>From 3af781fe4c1e77f4d0902ab833bdbfb7135e4a52 Mon Sep 17 00:00:00 2001
From: Abhishek Koneru <akoneru@redhat.com>
Date: Thu, 31 May 2012 17:04:47 -0400
Subject: [PATCH] Fixes for Null_Returns Cases

---
 base/ca/src/com/netscape/ca/CAService.java         |    3 +
 base/ca/src/com/netscape/ca/CRLIssuingPoint.java   |   28 ++++++---
 .../src/com/netscape/certsrv/util/StatsEvent.java  |    3 +-
 .../cmscore/authorization/AuthzSubsystem.java      |    4 +-
 .../cmscore/cert/CrossCertPairSubsystem.java       |    6 ++
 .../netscape/cmscore/connector/HttpPKIMessage.java |    5 +-
 .../cmscore/connector/RequestTransfer.java         |    3 +
 .../src/com/netscape/cmscore/dbs/DBRegistry.java   |    3 +
 .../netscape/cmscore/ldap/LdapPredicateParser.java |   10 +++-
 .../netscape/cmscore/ldap/PublisherProcessor.java  |   54 +++++++++---------
 .../com/netscape/cmscore/logging/LogSubsystem.java |    3 +-
 .../cmscore/policy/PolicyPredicateParser.java      |   13 +++--
 .../netscape/cmscore/security/CertificateInfo.java |    2 +-
 .../com/netscape/cmscore/usrgrp/UGSubsystem.java   |   60 ++++++++++++++++++++
 .../src/com/netscape/kra/EnrollmentService.java    |    7 ++-
 .../src/com/netscape/cmsutil/http/HttpMessage.java |    2 +-
 .../netscape/security/util/PrettyPrintFormat.java  |    6 +-
 .../netscape/security/x509/KeyUsageExtension.java  |    6 +-
 18 files changed, 169 insertions(+), 49 deletions(-)

diff --git a/base/ca/src/com/netscape/ca/CAService.java b/base/ca/src/com/netscape/ca/CAService.java
index 21702d90c0fee4be178ea670cc75bec16967fc86..5fb749b5e61a41fb87a105b670dac3f358364487 100755
--- a/base/ca/src/com/netscape/ca/CAService.java
+++ b/base/ca/src/com/netscape/ca/CAService.java
@@ -1500,6 +1500,9 @@ class getCertsForChallenge implements IServant {
             throws EBaseException {
         BigInteger[] serialNoArray =
                 request.getExtDataInBigIntegerArray(CAService.SERIALNO_ARRAY);
+        if (serialNoArray == null) {
+            throw new EBaseException("No Serial Numbers for fetching the certificates");
+        }
         X509CertImpl[] certs = new X509CertImpl[serialNoArray.length];
 
         for (int i = 0; i < serialNoArray.length; i++) {
diff --git a/base/ca/src/com/netscape/ca/CRLIssuingPoint.java b/base/ca/src/com/netscape/ca/CRLIssuingPoint.java
index ff61970f90f554b5a2cba853786ae417a0d9cfa1..3f7dfc8d1157b3d2c695b4f66c93c04ab570bda6 100755
--- a/base/ca/src/com/netscape/ca/CRLIssuingPoint.java
+++ b/base/ca/src/com/netscape/ca/CRLIssuingPoint.java
@@ -1926,19 +1926,27 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable {
                 if (IRequest.REVOCATION_REQUEST.equals(request.getRequestType())) {
                     RevokedCertImpl revokedCert[] =
                             request.getExtDataInRevokedCertArray(IRequest.CERT_INFO);
-                    for (int j = 0; j < revokedCert.length; j++) {
-                        if (Debug.on()) {
-                            Debug.trace("recoverCRLCache R j=" + j + "  length=" + revokedCert.length +
+                    if (revokedCert != null) {
+                        for (int j = 0; j < revokedCert.length; j++) {
+                            if (Debug.on()) {
+                                Debug.trace("recoverCRLCache R j=" + j + "  length=" + revokedCert.length +
                                         "  SerialNumber=0x" + revokedCert[j].getSerialNumber().toString(16));
+                            }
+                            if (cp != null)
+                                includeCert = cp.checkRevokedCertExtensions(revokedCert[j].getExtensions());
+                            if (includeCert) {
+                                updateRevokedCert(REVOKED_CERT, revokedCert[j].getSerialNumber(), revokedCert[j]);
+                            }
                         }
-                        if (cp != null)
-                            includeCert = cp.checkRevokedCertExtensions(revokedCert[j].getExtensions());
-                        if (includeCert) {
-                            updateRevokedCert(REVOKED_CERT, revokedCert[j].getSerialNumber(), revokedCert[j]);
+                    } else {
+                        if (Debug.on()) {
+                            Debug.trace("Revocation Request : Revoked Certificates is a Null or has Invalid Values");
                         }
+                        log(ILogger.LL_FAILURE, "Revoked Certificates is a Null or has Invalid Values");
                     }
                 } else if (IRequest.UNREVOCATION_REQUEST.equals(request.getRequestType())) {
                     BigInteger serialNo[] = request.getExtDataInBigIntegerArray(IRequest.OLD_SERIALS);
+                    if(serialNo !=null){
                     for (int j = 0; j < serialNo.length; j++) {
                         if (Debug.on()) {
                             Debug.trace("recoverCRLCache U j=" + j + "  length=" + serialNo.length +
@@ -1946,6 +1954,12 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable {
                         }
                         updateRevokedCert(UNREVOKED_CERT, serialNo[j], null);
                     }
+                    }else{
+                        if (Debug.on()) {
+                            Debug.trace("Unrevocation Request : Serial Numbers is a Null or has Invalid Values");
+                        }
+                        log(ILogger.LL_FAILURE, "Unrevocation Request : Serial Numbers is a Null or has Invalid Values");
+                    }
                 }
             }
 
