --git a/base/common/test/com/netscape/certsrv/authentication/AuthTokenTest.java b/base/common/test/com/netscape/certsrv/authentication/AuthTokenTest.java
index fab809badaaed09a9124dc9517cb34a984f1e51e..f81f790fc492f5040166226a8e028ebf10b7308f 100644
--- a/base/common/test/com/netscape/certsrv/authentication/AuthTokenTest.java
+++ b/base/common/test/com/netscape/certsrv/authentication/AuthTokenTest.java
@@ -109,7 +109,7 @@ public class AuthTokenTest extends CMSBaseTestCase {
         assertFalse(authToken.set("key4", (BigInteger[]) null));
     }
 
-    public void testGetSetDate() {
+    public void testGetSetDate() throws Exception {
         Date value = new Date();
         authToken.set("key", value);
         assertEquals(String.valueOf(value.getTime()),
@@ -118,6 +118,9 @@ public class AuthTokenTest extends CMSBaseTestCase {
 
         authToken.set("key2", "234567");
         Date retval = authToken.getInDate("key2");
+        if (retval == null) {
+            throw new Exception("Null InDate for AuthToken key2");
+        }
         assertEquals(234567L, retval.getTime());
 
         authToken.set("key3", "oops");
@@ -137,6 +140,9 @@ public class AuthTokenTest extends CMSBaseTestCase {
 
         assertFalse(cmsStub.aToBCalled);
         String[] retval = authToken.getInStringArray("key");
+        if(retval==null){
+            throw new IOException();
+        }
         assertTrue(cmsStub.aToBCalled);
         assertEquals(4, retval.length);
         assertEquals(value[0], retval[0]);
@@ -193,7 +199,7 @@ public class AuthTokenTest extends CMSBaseTestCase {
         assertFalse(authToken.set("key3", (CertificateExtensions) null));
     }
 
-    public void testGetSetCertificates() throws CertificateException {
+    public void testGetSetCertificates() throws CertificateException, IOException {
         X509CertImpl cert1 = getFakeCert();
         X509CertImpl cert2 = getFakeCert();
         X509CertImpl[] certArray = new X509CertImpl[] { cert1, cert2 };
@@ -216,7 +222,7 @@ public class AuthTokenTest extends CMSBaseTestCase {
         assertFalse(authToken.set("key2", (Certificates) null));
     }
 
-    public void testGetSetByteArrayArray() {
+    public void testGetSetByteArrayArray() throws IOException {
         byte[][] value = new byte[][] {
                 new byte[] { 1, 2, 3, 4 },
                 new byte[] { 12, 13, 14 },
diff --git a/base/common/test/com/netscape/cmscore/dbs/DBSubsystemDefaultStub.java b/base/common/test/com/netscape/cmscore/dbs/DBSubsystemDefaultStub.java
index fe19159d5dc70f193ff8121931021b5b470d94e2..396121b294b284db6159c52c6ca283aa236ba9a2 100644
--- a/base/common/test/com/netscape/cmscore/dbs/DBSubsystemDefaultStub.java
+++ b/base/common/test/com/netscape/cmscore/dbs/DBSubsystemDefaultStub.java
@@ -7,7 +7,6 @@ import netscape.ldap.LDAPConnection;
 import com.netscape.certsrv.base.EBaseException;
 import com.netscape.certsrv.base.IConfigStore;
 import com.netscape.certsrv.base.ISubsystem;
-import com.netscape.certsrv.dbs.EDBException;
 import com.netscape.certsrv.dbs.IDBRegistry;
 import com.netscape.certsrv.dbs.IDBSSession;
 import com.netscape.certsrv.dbs.IDBSubsystem;
@@ -25,7 +24,7 @@ public class DBSubsystemDefaultStub implements IDBSubsystem {
         return null;
     }
 
