Bug 61779

Summary: NPE in AuthConfigFactoryImpl.removeRegistration() if AuthConfigFactoryImpl.getConfigProvider() was called with null parameter for listener
Product: Tomcat 8 Reporter: Lazar Kirchev <lazar.kirchev>
Component: CatalinaAssignee: Tomcat Developers Mailing List <dev>
Status: RESOLVED FIXED    
Severity: normal    
Priority: P2    
Version: 8.5.23   
Target Milestone: ----   
Hardware: PC   
OS: All   

Description Lazar Kirchev 2017-11-18 13:55:43 UTC 
AuthConfigFactoryImpl.getConfigProvider() always creates a listener wrapper, even if the listener parameter is actually null. When after that AuthConfigFactoryImpl.removeRegistration() is called, the listeners in all listener wrappers for this registration are notified for the removal. 

However, no check for null listener in the listener wrapper is made, therefore if there is a null listener within a wrapper a NPE is thrown.
Comment 1 Lazar Kirchev 2017-11-18 13:57:28 UTC 
This pull request contains a test case, which illustrates the problem and a fix for it: https://github.com/apache/tomcat/pull/87
Comment 2 Mark Thomas 2017-11-20 13:11:40 UTC 
Again, many thanks.

Fixed in:
- trunk for 9.0.2 onwards
- 8.5.x for 8.5.24 onwards