diff --git a/base/common/src/com/netscape/certsrv/util/StatsEvent.java b/base/common/src/com/netscape/certsrv/util/StatsEvent.java
index 3ee6e0d307336091a0571a4e7021730db01de80f..44f209c2c586ed963adb9e49b591d5e5faf49e07 100755
--- a/base/common/src/com/netscape/certsrv/util/StatsEvent.java
+++ b/base/common/src/com/netscape/certsrv/util/StatsEvent.java
@@ -93,7 +93,8 @@ public class StatsEvent {
         while (e.hasMoreElements()) {
             String n = e.nextElement();
             StatsEvent c = getSubEvent(n);
-            c.resetCounters();
+            if (c != null)
+                c.resetCounters();
         }
     }
 
diff --git a/base/common/src/com/netscape/cmscore/authorization/AuthzSubsystem.java b/base/common/src/com/netscape/cmscore/authorization/AuthzSubsystem.java
index 4ad6db52856394f3dfebf2756960be8235aee0e4..2c092f91c14dd5da976d63c6b8749f93bba86949 100755
--- a/base/common/src/com/netscape/cmscore/authorization/AuthzSubsystem.java
+++ b/base/common/src/com/netscape/cmscore/authorization/AuthzSubsystem.java
@@ -421,8 +421,8 @@ public class AuthzSubsystem implements IAuthzSubsystem {
             //String infoMsg =
             //        "Shutting down authz manager instance " + mgr.getName();
             //log(ILogger.LL_INFO, infoMsg);
-
-            mgr.shutdown();
+            if (mgr != null)
+                mgr.shutdown();
         }
         mAuthzMgrPlugins.clear();
         mAuthzMgrInsts.clear();
diff --git a/base/common/src/com/netscape/cmscore/cert/CrossCertPairSubsystem.java b/base/common/src/com/netscape/cmscore/cert/CrossCertPairSubsystem.java
index 1aa53d9e4b00d4eaccaed7182b975893e2ee4b64..ff14f07611a32727ed11a0285b2da2675f198914 100755
--- a/base/common/src/com/netscape/cmscore/cert/CrossCertPairSubsystem.java
+++ b/base/common/src/com/netscape/cmscore/cert/CrossCertPairSubsystem.java
@@ -188,6 +188,9 @@ public class CrossCertPairSubsystem implements ICrossCertPairSubsystem {
 
         try {
             conn = getConn();
+            if (conn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
             LDAPSearchResults res = conn.search(mBaseDN, LDAPv2.SCOPE_SUB,
                     DN_XCERTS, null, false);
 