-    public IDBSSession createSession() throws EDBException {
+    public IDBSSession createSession() {
         return null;
     }
 
diff --git a/base/common/test/com/netscape/cmscore/test/CMSBaseTestCase.java b/base/common/test/com/netscape/cmscore/test/CMSBaseTestCase.java
index d3971afd4753dfde1ec25113d8aa488cee56fafa..007ccafcb07b25f4808af633c4434f4dc0d3c6a0 100644
--- a/base/common/test/com/netscape/cmscore/test/CMSBaseTestCase.java
+++ b/base/common/test/com/netscape/cmscore/test/CMSBaseTestCase.java
@@ -7,7 +7,6 @@ import netscape.security.x509.X509CertImpl;
 
 import com.netscape.certsrv.app.CMSEngineDefaultStub;
 import com.netscape.certsrv.apps.CMS;
-import com.netscape.certsrv.dbs.EDBException;
 import com.netscape.certsrv.dbs.IDBRegistry;
 import com.netscape.certsrv.dbs.IDBSSession;
 import com.netscape.certsrv.logging.ILogger;
@@ -88,7 +87,7 @@ public abstract class CMSBaseTestCase extends TestCase {
     }
 
     class DBSubsystemStub extends DBSubsystemDefaultStub {
-        public IDBSSession createSession() throws EDBException {
+        public IDBSSession createSession() {
             return session;
         }
 
diff --git a/base/java-tools/src/com/netscape/cmstools/DRMTool.java b/base/java-tools/src/com/netscape/cmstools/DRMTool.java
index efd83e892deca14210ce35c865ea344448c6cd02..0eaf26ee10b58c6be004b8e0316d9ec5105b81b5 100644
--- a/base/java-tools/src/com/netscape/cmstools/DRMTool.java
+++ b/base/java-tools/src/com/netscape/cmstools/DRMTool.java
@@ -1642,7 +1642,9 @@ public class DRMTool {
                              new FileReader(
                                      mSourcePKISecurityDatabasePwdfile));
                     pwd = in.readLine();
-
+                    if (pwd == null) {
+                        pwd = "";
+                    }
                     mPwd = new Password(pwd.toCharArray());
 
                     mSourceToken.login(mPwd);
diff --git a/base/java-tools/src/com/netscape/cmstools/OCSPClient.java b/base/java-tools/src/com/netscape/cmstools/OCSPClient.java
index fc2f081e94abd9232e6e8a351ac924dd28fcc32c..7d581fdb81f169f6d1017a418d4def630e2ade18 100644
--- a/base/java-tools/src/com/netscape/cmstools/OCSPClient.java
+++ b/base/java-tools/src/com/netscape/cmstools/OCSPClient.java
@@ -174,6 +174,9 @@ public class OCSPClient {
         ResponseData rd = basic.getResponseData();
         for (int i = 0; i < rd.getResponseCount(); i++) {
             SingleResponse rd1 = rd.getResponseAt(i);
+            if (rd1 == null) {
+                throw new Exception("No OCSP Response data.");
+            }
             System.out.println("CertID.serialNumber=" +
                     rd1.getCertID().getSerialNumber());
             CertStatus status1 = rd1.getCertStatus();
diff --git a/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java b/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java
index ad1c485c0b963bc2675c30c367aeef6ae4262889..53250586738efcac63c8cb6a27b574cf5e9fba44 100644
--- a/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java
+++ b/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java
@@ -224,6 +224,9 @@ public class PKCS12Export {
         try {
             BufferedReader in = new BufferedReader(new FileReader(pwdfile));
             pwd = in.readLine();
+            if (pwd == null) {
+                pwd = "";
+            }
         } catch (Exception e) {
             debug("Failed to read the keydb password from the file. Exception: " + e.toString());
             System.exit(1);
@@ -233,6 +236,9 @@ public class PKCS12Export {
         try {
             BufferedReader in = new BufferedReader(new FileReader(pk12pwdfile));
             pk12pwd = in.readLine();
+            if (pk12pwd == null) {
+                pk12pwd = "";
+            }
         } catch (Exception e) {
             debug("Failed to read the keydb password from the file. Exception: " + e.toString());
             System.exit(1);
diff --git a/base/kra/src/com/netscape/kra/KRAService.java b/base/kra/src/com/netscape/kra/KRAService.java
index 987d17b6b7f48b258806f03ddaee53aca35a23aa..f5d709c93796a0c67477d98c566722585024442e 100644
--- a/base/kra/src/com/netscape/kra/KRAService.java
+++ b/base/kra/src/com/netscape/kra/KRAService.java
@@ -17,6 +17,7 @@
 // --- END COPYRIGHT BLOCK ---
 package com.netscape.kra;
 
