This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new 6c5a6c0990 Improve handshake robustness
6c5a6c0990 is described below
commit 6c5a6c099083ccb7f19e501ea9251c030ffae49d
Author: remm <[email protected]>
AuthorDate: Wed Sep 2 09:21:51 2026 +0200
Improve handshake robustness
Avoid some possible edge cases.
Found by code review.
---
.../apache/tomcat/websocket/AsyncChannelWrapperSecure.java | 12 +++++++++---
webapps/docs/changelog.xml | 3 +++
2 files changed, 12 insertions(+), 3 deletions(-)
diff --git a/java/org/apache/tomcat/websocket/AsyncChannelWrapperSecure.java
b/java/org/apache/tomcat/websocket/AsyncChannelWrapperSecure.java
index 8e7c82430b..ca25622714 100644
--- a/java/org/apache/tomcat/websocket/AsyncChannelWrapperSecure.java
+++ b/java/org/apache/tomcat/websocket/AsyncChannelWrapperSecure.java
@@ -369,15 +369,21 @@ public class AsyncChannelWrapperSecure implements
AsyncChannelWrapper {
SSLEngineResult r = sslEngine.wrap(DUMMY,
socketWriteBuffer);
checkResult(r, true);
socketWriteBuffer.flip();
- Future<Integer> fWrite =
socketChannel.write(socketWriteBuffer);
- fWrite.get();
+ while (socketWriteBuffer.hasRemaining()) {
+ Future<Integer> fWrite =
socketChannel.write(socketWriteBuffer);
+ if (fWrite.get() < 0) {
+ throw new
EOFException(sm.getString("asyncChannelWrapperSecure.eof"));
+ }
+ }
break;
}
case NEED_UNWRAP: {
socketReadBuffer.compact();
if (socketReadBuffer.position() == 0 ||
resultStatus == Status.BUFFER_UNDERFLOW) {
Future<Integer> fRead =
socketChannel.read(socketReadBuffer);
- fRead.get();
+ if (fRead.get() < 0) {
+ throw new
EOFException(sm.getString("asyncChannelWrapperSecure.eof"));
+ }
}
socketReadBuffer.flip();
SSLEngineResult r =
sslEngine.unwrap(socketReadBuffer, DUMMY);
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 4d0f908c2b..3fdd700e8c 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -454,6 +454,9 @@
Harden the WebSocket client and use a <code>SecureRandom</code> when
generating the <code>Sec-WebSocket-Key</code> header. (markt)
</fix>
+ <fix>
+ Improve robustness of client handshakes. (remm)
+ </fix>
</changelog>
</subsection>
<subsection name="Web applications">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
