CipherOutputStream.close() in org.bouncycastle.crypto.io and org.bouncycastle.jcajce.io finalises the cipher on every call. On main, core/src/main/java/org/bouncycastle/crypto/io/CipherOutputStream.java:232 and :241 call doFinal inside close() (:223), and prov/src/main/java/org/bouncycastle/jcajce/io/CipherOutputStream.java:114 calls cipher.doFinal() inside close() (:108), with no record of an earlier close. java.io.Closeable says "If the stream is already closed then invoking this method has no effect.", javax.crypto.CipherOutputStream keeps a closed flag for this, and both CipherInputStream classes here already guard with a finalized flag.

The first close() leaves the cipher reset, so a second one finalises it again with no input and appends the result: one more padding block for a padded block cipher, one more tag for EAX, CCM, OCB and GCM-SIV. The output then fails to decrypt (pad block corrupted, mac check in EAX failed), or with ECB decrypts to different data without error. GCM throws instead (GCM cipher cannot be reused for encryption), as does a FileOutputStream sink (Stream Closed). In decrypt mode an AEAD stream throws InvalidCipherTextIOException with cause data too short (Data too short for GCM-SIV) after writing out the correct plaintext. A try-with-resources that also declares a BufferedOutputStream over the cipher stream is enough to close it twice.

Reproduced on the released bcprov-jdk18on-1.86.jar: in that pattern, a 33-byte message encrypted with AES/CBC/PKCS5Padding through the jcajce.io stream gives 64 bytes and BadPaddingException on decryption, where javax.crypto.CipherOutputStream gives 48. Current main and the 1.87-SNAPSHOT beta (1.87.0.20727) have both sources unchanged from 1.86 and reproduce it. Stream ciphers and CTR are unaffected.

This change:

• adds a closed field to each class, set at the start of close() before the cipher is finalised, so a later call returns at once, as in javax.crypto.CipherOutputStream; and
• adds testDoubleClose to core CipherStreamTest (AES/CBC/PKCS7, EAX, GCM) and prov CipherStreamTest2 (AES/CBC/PKCS5Padding, EAX, and GCM behind the JVM check the file already uses), closing an encrypting and then a decrypting stream twice and checking the output is unchanged and decrypts back.

Both tests fail without the change and pass with it; the other entries of both RegressionTest.tests arrays give the same result either way (without a bc-test-data checkout, the 21 core and 4 prov entries that need it could not run). Data written after close() is no longer finalised by a later close(), as with javax.crypto.CipherOutputStream.

Base tree only: no META-INF/versions copy of either class, no module-info or OSGi change. The clean-room jce/src/main/java/javax/crypto/CipherOutputStream.java has the same unguarded close() and is left as is. A release-note entry is included, happy to move it to another block.