@@ -399,6 +402,9 @@ public class CrossCertPairSubsystem implements ICrossCertPairSubsystem {
 
         try {
             conn = getConn();
+            if (conn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
             // search in internal db for xcerts
             LDAPSearchResults res = conn.search(mBaseDN, LDAPv2.SCOPE_SUB,
                     DN_XCERTS, null, false);
diff --git a/base/common/src/com/netscape/cmscore/connector/HttpPKIMessage.java b/base/common/src/com/netscape/cmscore/connector/HttpPKIMessage.java
index ddf23378ae924c8a00457d3143f70e1a63f2b5ce..220a527eeb9a8ea6d1fc806290a7435c249b128e 100755
--- a/base/common/src/com/netscape/cmscore/connector/HttpPKIMessage.java
+++ b/base/common/src/com/netscape/cmscore/connector/HttpPKIMessage.java
@@ -73,7 +73,10 @@ public class HttpPKIMessage implements IHttpPKIMessage {
                 + r.getRequestId().toString() + " requestStatus=" + reqStatus + " instance=" + r);
 
         String attrs[] = RequestTransfer.getTransferAttributes(r);
-        int len = attrs.length;
+        int len = 0;
+        if (attrs != null)
+            len = attrs.length;
+
         String[] names = attrs;
         Object value = null;
 
diff --git a/base/common/src/com/netscape/cmscore/connector/RequestTransfer.java b/base/common/src/com/netscape/cmscore/connector/RequestTransfer.java
index baf076422628b3d9b82be4396170df126d596a69..7e756b0f46a20f5602bfc30605965a248ac44c39 100755
--- a/base/common/src/com/netscape/cmscore/connector/RequestTransfer.java
+++ b/base/common/src/com/netscape/cmscore/connector/RequestTransfer.java
@@ -107,6 +107,9 @@ public class RequestTransfer {
                 src.getRequestId().toString() +
                 " destId=" + dest.getRequestId().toString());
         String attrs[] = getTransferAttributes(src);
+        if (attrs == null) {
+            return;
+        }
 
         for (int i = 0; i < attrs.length; i++) {
             String key = attrs[i];
diff --git a/base/common/src/com/netscape/cmscore/dbs/DBRegistry.java b/base/common/src/com/netscape/cmscore/dbs/DBRegistry.java
index 63b00b6bfaeaf16dc2ebfe37e935d24065e6220e..67ec3e6d8d608f1aac58f6e668f679fc07dab86f 100755
--- a/base/common/src/com/netscape/cmscore/dbs/DBRegistry.java
+++ b/base/common/src/com/netscape/cmscore/dbs/DBRegistry.java
@@ -460,6 +460,9 @@ public class DBRegistry implements IDBRegistry, ISubsystem {
             throws EBaseException {
         // map object class attribute to object
         LDAPAttribute attr = attrs.getAttribute("objectclass");
+        if (attr == null) {
+            throw new EBaseException("Cannot fing Object Class to create the Object");
+        }
 
         //CMS.debug("createObject: attrs " + attrs.toString());
 
diff --git a/base/common/src/com/netscape/cmscore/ldap/LdapPredicateParser.java b/base/common/src/com/netscape/cmscore/ldap/LdapPredicateParser.java
index b0505c16b28df6262dde983d8dcf8b7617228cbf..51b69a42225afb38ddd48442801b7ba8e0be2136 100755
--- a/base/common/src/com/netscape/cmscore/ldap/LdapPredicateParser.java
+++ b/base/common/src/com/netscape/cmscore/ldap/LdapPredicateParser.java
@@ -69,9 +69,15 @@ public class LdapPredicateParser {
         // reverse-polish notation.
         String token = pt.nextToken();
 
-        if (getOP(token) != EXPRESSION) {
+        if (token != null) {
+            if (getOP(token) != EXPRESSION) {
+                if (Debug.ON)
+                    Debug.trace("Malformed expression: " + predicateExpression);
+                throw new ELdapException(CMS.getUserMessage("CMS_LDAP_BAD_LDAP_EXPRESSION", predicateExpression));
+            }
+        } else {
             if (Debug.ON)
-                Debug.trace("Malformed expression: " + predicateExpression);
+                Debug.trace("Malformed expression: Null Token");
             throw new ELdapException(CMS.getUserMessage("CMS_LDAP_BAD_LDAP_EXPRESSION", predicateExpression));
         }
         ILdapExpression current = parseExpression(token);
diff --git a/base/common/src/com/netscape/cmscore/ldap/PublisherProcessor.java b/base/common/src/com/netscape/cmscore/ldap/PublisherProcessor.java
index 62e4b8bef019a0f756d45a614377759188e5b76e..f0baad45899c7d0af51183d3e40f9ea18164b0bb 100755
--- a/base/common/src/com/netscape/cmscore/ldap/PublisherProcessor.java
+++ b/base/common/src/com/netscape/cmscore/ldap/PublisherProcessor.java
@@ -492,22 +492,23 @@ public class PublisherProcessor implements
 
