using org.bouncycastle.asn1.ASN1Primitive.fromByteArray throw malformed integer error

[jeffreyHZ]

my code （bc1.60)
###################################################

String asn1DerStr = "MEUCIAAldUKhWOntPOtkLTasILDsO/yb856xuqRjhj7GYmBTAiEA5SwutrNtbjT2jb2K75boVtkXtN9NoO6FwN9UYMTF9h0=";
        byte[] signature = Base64.decode(asn1DerStr);

        // using sun.security.util.DerInputStream
        DerInputStream din=new DerInputStream(signature);
        DerValue[] value=din.getSequence(0);

        DerInputStream din1=new DerInputStream(value[0].toByteArray());

        System.out.println("BigInteger R:"+din1.getBigInteger());

        DerInputStream din2=new DerInputStream(value[1].toByteArray());

        System.out.println("BigInteger S:"+din2.getBigInteger());

        // using org.bouncycastle.asn1.ASN1Primitive.fromByteArray 
       //  thorw  java.lang.IllegalArgumentException: malformed integer error**

       ASN1Primitive.fromByteArray(Base64.decode(asn1DerStr));

####################################################

BigInteger R:66182642067710712729877272665458700927967223008706446127699131494534635603
BigInteger S:103657706002356414938841938896517993175947319776915171052666044982301919933981
Exception in thread "main" org.bouncycastle.asn1.ASN1Exception: corrupted stream detected
at org.bouncycastle.asn1.ASN1InputStream.readObject(Unknown Source)
at org.bouncycastle.asn1.ASN1InputStream.buildEncodableVector(Unknown Source)
at org.bouncycastle.asn1.ASN1InputStream.buildDEREncodableVector(Unknown Source)
at org.bouncycastle.asn1.ASN1InputStream.buildObject(Unknown Source)
at org.bouncycastle.asn1.ASN1InputStream.readObject(Unknown Source)
at org.bouncycastle.asn1.ASN1Primitive.fromByteArray(Unknown Source)
at com.szca.caau.webservice.test.CasCertVerifyDemo.parseSignature(CasCertVerifyDemo.java:32)
at com.szca.caau.webservice.test.CasCertVerifyDemo.main(CasCertVerifyDemo.java:40)
Caused by: java.lang.IllegalArgumentException: malformed integer
at org.bouncycastle.asn1.ASN1Integer.(Unknown Source)
at org.bouncycastle.asn1.ASN1InputStream.createPrimitiveDERObject(Unknown Source)
at org.bouncycastle.asn1.ASN1InputStream.buildObject(Unknown Source)
... 8 more

[peterdettman]

ASN.1 signature data: 3045022000257542a158e9ed3ceb642d36ac20b0ec3bfc9bf39eb1baa463863ec6626053022100e52c2eb6b36d6e34f68dbd8aef96e856d917b4df4da0ee85c0df5460c4c5f61d

i.e.:

3045 // Sequence with 69 content bytes:
    0220 // Integer with 32 content bytes ('R'):
        00257542a158e9ed3ceb642d36ac20b0ec3bfc9bf39eb1baa463863ec6626053
    0221 // Integer with 33 content bytes ('S'):
        00e52c2eb6b36d6e34f68dbd8aef96e856d917b4df4da0ee85c0df5460c4c5f61d

The encoding of 'R' is malformed because the leading '00' byte is redundant with the sign bit of the following byte '25'. See X.690, section 8.3.2:

If the contents octets of an integer value encoding consist of more than one octet, then the bits of the first octet and bit 8 of the second octet:
a) shall not all be ones; and
b) shall not all be zero.
NOTE – These rules ensure that an integer value is always encoded in the smallest possible number of octets.

Ideally you would fix the software that is generating the malformed ASN.1, and/or inform the authors if it is third party software. If you have no other choice, we support a system property to ignore this sort of error:
org.bouncycastle.asn1.allow_unsafe_integer="true"

or, if possible, only set that property (thread-)locally around the problem code using org.bouncycastle.util.Properties.setThreadOverride/removeThreadOverride.