1 files changed, 26 insertions, 17 deletions
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/x509/NameConstraints.java b/bcprov/src/main/java/org/bouncycastle/asn1/x509/NameConstraints.java
index 0a923a85..88cfe3a9 100644
--- a/bcprov/src/main/java/org/bouncycastle/asn1/x509/NameConstraints.java
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/x509/NameConstraints.java
@@ -37,12 +37,14 @@ public class NameConstraints
             ASN1TaggedObject o = ASN1TaggedObject.getInstance(e.nextElement());
             switch (o.getTagNo())
             {
-                case 0:
-                    permitted = createArray(ASN1Sequence.getInstance(o, false));
-                    break;
-                case 1:
-                    excluded = createArray(ASN1Sequence.getInstance(o, false));
-                    break;
+            case 0:
+                permitted = createArray(ASN1Sequence.getInstance(o, false));
+                break;
+            case 1:
+                excluded = createArray(ASN1Sequence.getInstance(o, false));
+                break;
+            default:
+                throw new IllegalArgumentException("Unknown tag encountered: " + o.getTagNo());
             }
         }
     }
@@ -62,15 +64,8 @@ public class NameConstraints
         GeneralSubtree[] permitted,
         GeneralSubtree[] excluded)
     {
-        if (permitted != null)
-        {
-            this.permitted = permitted;
-        }
-
-        if (excluded != null)
-        {
-            this.excluded = excluded;
-        }
+        this.permitted = cloneSubtree(permitted);
+        this.excluded = cloneSubtree(excluded);
     }
 
     private GeneralSubtree[] createArray(ASN1Sequence subtree)
@@ -87,12 +82,12 @@ public class NameConstraints
 
     public GeneralSubtree[] getPermittedSubtrees()
     {
-        return permitted;
+        return cloneSubtree(permitted);
     }
 
     public GeneralSubtree[] getExcludedSubtrees()
     {
-        return excluded;
+        return cloneSubtree(excluded);
     }
 
     /*
@@ -115,4 +110,18 @@ public class NameConstraints
 
         return new DERSequence(v);
     }
+
+    private static GeneralSubtree[] cloneSubtree(GeneralSubtree[] subtrees)
+    {
+        if (subtrees != null)
+        {
+            GeneralSubtree[] rv = new GeneralSubtree[subtrees.length];
+
+            System.arraycopy(subtrees, 0, rv, 0, rv.length);
+
+            return rv;
+        }
+
+        return null;
+    }
 }