+import java.security.cert.CertificateException;
 import java.util.Hashtable;
 
 import com.netscape.certsrv.apps.CMS;
@@ -96,6 +97,14 @@ public class KRAService implements IService {
             //	return true;
             // #546508
             return false;
+        } catch (CertificateException e) {
+            // TODO Auto-generated catch block
+            e.printStackTrace();
+            r.setExtData(IRequest.RESULT, IRequest.RES_ERROR);
+            r.setExtData(IRequest.ERROR, e);
+            //  return true;
+            // #546508
+            return false;
         }
     }
 }
diff --git a/base/kra/src/com/netscape/kra/RecoveryService.java b/base/kra/src/com/netscape/kra/RecoveryService.java
index 7fbefd77631d0c30d50e8d722eb713db62548f30..e00ff374df8cf351638776861541310e0b8ef5c9 100644
--- a/base/kra/src/com/netscape/kra/RecoveryService.java
+++ b/base/kra/src/com/netscape/kra/RecoveryService.java
@@ -20,11 +20,12 @@ package com.netscape.kra;
 import java.io.ByteArrayOutputStream;
 import java.io.CharConversionException;
 import java.math.BigInteger;
-import java.security.SecureRandom;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.security.PublicKey;
+import java.security.SecureRandom;
 import java.security.cert.CertificateEncodingException;
+import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 import java.util.Hashtable;
 import java.util.Random;
@@ -128,8 +129,9 @@ public class RecoveryService implements IService {
      * @param request recovery request
      * @return operation success or not
      * @exception EBaseException failed to serve
+     * @throws CertificateException
      */
-    public boolean serviceRequest(IRequest request) throws EBaseException {
+    public boolean serviceRequest(IRequest request) throws EBaseException, CertificateException {
 
         CryptoManager cm = null;
         IConfigStore config = null;
@@ -194,6 +196,9 @@ public class RecoveryService implements IService {
         byte pubData[] = keyRecord.getPublicKeyData();
         X509Certificate x509cert =
                 request.getExtDataInCert(ATTR_USER_CERT);
+        if (x509cert == null) {
+            throw new CertificateException("Key is Null or Could not create a certificate.");
+        }
         byte inputPubData[] = x509cert.getPublicKey().getEncoded();
 
         if (inputPubData.length != pubData.length) {
@@ -380,7 +385,7 @@ public class RecoveryService implements IService {
             throws EBaseException {
 
         CMS.debug("RecoverService: recoverKey: key to recover is RSA? "+
-            isRSA); 
+            isRSA);
 
         try {
             if (CMS.getConfigStore().getBoolean("kra.keySplitting")) {
diff --git a/base/silent/src/com/netscape/pkisilent/argparser/ArgParser.java b/base/silent/src/com/netscape/pkisilent/argparser/ArgParser.java
index 0e332500559818fb38ebe1a03946ed126abf3817..f4ea79c2b7fa8c2c8302b06f9b74915ae7d53460 100755
--- a/base/silent/src/com/netscape/pkisilent/argparser/ArgParser.java
+++ b/base/silent/src/com/netscape/pkisilent/argparser/ArgParser.java
@@ -1610,7 +1610,7 @@ public class ArgParser {
         return (rec != null) ? rec.valTypeName() : null;
     }
 