             //this is the only rule we support now
             LdapRule rule = (LdapRule) (mRuleInsts.get(name));
+            if (rule.getType() != null) {
+                if (rule.enabled() && rule.getType().equals(publishingType)) {
+                    // check if the predicate match
+                    ILdapExpression exp = rule.getPredicate();
 
-            if (rule.enabled() && rule.getType().equals(publishingType)) {
-                // check if the predicate match
-                ILdapExpression exp = rule.getPredicate();
+                    try {
+                        SessionContext sc = SessionContext.getContext();
 
-                try {
-                    SessionContext sc = SessionContext.getContext();
-
-                    if (exp != null && !exp.evaluate(sc))
-                        continue;
-                } catch (Exception ex) {
-                    // do nothing
+                        if (exp != null && !exp.evaluate(sc))
+                            continue;
+                    } catch (Exception ex) {
+                        // do nothing
+                    }
+                    rules.addElement(rule);
+                    if (Debug.ON)
+                        Debug.trace("added rule " + name + " for " + publishingType);
                 }
-                rules.addElement(rule);
-                if (Debug.ON)
-                    Debug.trace("added rule " + name + " for " + publishingType);
             }
         }
         return rules.elements();
@@ -535,22 +536,23 @@ public class PublisherProcessor implements
 
             //this is the only rule we support now
             LdapRule rule = (LdapRule) (mRuleInsts.get(name));
+            if (rule.getType() != null) {
+                if (rule.enabled() && rule.getType().equals(publishingType)) {
+                    // check if the predicate match
+                    ILdapExpression exp = rule.getPredicate();
 
-            if (rule.enabled() && rule.getType().equals(publishingType)) {
-                // check if the predicate match
-                ILdapExpression exp = rule.getPredicate();
+                    try {
+                        if (exp != null && !exp.evaluate(req))
+                            continue;
+                    } catch (Exception ex) {
+                        ex.printStackTrace();
+                    }
 
-                try {
-                    if (exp != null && !exp.evaluate(req))
-                        continue;
-                } catch (Exception ex) {
-                    ex.printStackTrace();
+                    rules.addElement(rule);
+                    if (Debug.ON)
+                        Debug.trace("added rule " + name + " for " + publishingType +
+                                " request: " + req.getRequestId());
                 }
-
-                rules.addElement(rule);
-                if (Debug.ON)
-                    Debug.trace("added rule " + name + " for " + publishingType +
-                            " request: " + req.getRequestId());
             }
         }
         return rules.elements();
diff --git a/base/common/src/com/netscape/cmscore/logging/LogSubsystem.java b/base/common/src/com/netscape/cmscore/logging/LogSubsystem.java
index 9607cf892362f0b2cd6936b918ee291310333fda..a0b698016a50e057d88fe8addaf3da13dc9c4ed5 100755
--- a/base/common/src/com/netscape/cmscore/logging/LogSubsystem.java
+++ b/base/common/src/com/netscape/cmscore/logging/LogSubsystem.java
@@ -203,7 +203,8 @@ public class LogSubsystem implements ILogSubsystem {
 
