T generateItem(InputStream inStream) throws ParsingException {
            if (inStream == null) {
                throw new ParsingException("inStream == null");
            }

            final boolean markable = inStream.markSupported();
            if (markable) {
                inStream.mark(PKCS7_MARKER.length);
            }

            final PushbackInputStream pbis = new PushbackInputStream(inStream, PUSHBACK_SIZE);
            try {
                byte[] buffer = new byte[PKCS7_MARKER.length];

                int len = pbis.read(buffer);
                if (len < 0) {
                    /* No need to reset here. The stream was empty or EOF. */
                    throw new ParsingException("inStream is empty");
                }
                pbis.unread(buffer, 0, len);

                if (buffer[0] == '-') {
                    return fromX509PemInputStream(pbis);
                }
                if (isMaybePkcs7(buffer)) {
                    List<? extends T> certs = fromPkcs7DerInputStream(pbis);
                    if (certs.size() == 0) {
                        return null;
                    }
                    return certs.get(0);
                }
                if (buffer[0] == VALUE_0) {
                    return fromX509DerInputStream(pbis);
                }
                int value = 0;
                buffer = new byte[PEM_MARKER.length];
                while (value != -1) {
                    value = pbis.read();
                    if (value == DASH) {
                        pbis.unread(value);
                        len = pbis.read(buffer);
                        if (len < PEM_MARKER.length) {
                            throw new ParsingException("No certificate found");
                        }
                        pbis.unread(buffer, 0, len);
                        if (Arrays.equals(buffer, PEM_MARKER)) {
                            return fromX509PemInputStream(pbis);
                        }
                        pbis.read();
                    }
                }
                throw new ParsingException("No certificate found");
            } catch (Exception e) {
                if (markable) {
                    try {
                        inStream.reset();
                    } catch (IOException ignored) {
                        // If resetting the stream fails, there's not much we can do
                    }
                }
                throw new ParsingException(e);
            }
        }
The code for X509 Certificates and CRL is pretty much the same. We use
this abstract class to share the code between them. This makes it ugly,
but it's already written in this language anyway.
common/src/main/java/org/conscrypt/OpenSSLX509CertificateFactory.java