-    private Object createResultHolder(Record rec) {
+    private Object createResultHolder(Record rec) throws ArgParseException {
         if (rec.numValues == 1) {
             switch (rec.type) {
             case Record.LONG: {
@@ -1648,7 +1648,9 @@ public class ArgParser {
             }
             }
         }
-        return null; // can't happen
+
+        throw new ArgParseException("Bad parameters in the Record for Result Holder. Type :" + rec.type
+                + " ,Number of Values : " + rec.numValues); // can't happen
     }
 
     static void stringToArgs(Vector<String> vec, String s,
diff --git a/base/silent/src/com/netscape/pkisilent/common/CMSLDAP.java b/base/silent/src/com/netscape/pkisilent/common/CMSLDAP.java
index 7558dc88f58d8d4cc7222bcfd8cee219222efb60..528e48092b46d20d74fc5da12f145da62b29a64e 100644
--- a/base/silent/src/com/netscape/pkisilent/common/CMSLDAP.java
+++ b/base/silent/src/com/netscape/pkisilent/common/CMSLDAP.java
@@ -196,7 +196,7 @@ public class CMSLDAP {
 
     }
 
-    private X509Certificate getXCertificate(byte[] cpack) {
+    private X509Certificate getXCertificate(byte[] cpack) throws Exception {
 
         try {
             CertificateFactory cf = CertificateFactory.getInstance("X.509");
@@ -209,7 +209,7 @@ public class CMSLDAP {
             return the_cert;
         } catch (Exception e) {
             System.out.println("ERROR: getXCertificate " + e.toString());
-            return null;
+            throw new Exception(e.toString());
         }
 
     }
diff --git a/base/silent/src/com/netscape/pkisilent/http/HTTPClient.java b/base/silent/src/com/netscape/pkisilent/http/HTTPClient.java
index 4288530328cb5087d6b3a6c4c16a8bc0c5704ccc..7738e7d7e4b56cbf4febc5a8ddc98a815c340e77 100644
--- a/base/silent/src/com/netscape/pkisilent/http/HTTPClient.java
+++ b/base/silent/src/com/netscape/pkisilent/http/HTTPClient.java
@@ -24,7 +24,6 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.io.PrintStream;
-import java.io.UnsupportedEncodingException;
 import java.net.InetAddress;
 import java.net.Socket;
 import java.net.URLDecoder;
@@ -39,10 +38,10 @@ import org.mozilla.jss.ssl.SSLSocket;
 import org.mozilla.jss.ssl.TestCertApprovalCallback;
 import org.mozilla.jss.ssl.TestClientCertificateSelectionCallback;
 
+import com.netscape.cmsutil.util.Utils;
 import com.netscape.pkisilent.argparser.ArgParser;
 import com.netscape.pkisilent.argparser.StringHolder;
 import com.netscape.pkisilent.common.ComCrypto;
-import com.netscape.cmsutil.util.Utils;
 
 public class HTTPClient implements SSLCertificateApprovalCallback {
 
@@ -373,9 +372,8 @@ public class HTTPClient implements SSLCertificateApprovalCallback {
     // posts the given query data
     // returns HTTPResponse
     public HTTPResponse nonsslConnect(String hostname, String portnumber,
-                                String url, String query) {
+                                String url, String query) throws Exception {
 
-        boolean st = true;
         HTTPResponse hr = null;
 
         try {
@@ -430,7 +428,7 @@ public class HTTPClient implements SSLCertificateApprovalCallback {
             } catch (Exception e) {
                 System.out.println("Exception");
                 e.printStackTrace();
-                st = false;
+                throw new Exception(e.toString());
             }
 
             socket.close();
@@ -447,13 +445,10 @@ public class HTTPClient implements SSLCertificateApprovalCallback {
         catch (Exception e) {
             System.err.println("Exception: Unable to Send Request:" + e);
             e.printStackTrace();
-            st = false;
+            throw new Exception("Exception: Unable to Send Request:" + e.toString());
         }
 
-        if (!st)
-            return null;
-        else
-            return hr;
+        return hr;
     }
 
     public HTTPResponse readResponse(InputStream inputStream)
@@ -1079,7 +1074,7 @@ public class HTTPClient implements SSLCertificateApprovalCallback {
         return true;
     }
 
-    public static void main(String args[]) throws UnsupportedEncodingException {
+    public static void main(String args[]) throws Exception  {
         HTTPClient hc = new HTTPClient();
         HTTPResponse hr = null;
 