         try {
             return cs.getString("pluginName", "");
-        } catch (EBaseException e) {
+        } catch (Exception e) {
+            e.printStackTrace();
             return "";
         }
     }
diff --git a/base/common/src/com/netscape/cmscore/policy/PolicyPredicateParser.java b/base/common/src/com/netscape/cmscore/policy/PolicyPredicateParser.java
index f6c01b04105147381ff988c979c68787ad65e96c..5d79c42bbdb8b2eb77dfacbce8ccbc24724b578d 100755
--- a/base/common/src/com/netscape/cmscore/policy/PolicyPredicateParser.java
+++ b/base/common/src/com/netscape/cmscore/policy/PolicyPredicateParser.java
@@ -69,11 +69,16 @@ public class PolicyPredicateParser {
         // The first token cannot be an operator. We are not dealing with
         // reverse-polish notation.
         String token = pt.nextToken();
-
-        if (getOP(token) != EXPRESSION) {
+        if (token != null) {
+            if (getOP(token) != EXPRESSION) {
+                if (Debug.ON)
+                    Debug.trace("Malformed expression: " + predicateExpression);
+                throw new EPolicyException(CMS.getUserMessage("CMS_POLICY_BAD_POLICY_EXPRESSION", predicateExpression));
+            }
+        } else {
             if (Debug.ON)
-                Debug.trace("Malformed expression: " + predicateExpression);
-            throw new EPolicyException(CMS.getUserMessage("CMS_POLICY_BAD_POLICY_EXPRESSION", predicateExpression));
+                Debug.trace("Malformed Predicate Expression : No Tokens");
+            throw new EPolicyException("Malformed Predicate Expression : No Tokens");
         }
         IExpression current = parseExpression(token);
         boolean malformed = false;
diff --git a/base/common/src/com/netscape/cmscore/security/CertificateInfo.java b/base/common/src/com/netscape/cmscore/security/CertificateInfo.java
index 9148032236872933b81cd1834866c9aa19dcacee..9a9da4f43a1925d9bed0cef038800c3f4cc72a2b 100755
--- a/base/common/src/com/netscape/cmscore/security/CertificateInfo.java
+++ b/base/common/src/com/netscape/cmscore/security/CertificateInfo.java
@@ -194,7 +194,7 @@ public abstract class CertificateInfo {
 
             AlgorithmId sigAlgId = getAlgorithmId();
 
-            if (sigAlgId == null) {
+            if ((sigAlgId == null) && (algm != null)) {
                 byte[] encodedOID = ASN1Util.encode(algm.toOID());
 
                 sigAlgId = new AlgorithmId(new ObjectIdentifier(
diff --git a/base/common/src/com/netscape/cmscore/usrgrp/UGSubsystem.java b/base/common/src/com/netscape/cmscore/usrgrp/UGSubsystem.java
index 7cca7000252a65038e6f72ac6fa8fba6095f41a8..508c7064b16d2a9671127d63672c6abe2fe991da 100755
--- a/base/common/src/com/netscape/cmscore/usrgrp/UGSubsystem.java
+++ b/base/common/src/com/netscape/cmscore/usrgrp/UGSubsystem.java
@@ -204,6 +204,9 @@ public final class UGSubsystem implements IUGSubsystem {
 
                 try {
                     ldapconn = getConn();
+                    if (ldapconn == null) {
+                        throw new LDAPException("No LDAP Connection Available");
+                    }
                     // read DN
                     LDAPSearchResults res =
                             ldapconn.search(userid,
@@ -237,6 +240,9 @@ public final class UGSubsystem implements IUGSubsystem {
 
         try {
             ldapconn = getConn();
+            if (ldapconn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
             String filter = LDAP_ATTR_USER_CERT_STRING + "=" + getCertificateString(cert);
             LDAPSearchResults res =
                     ldapconn.search(getUserBaseDN(),
@@ -287,6 +293,9 @@ public final class UGSubsystem implements IUGSubsystem {
 
         try {
             ldapconn = getConn();
+            if (ldapconn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
             LDAPSearchResults res = ldapconn.search(getUserBaseDN(),
                     LDAPv2.SCOPE_SUB, "(" + filter + ")",
                     null, false);
@@ -318,6 +327,9 @@ public final class UGSubsystem implements IUGSubsystem {
 
         try {
             ldapconn = getConn();
+            if (ldapconn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
             LDAPSearchResults res = ldapconn.search(getUserBaseDN(),
                     LDAPv2.SCOPE_SUB, "(uid=" + filter + ")",
                     null, false);
@@ -355,6 +367,9 @@ public final class UGSubsystem implements IUGSubsystem {
             attrs[1] = "cn";
 
             ldapconn = getConn();
+            if (ldapconn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
             LDAPSearchConstraints cons = new LDAPSearchConstraints();
 
             cons.setMaxResults(0);
@@ -693,6 +708,9 @@ public final class UGSubsystem implements IUGSubsystem {
 
         try {
             ldapconn = getConn();
+            if (ldapconn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
             ldapconn.add(entry);
         } catch (ELdapException e) {
             log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_USRGRP_ADD_USER", e.toString()));
@@ -735,6 +753,9 @@ public final class UGSubsystem implements IUGSubsystem {
 
             try {
                 ldapconn = getConn();
+                if (ldapconn == null) {
+                    throw new LDAPException("No LDAP Connection Available");
+                }
                 ldapconn.modify("uid=" + user.getUserID() +
                         "," + getUserBaseDN(), addCert);
                 // for audit log
@@ -882,6 +903,9 @@ public final class UGSubsystem implements IUGSubsystem {
 
