NullPointerException during validation of ACI containing or expression without 2nd operand

[myandrews]

Validation of ACI is failed while trying to decode ACI without 2nd operand in or/and expression in bind rule.
Problem ACI is

(version 3.0; acl "ac"; allow (search)(()or) (userdn="ldap:///self"); )

Test to reproduce the problem

        String aci = "(version 3.0; acl \"ac\"; allow (search)(()or) (userdn=\\\"ldap:///self\\\"); )";
        Aci.decode(ByteString.valueOfUtf8(aci), DN.rootDN());

Stacktrace is

java.lang.NullPointerException: Cannot invoke "org.opends.server.authorization.dseecompat.BindRule.setNegate(boolean)" because "bindrule_2" is null
    at org.opends.server.authorization.dseecompat.BindRule.createBindRule(BindRule.java:314)
    at org.opends.server.authorization.dseecompat.BindRule.decode(BindRule.java:206)
    at org.opends.server.authorization.dseecompat.BindRule.decode(BindRule.java:186)
    at org.opends.server.authorization.dseecompat.BindRule.decode(BindRule.java:186)
    at org.opends.server.authorization.dseecompat.BindRule.decode(BindRule.java:186)
    at org.opends.server.authorization.dseecompat.BindRule.decode(BindRule.java:186)
    at org.opends.server.authorization.dseecompat.PermBindRulePair.<init>(PermBindRulePair.java:37)
    at org.opends.server.authorization.dseecompat.PermBindRulePair.decode(PermBindRulePair.java:50)
    at org.opends.server.authorization.dseecompat.AciBody.decode(AciBody.java:161)
    at org.opends.server.authorization.dseecompat.Aci.decode(Aci.java:276)
    at ru.rtk.it.sc.fuzz.ds.FuzzAciDecode.fuzzerTestOneInput(FuzzAciDecode.java:23)

Expecting to get AciException in this case.

[vharseko]

Thanks for the detailed report and the reproducer — confirmed.

Root cause. An empty group such as () decodes to a null bind rule (the base case of BindRule.decode). That null was then dereferenced without a check: in (()or) the or boolean has no right-hand operand, so bindrule_2 is null when createBindRule calls bindrule_2.setNegate(...) — hence the NPE instead of an AciException. The same gap existed for a missing left operand (e.g. ()or userdn=..., which would build a complex rule with left == null and NPE later during evaluation) and for a bare () group.

Fix. All three cases now raise WARN_ACI_SYNTAX_INVALID_BIND_RULE_SYNTAX (AciException), which is the expected behavior. Added BindRuleOperandTest covering (()or), (… or), (… and), ()or …, (), and the full ACI from your report through Aci.decode(ByteString, DN).

PR: #720

[myandrews]

@vharseko using PR validation is now passed ok. Thanks!