Don't double release ByteBuf when parsing of the X509Certificate fails (#8457)

Motivation:

Due a bug in our implementation we tried to release the same ByteBuf two times when we failed to parse the X509Certificate as closing the ByteBufInputStream already closed it.

Modifications:

- Don't close the ByteBuf when closing the ByteBufInputStream
- Explicit release all ByteBufs after we are done parsing in a finally block.
- Add testcase.

Result:

Do not produce an IllegalReferenceCountException and throw the correct CertificateException.

handler/src/main/java/io/netty/handler/ssl/SslContext.java

@@ -1082,10 +1082,9 @@ public abstract class SslContext {
         CertificateFactory cf = CertificateFactory.getInstance("X.509");
         X509Certificate[] x509Certs = new X509Certificate[certs.length];
 
-        int i = 0;
         try {
-            for (; i < certs.length; i++) {
-                InputStream is = new ByteBufInputStream(certs[i], true);
+            for (int i = 0; i < certs.length; i++) {
+                InputStream is = new ByteBufInputStream(certs[i], false);
                 try {
                     x509Certs[i] = (X509Certificate) cf.generateCertificate(is);
                 } finally {
@@ -1098,8 +1097,8 @@ public abstract class SslContext {
                 }
             }
         } finally {
-            for (; i < certs.length; i++) {
-                certs[i].release();
+            for (ByteBuf buf: certs) {
+                buf.release();
             }
         }
         return x509Certs;

handler/src/test/java/io/netty/handler/ssl/SslContextTest.java

@@ -23,6 +23,7 @@ import java.io.IOException;
 import java.security.KeyManagementException;
 import java.security.NoSuchAlgorithmException;
 import java.security.PrivateKey;
+import java.security.cert.CertificateException;
 import java.security.spec.InvalidKeySpecException;
 
 import javax.net.ssl.SSLContext;
@@ -114,5 +115,10 @@ public abstract class SslContextTest {
         assertFalse(sslContext.cipherSuites().contains(unsupportedCipher));
     }
 
+    @Test(expected = CertificateException.class)
+    public void test() throws CertificateException {
+        SslContext.toX509Certificates(new File(getClass().getResource("ec_params_unsupported.pem").getFile()));
+    }
+
     protected abstract SslContext newServerContext(File crtFile, File keyFile, String pass) throws SSLException;
 }

handler/src/test/resources/io/netty/handler/ssl/ec_params_unsupported.pem

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC8TCCApagAwIBAgIJAOeu9WKx0IutMAoGCCqGSM49BAMCMFkxCzAJBgNVBAYT
+AkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRn
+aXRzIFB0eSBMdGQxEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0xODExMDEyMDAwMTha
+Fw0yMDEwMzEyMDAwMThaMFkxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0
+YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxEjAQBgNVBAMM
+CWxvY2FsaG9zdDCCAUswggEDBgcqhkjOPQIBMIH3AgEBMCwGByqGSM49AQECIQD/
+////AAAAAQAAAAAAAAAAAAAAAP///////////////zBbBCD/////AAAAAQAAAAAA
+AAAAAAAAAP///////////////AQgWsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848
+PifSYEsDFQDEnTYIhucEk2pmeOETnSa3gZ9+kARBBGsX0fLhLEJH+Lzm5WOkQPJ3
+A32BLeszoPShOUXYmMKWT+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfUC
+IQD/////AAAAAP//////////vOb6racXnoTzucrC/GMlUQIBAQNCAAQ3G/YXF+YE
+XuASiyC1822n0iNPumHgFplF+6/veicKm+mDNA3NA/1zTRKJOyqpDdMyB9tgFrdV
+zcHzw7JW+lDpo1MwUTAdBgNVHQ4EFgQUonraQIcnNMppU+GoJ6+vPbC84pEwHwYD
+VR0jBBgwFoAUonraQIcnNMppU+GoJ6+vPbC84pEwDwYDVR0TAQH/BAUwAwEB/zAK
+BggqhkjOPQQDAgNJADBGAiEAoIkAinhds0VvNtWdi6f+r+U8AA9rUsR1sJBzVOYD
+ErACIQCMMyfEWW8d4N3q8fpZ/lWTNaionVWeZZHWjseTmafWQg==
+-----END CERTIFICATE-----