                 try {
                     ldapconn = getConn();
+                    if (ldapconn == null) {
+                        throw new LDAPException("No LDAP Connection Available");
+                    }
                     ldapconn.modify("uid=" + user.getUserID() +
                             "," + getUserBaseDN(), attrs);
                     certCount++;
@@ -924,6 +948,9 @@ public final class UGSubsystem implements IUGSubsystem {
 
         try {
             ldapconn = getConn();
+            if (ldapconn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
             String groupDN = "cn=" + grp.getGroupID() +
                     "," + getGroupBaseDN();
             LDAPAttribute memberAttr = new LDAPAttribute(
@@ -956,6 +983,9 @@ public final class UGSubsystem implements IUGSubsystem {
 
         try {
             ldapconn = getConn();
+            if (ldapconn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
             ldapconn.delete("uid=" + userid + "," + getUserBaseDN());
             // for audit log
             SessionContext sessionContext = SessionContext.getContext();
@@ -998,6 +1028,9 @@ public final class UGSubsystem implements IUGSubsystem {
 
         try {
             ldapconn = getConn();
+            if (ldapconn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
             if ((st = user.getFullName()) != null) {
                 attrs.add(LDAPModification.REPLACE,
                         new LDAPAttribute("sn", st));
@@ -1115,6 +1148,9 @@ public final class UGSubsystem implements IUGSubsystem {
 
         try {
             ldapconn = getConn();
+            if (ldapconn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
             LDAPSearchResults res =
                     ldapconn.search(getGroupBaseDN(), LDAPv2.SCOPE_SUB,
                             "(&(objectclass=groupofuniquenames)(cn=" + filter + "))",
@@ -1159,6 +1195,9 @@ public final class UGSubsystem implements IUGSubsystem {
             attrs[1] = "description";
 
             ldapconn = getConn();
+            if (ldapconn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
             LDAPSearchResults res =
                     ldapconn.search(getGroupBaseDN(), LDAPv2.SCOPE_SUB,
                             "(&(objectclass=groupofuniquenames)(cn=" + filter + "))",
@@ -1273,6 +1312,9 @@ public final class UGSubsystem implements IUGSubsystem {
 
         try {
             ldapconn = getConn();
+            if (ldapconn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
             // read the group object
             LDAPSearchResults res = ldapconn.search(name,
                     LDAPConnection.SCOPE_BASE, "(objectclass=*)", null, false);
@@ -1302,6 +1344,9 @@ public final class UGSubsystem implements IUGSubsystem {
 
         try {
             ldapconn = getConn();
+            if (ldapconn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
             LDAPEntry entry = ldapconn.read(name);
             LDAPAttribute attr = entry.getAttribute(OBJECTCLASS_ATTR);
 
@@ -1374,6 +1419,9 @@ public final class UGSubsystem implements IUGSubsystem {
             attrs[0] = "cn";
 
             ldapconn = getConn();
+            if (ldapconn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
 
             String filter = "(uniquemember=" + userid + ")";
             Debug.trace("authorization search base: " + basedn);
@@ -1448,6 +1496,9 @@ public final class UGSubsystem implements IUGSubsystem {
                     "," + getGroupBaseDN(), attrs);
 
             ldapconn = getConn();
+            if (ldapconn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
             ldapconn.add(entry);
         } catch (LDAPException e) {
             log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_USRGRP_ADD_GROUP", e.toString()));
@@ -1477,6 +1528,9 @@ public final class UGSubsystem implements IUGSubsystem {
 
         try {
             ldapconn = getConn();
+            if (ldapconn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
             ldapconn.delete("cn=" + name + "," + getGroupBaseDN());
         } catch (LDAPException e) {
             log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_USRGRP_REMOVE_GROUP", e.toString()));
@@ -1531,6 +1585,9 @@ public final class UGSubsystem implements IUGSubsystem {
             }
 
             ldapconn = getConn();
+            if (ldapconn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
             ldapconn.modify("cn=" + grp.getGroupID() +
                     "," + getGroupBaseDN(), mod);
         } catch (LDAPException e) {
@@ -1579,6 +1636,9 @@ public final class UGSubsystem implements IUGSubsystem {
 
