Bug 5625 - Https Get results in System.NullReferenceException: Object reference not set to an instance of an object at Mono.Security.X509.X509Certificate.Parse (System.Byte[] data)
Summary: Https Get results in System.NullReferenceException: Object reference not set ...
Alias: None
Product: iOS
Classification: Xamarin
Component: Xamarin.iOS.dll ()
Version: 5.2
Hardware: Other Other
: --- normal
Target Milestone: Untriaged
Assignee: Sebastien Pouliot
Depends on:
Reported: 2012-06-12 21:17 UTC by dj_technohead
Modified: 2012-06-19 15:59 UTC (History)
2 users (show)

Is this bug a regression?: ---
Last known good build:

Notice (2018-05-24): bugzilla.xamarin.com is now in read-only mode.

Please join us on Visual Studio Developer Community and in the Xamarin and Mono organizations on GitHub to continue tracking issues. Bugzilla will remain available for reference in read-only mode. We will continue to work on open Bugzilla bugs, copy them to the new locations as needed for follow-up, and add the new items under Related Links.

Our sincere thanks to everyone who has contributed on this bug tracker over the years. Thanks also for your understanding as we make these adjustments and improvements for the future.

Please create a new report on Developer Community or GitHub with your current version information, steps to reproduce, and relevant error messages or log files if you are hitting an issue that looks similar to this resolved bug and you do not yet see a matching new report.

Related Links:

Description dj_technohead 2012-06-12 21:17:15 UTC
HTTPS GETs to Facebook that used to work are now throwing exceptions within Mono. The following URL: 


which works in a browser, and used to work in MonoTouch, is now throwing the exception:

System.NullReferenceException: Object reference not set to an instance of an object
  at Mono.Security.X509.X509Certificate.Parse (System.Byte[] data) [0x0021d] in /Developer/MonoTouch/Source/mono/mcs/class/Mono.Security/Mono.Security.X509/X509Certificate.cs:166

On the line 166 in X509Certificate.cs :
// signature processing
byte[] bitstring = decoder [2].Value;
Comment 1 dj_technohead 2012-06-12 22:33:31 UTC
HTTPS GET request is being made using HttpWebRequest.
Comment 2 dj_technohead 2012-06-13 17:14:34 UTC
The same code untouched is now working. I assume that Facebook changed something and then changed it again. However, there is still a problem in Mono with its handling of the situation that caused the exception.
Comment 3 Sebastien Pouliot 2012-06-15 20:50:32 UTC
That's quite weird since this code block is inside a try/catch so that the only (reported) exception should be a CryptographicException (which is the same as Microsoft would throw for any invalid, format-wise, certificate).

I'll try this once I'm back from WWDC. If you get this again please include the full stack trace in case the context gives some additional hints.
Comment 4 dj_technohead 2012-06-17 13:27:54 UTC
Hi Sebastien,
  unfortunately I don't know how to reproduce this other than having a site with an invalid SSL certificate. But the problem itself is pretty bad, as it was causing our app, which is live on the app store, to crash when (in this case) Facebook made a change to their cert. I'd imagine other MT apps using the facebook API directly would have been seeing the same problems.

Comment 5 Sebastien Pouliot 2012-06-17 13:37:58 UTC
That I can try (bad certificate) but:

1) it should never give you a NullReferenceException since it's wrapped inside a CryptographicException. If you got this *unwrapped* then it's a very different (runtime) issue and we'll need a test case that shows this;

2) your code should catch such CryptographicException since it's the way the .NET FX reports invalid certificates. Maybe it should be caught inside another class (between the X509Certificate and your code) but again I'll need a test case showing how you got this (even if it does not crash anymore) so I know the actual call stack at that time (e.g. I can inject the same exception to see how this behave).
Comment 6 dj_technohead 2012-06-17 13:53:56 UTC
Good point on catching the CryptographicException, I am catching all exceptions when making requests, so that should have caught the cryptographic exception, or the null referenced object exception, without causing a crash, although I will try as you suggested to make sure that that is the case.
Comment 7 dj_technohead 2012-06-17 14:25:23 UTC
Just verified that I was catching all exceptions when making the requests that were failing. I threw a general exception and it was caught and handled properly, and the app did not crash.
Comment 8 dj_technohead 2012-06-17 15:59:45 UTC
I did find one point where making a request to facebook (friends) that was not guarded by a try/catch and have rectified that, but the other section was guarded, and was definitely failing and causing a crash as that was the code that was requesting facebook/me as identified above.
Comment 9 Sebastien Pouliot 2012-06-19 15:59:13 UTC
Something else (maybe in the runtime) must have gone wrong. However there's not enought details to duplicate it (or suggest where the real issue might be).

If it ever occurs again please re-open the bug report and
* paste the full stack trace
* look at the device console and paste the lines before the crash
* attach the device crash report

Note: I've added some code in our test suite that will hit the same url. Since that's executed often (bots) maybe this condition will be hit again (and that will point back to this bug)