This is an automated email from the ASF dual-hosted git repository.

rmaucher pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/10.1.x by this push:
     new 137e624b95 Fix isTrailerFieldsReady
137e624b95 is described below

commit 137e624b95c09b5f48cd99c77ea9b51dfd17d30e
Author: remm <[email protected]>
AuthorDate: Mon Jun 1 03:52:11 2026 +0200

    Fix isTrailerFieldsReady
    
    Use it in the test since it's not allowed to access the trailers if it
    does not return true. So this is now more strict, maybe problems ?
    setLimit should always set the limit (it could change in theory).
    Http11InputBuffer.expand would be inefficient if it is used (always
    reallocate even if unneeded).
---
 java/org/apache/coyote/AbstractProcessor.java                     | 8 +++++++-
 java/org/apache/coyote/http11/Http11InputBuffer.java              | 3 ++-
 java/org/apache/coyote/http11/Http11OutputBuffer.java             | 2 +-
 java/org/apache/coyote/http11/filters/BufferedInputFilter.java    | 2 ++
 test/org/apache/coyote/http11/filters/TestChunkedInputFilter.java | 2 +-
 webapps/docs/changelog.xml                                        | 4 ++++
 6 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/java/org/apache/coyote/AbstractProcessor.java 
b/java/org/apache/coyote/AbstractProcessor.java
index d606964dce..4003bf2314 100644
--- a/java/org/apache/coyote/AbstractProcessor.java
+++ b/java/org/apache/coyote/AbstractProcessor.java
@@ -339,7 +339,13 @@ public abstract class AbstractProcessor extends 
AbstractProcessorLight implement
                         setErrorState(ErrorState.CLOSE_CLEAN, null);
                         return;
                     }
-                    port = port * 10 + c - '0';
+                    int digit = c - '0';
+                    if (port > (Integer.MAX_VALUE - digit) / 10) {
+                        response.setStatus(400);
+                        setErrorState(ErrorState.CLOSE_CLEAN, null);
+                        return;
+                    }
+                    port = port * 10 + digit;
                 }
                 request.setServerPort(port);
 
diff --git a/java/org/apache/coyote/http11/Http11InputBuffer.java 
b/java/org/apache/coyote/http11/Http11InputBuffer.java
index 3a412c449e..81274341d9 100644
--- a/java/org/apache/coyote/http11/Http11InputBuffer.java
+++ b/java/org/apache/coyote/http11/Http11InputBuffer.java
@@ -724,7 +724,7 @@ public class Http11InputBuffer implements InputBuffer, 
ApplicationBufferHandler
 
 
     boolean isChunking() {
-        for (int i = 0; i < lastActiveFilter; i++) {
+        for (int i = 0; i <= lastActiveFilter; i++) {
             if (activeFilters[i] == filterLibrary[Constants.CHUNKED_FILTER]) {
                 return true;
             }
@@ -1230,6 +1230,7 @@ public class Http11InputBuffer implements InputBuffer, 
ApplicationBufferHandler
     public void expand(int size) {
         if (byteBuffer.capacity() >= size) {
             byteBuffer.limit(size);
+            return;
         }
         ByteBuffer temp = ByteBuffer.allocate(size);
         temp.put(byteBuffer);
diff --git a/java/org/apache/coyote/http11/Http11OutputBuffer.java 
b/java/org/apache/coyote/http11/Http11OutputBuffer.java
index 40e78c5083..d3ca5e6ee5 100644
--- a/java/org/apache/coyote/http11/Http11OutputBuffer.java
+++ b/java/org/apache/coyote/http11/Http11OutputBuffer.java
@@ -557,7 +557,7 @@ public class Http11OutputBuffer implements HttpOutputBuffer 
{
 
 
     boolean isChunking() {
-        for (int i = 0; i < lastActiveFilter; i++) {
+        for (int i = 0; i <= lastActiveFilter; i++) {
             if (activeFilters[i] == filterLibrary[Constants.CHUNKED_FILTER]) {
                 return true;
             }
diff --git a/java/org/apache/coyote/http11/filters/BufferedInputFilter.java 
b/java/org/apache/coyote/http11/filters/BufferedInputFilter.java
index 789da42b0d..878ca7487b 100644
--- a/java/org/apache/coyote/http11/filters/BufferedInputFilter.java
+++ b/java/org/apache/coyote/http11/filters/BufferedInputFilter.java
@@ -76,6 +76,8 @@ public class BufferedInputFilter implements InputFilter, 
ApplicationBufferHandle
         if (buffered == null) {
             buffered = new ByteChunk();
             buffered.setLimit(limit);
+        } else {
+            buffered.setLimit(limit);
         }
     }
 
diff --git a/test/org/apache/coyote/http11/filters/TestChunkedInputFilter.java 
b/test/org/apache/coyote/http11/filters/TestChunkedInputFilter.java
index fa3a58cebb..0ca664b7e3 100644
--- a/test/org/apache/coyote/http11/filters/TestChunkedInputFilter.java
+++ b/test/org/apache/coyote/http11/filters/TestChunkedInputFilter.java
@@ -626,7 +626,7 @@ public class TestChunkedInputFilter extends TomcatBaseTest {
 
         private void dumpHeader(String headerName, HttpServletRequest req,
                 PrintWriter pw) {
-            String value = req.getTrailerFields().get(headerName);
+            String value = req.isTrailerFieldsReady() ? 
req.getTrailerFields().get(headerName) : null;
             if (value == null) {
                 value = "null";
             }
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index a95573e991..5c931e6789 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -272,6 +272,10 @@
         to <code>Http2Protocol</code> that allows the consistency check for the
         scheme provided by the user agent to be bypassed. (markt)
       </fix>
+      <fix>
+        <code>isTrailerFieldsReady</code> was always returning
+        <code>true</code>. (remm)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Jasper">


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to