         try {
             ldapconn = getConn();
+            if (ldapconn == null) {
+                throw new LDAPException("No LDAP Connection Available");
+            }
             LDAPSearchResults res = ldapconn.search(getUserBaseDN(),
                     LDAPv2.SCOPE_SUB, "(uid=" + u + ")", null, false);
 
diff --git a/base/kra/src/com/netscape/kra/EnrollmentService.java b/base/kra/src/com/netscape/kra/EnrollmentService.java
index c881decdfb305d3a71638979207849aa3dcee579..89f47c9a3984ff1eba27c06b8f71aeb05a066b6f 100755
--- a/base/kra/src/com/netscape/kra/EnrollmentService.java
+++ b/base/kra/src/com/netscape/kra/EnrollmentService.java
@@ -734,7 +734,9 @@ public class EnrollmentService implements IService {
         X509CertInfo certInfo[] =
                 request.getExtDataInCertInfoArray(IRequest.CERT_INFO);
         CertificateX509Key pX509Key = null;
-
+        if (certInfo == null) {
+            throw new EBaseException("Invalid or NULL Certificates found");
+        }
         try {
             pX509Key = (CertificateX509Key)
                     certInfo[i].get(X509CertInfo.KEY);
@@ -785,6 +787,9 @@ public class EnrollmentService implements IService {
 
         X509CertInfo certInfo[] =
                 request.getExtDataInCertInfoArray(IRequest.CERT_INFO);
+        if (certInfo == null) {
+            throw new EBaseException("Invalid or NULL Certificates found");
+        }
         CertificateSubjectName pSub = null;
 
         try {
diff --git a/base/util/src/com/netscape/cmsutil/http/HttpMessage.java b/base/util/src/com/netscape/cmsutil/http/HttpMessage.java
index 398f384008419f42a8f74e055f9c26bbe7df0853..468539b8ee2d497b570d7b2966c146d2ec361954 100755
--- a/base/util/src/com/netscape/cmsutil/http/HttpMessage.java
+++ b/base/util/src/com/netscape/cmsutil/http/HttpMessage.java
@@ -122,7 +122,7 @@ public class HttpMessage {
         //        if (line == null) {
         //           throw new HttpEofException("End of stream reached");
         //      }
-        if (line.equals("")) {
+        if (line == null || line.equals("")) {
             throw new HttpProtocolException("Bad Http req/resp line " + line);
         }
         mLine = line;
diff --git a/base/util/src/netscape/security/util/PrettyPrintFormat.java b/base/util/src/netscape/security/util/PrettyPrintFormat.java
index 4bbc87936423b91f2fa538ee9ce200e7dd597ade..4df4473d07ad6e18302f38e2f81f430acf76e624 100755
--- a/base/util/src/netscape/security/util/PrettyPrintFormat.java
+++ b/base/util/src/netscape/security/util/PrettyPrintFormat.java
@@ -106,6 +106,10 @@ public class PrettyPrintFormat {
         int hexCount = 0;
         char c[];
         int j = 0;
+        int len = 0;
+        if (in != null) {
+            len = in.length;
+        }
 
         if (lineLen == 0) {
             c = new char[in.length * 3 + 1];
@@ -116,7 +120,7 @@ public class PrettyPrintFormat {
         char sep = separator.charAt(0);
 
         sb.append(indent(indentSize));
-        for (int i = 0; i < in.length; i++) {
+        for (int i = 0; i < len; i++) {
             if (lineLen > 0 && hexCount == lineLen) {
                 c[j++] = '\n';
                 sb.append(c, 0, j);
diff --git a/base/util/src/netscape/security/x509/KeyUsageExtension.java b/base/util/src/netscape/security/x509/KeyUsageExtension.java
index 15bf29b839abf8c00f159c8b7852ef764d9fa3cf..96b5fe367aa8edd5b09d42a71adf88d03ea15f03 100755
--- a/base/util/src/netscape/security/x509/KeyUsageExtension.java
+++ b/base/util/src/netscape/security/x509/KeyUsageExtension.java
@@ -210,7 +210,11 @@ public class KeyUsageExtension extends Extension
         }
         this.extensionValue = extValue;
         DerValue val = new DerValue(extValue);
-        this.bitString = val.getUnalignedBitString().toBooleanArray();
+        try {
+            this.bitString = val.getUnalignedBitString().toBooleanArray();
+        } catch (Exception e) {
+            this.bitString = null;
+        }
     }
 
     /**
-- 
1.7.10.2