@@ -1200,7 +1195,13 @@ public class HTTPClient implements SSLCertificateApprovalCallback {
             }
         } else if (ssl != null && ssl.equalsIgnoreCase("false")) {
             // non ssl connect
-            hr = hc.nonsslConnect(cs_hostname, cs_port, uri, query);
+            try {
+                hr = hc.nonsslConnect(cs_hostname, cs_port, uri, query);
+            } catch (Exception e) {
+                // TODO Auto-generated catch block
+                e.printStackTrace();
+                throw new Exception("Non SSL Connect Failed due to :" + e.toString());
+            }
         } else {
             System.out.println("ERROR: ssl parameter is null");
             System.exit(-1);
diff --git a/base/util/src/com/netscape/cmsutil/radius/ChallengeException.java b/base/util/src/com/netscape/cmsutil/radius/ChallengeException.java
index 972f7f08427707412088eca9b61116ad3b75ff05..7ee265523472323e1c77608f4b8f6d04472ee9fa 100644
--- a/base/util/src/com/netscape/cmsutil/radius/ChallengeException.java
+++ b/base/util/src/com/netscape/cmsutil/radius/ChallengeException.java
@@ -33,11 +33,20 @@ public class ChallengeException extends Exception {
     }
 
     public String getState() {
-        return ((StateAttribute) (_res.getAttributeSet().getAttributeByType(Attribute.STATE))).getString();
+        StateAttribute state = (StateAttribute) _res.getAttributeSet().getAttributeByType(
+                Attribute.STATE);
+        if (state != null) {
+            return state.getString();
+        }
+        return "";
     }
 
     public String getReplyMessage() {
-        return ((ReplyMessageAttribute) (_res.getAttributeSet().getAttributeByType(Attribute.REPLY_MESSAGE)))
-                .getString();
+        ReplyMessageAttribute replyMsg = (ReplyMessageAttribute) _res.getAttributeSet().getAttributeByType(
+                Attribute.REPLY_MESSAGE);
+        if (replyMsg != null) {
+            return replyMsg.getString();
+        }
+        return "";
     }
 }
diff --git a/base/util/src/com/netscape/cmsutil/radius/RejectException.java b/base/util/src/com/netscape/cmsutil/radius/RejectException.java
index f312ef2a469291525a9f92241cc835cef27aab43..77fe3920f22444f3f98b7bb9923b42ec25e086fa 100644
--- a/base/util/src/com/netscape/cmsutil/radius/RejectException.java
+++ b/base/util/src/com/netscape/cmsutil/radius/RejectException.java
@@ -33,7 +33,11 @@ public class RejectException extends Exception {
     }
 
     public String getReplyMessage() {
-        return ((ReplyMessageAttribute) (_res.getAttributeSet().getAttributeByType(Attribute.REPLY_MESSAGE)))
-                .getString();
+        ReplyMessageAttribute replyMsg = (ReplyMessageAttribute) _res.getAttributeSet().getAttributeByType(
+                Attribute.REPLY_MESSAGE);
+        if (replyMsg != null) {
+            return replyMsg.getString();
+        }
+        return "";
     }
 }
diff --git a/base/util/src/netscape/security/extensions/NSCertTypeExtension.java b/base/util/src/netscape/security/extensions/NSCertTypeExtension.java
index 22197be9b51799dfae37455166dda85d057fa3ce..1a240f1ce3d0221792741e9191e307549761fa8a 100644
--- a/base/util/src/netscape/security/extensions/NSCertTypeExtension.java
+++ b/base/util/src/netscape/security/extensions/NSCertTypeExtension.java
@@ -24,6 +24,7 @@ import java.security.cert.CertificateException;
 import java.util.Enumeration;
 import java.util.Vector;
 
