This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 60ec8ff01bc3992f255d90eea3dc41c99b252255 Author: opencode <[email protected]> AuthorDate: Tue Oct 13 09:23:04 2026 +0200 Complete the CRLF state transition in ChunkedInputFilter.available() When available() handled a single remaining byte in the CHUNK_BODY_CRLF state it ignored the result of skipCRLF(). skipCRLF() returns true only when it has consumed a complete CRLF, in which case the state machine must move to CHUNK_HEADER. The two sibling branches, for more than two remaining bytes and for a lone CRLF pair, both perform that transition. The transition used to be made by skipCRLF() itself. It was hoisted to the call sites when those paths were cleaned up, but the third call site was missed. The missing transition is not reachable through the current public APIs. For it to matter, skipCRLF() would have to complete a CRLF from exactly one buffered byte, which requires a previously consumed CR to still be pending while a single, non-LF byte is left over from the earlier partial parse. That state cannot currently be observed by a later available() call, since the read chunk is replaced rather than extended by each fill and a refill consumes its first byte within the same parse loop. The alignment is defensive: it keeps the state machine consistent should a future change allow available() to observe refilled data, avoiding a 400 for a valid chunked request. --- java/org/apache/coyote/http11/filters/ChunkedInputFilter.java | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java b/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java index aa658830f8..42a4f53ad2 100644 --- a/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java +++ b/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java @@ -231,8 +231,10 @@ public class ChunkedInputFilter implements InputFilter, ApplicationBufferHandler available = readChunk.remaining(); } if (available == 1 && parseState == ParseState.CHUNK_BODY_CRLF) { - skipCRLF(); - // LF to read next, or failed + if (skipCRLF()) { + parseState = ParseState.CHUNK_HEADER; + } + // CRLF complete, CR consumed with LF to read next, or failed available = readChunk.remaining(); } else if (available == 2 && !crFound && parseState == ParseState.CHUNK_BODY_CRLF) { // Just CRLF is left in the buffer. There is no data to read. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