+import netscape.security.util.BitArray;
 import netscape.security.util.DerOutputStream;
 import netscape.security.util.DerValue;
 import netscape.security.util.ObjectIdentifier;
@@ -241,8 +242,11 @@ public class NSCertTypeExtension extends Extension implements CertAttrSet {
 
         this.extensionValue = extValue;
         DerValue val = new DerValue(extValue);
-
-        this.mBitString = val.getUnalignedBitString().toByteArray();
+        BitArray bitArray = val.getUnalignedBitString();
+        if (bitArray == null) {
+            throw new IOException("Invalid Encoded DER Value");
+        }
+        this.mBitString = bitArray.toByteArray();
     }
 
     /**
diff --git a/base/util/src/netscape/security/util/DerInputBuffer.java b/base/util/src/netscape/security/util/DerInputBuffer.java
index 429bf4d6a52c82ffe16ceea2fc6ea7f1b88e384d..466e64906c0dc9676b014d39f6e929cf7045d1ef 100644
--- a/base/util/src/netscape/security/util/DerInputBuffer.java
+++ b/base/util/src/netscape/security/util/DerInputBuffer.java
@@ -52,10 +52,10 @@ class DerInputBuffer extends ByteArrayInputStream implements Cloneable {
         }
     }
 
-    byte[] toByteArray() {
+    byte[] toByteArray() throws Exception {
         int len = available();
         if (len <= 0)
-            return null;
+            throw new Exception("No Buffer Space Available.");
         byte[] retval = new byte[len];
 
         System.arraycopy(buf, pos, retval, 0, len);
diff --git a/base/util/src/netscape/security/util/DerInputStream.java b/base/util/src/netscape/security/util/DerInputStream.java
index b8c1c8c93b60f03f09de9767c230d48e807c4a75..1d33149957fd9202af0cf300edb7ce098f0da1d0 100644
--- a/base/util/src/netscape/security/util/DerInputStream.java
+++ b/base/util/src/netscape/security/util/DerInputStream.java
@@ -112,8 +112,9 @@ public class DerInputStream {
     /**
      * Return what has been written to this DerInputStream
      * as a byte array. Useful for debugging.
+     * @throws Exception
      */
-    public byte[] toByteArray() {
+    public byte[] toByteArray() throws Exception {
         return buffer.toByteArray();
     }
 
diff --git a/base/util/src/netscape/security/x509/IssuingDistributionPointExtension.java b/base/util/src/netscape/security/x509/IssuingDistributionPointExtension.java
index 67ace692e5b82807259e610fa71f97d13c5845a3..4af8d19626c3599d7680e33ebe9dc4bacb039362 100644
--- a/base/util/src/netscape/security/x509/IssuingDistributionPointExtension.java
+++ b/base/util/src/netscape/security/x509/IssuingDistributionPointExtension.java
@@ -195,6 +195,9 @@ public class IssuingDistributionPointExtension extends Extension
                                 opt.resetTag(DerValue.tag_BitString);
                                 try {
                                     BitArray reasons = opt.getUnalignedBitString();
+                                    if (reasons == null) {
+                                        throw new IOException();
+                                    }
                                     issuingDistributionPoint.setOnlySomeReasons(reasons);
 
                                     @SuppressWarnings("unused")
diff --git a/base/util/test/com/netscape/security/util/JSSUtil.java b/base/util/test/com/netscape/security/util/JSSUtil.java
index bbbabbf14fb10f89e6de2f5bd85c7e93294878ba..7e5624e1ee715fb6715d2ff8f8cf060e37d8b37b 100644
--- a/base/util/test/com/netscape/security/util/JSSUtil.java
+++ b/base/util/test/com/netscape/security/util/JSSUtil.java
@@ -68,6 +68,10 @@ public class JSSUtil {
         default:
             throw new Exception("Unsupported tag: " + tag);
         }
-        return ASN1Util.decode(new Tag(Tag.UNIVERSAL, tag), template, bytes).toString();
+        ASN1Value asnValue=ASN1Util.decode(new Tag(Tag.UNIVERSAL, tag), template, bytes);
+        if(asnValue==null){
+            throw new Exception("Cannot decode the given template.");
+        }
+        return asnValue.toString();
     }
 }
-- 
1.7.10.2

