This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 2ad9b5d4850668df0ba177a59f2fb9fe54768eee Author: opencode <[email protected]> AuthorDate: Fri Oct 16 10:12:00 2026 +0200 Account for the array offset when copying between OpenSSL FFM engine buffers and heap ByteBuffers The write and read helper methods of the FFM based OpenSSL SSLEngine used the buffer position directly as the index into the array returned by ByteBuffer.array(). For a heap buffer that is a view of a larger array, for example the result of slicing the buffer at a non-zero position, the index into the backing array is the array offset plus the position. The unadjusted position caused the engine to read from and write to the wrong offset, silently corrupting the application data of any wrap or unwrap call that used such a buffer. The buffers Tomcat itself passes to the engine are all direct or have a zero array offset, so this went unnoticed internally. It is a regression against the JNI based implementation, which uses ByteBuffer get and put methods that take the array offset into account implicitly. --- .../apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java index e92dbaf43e..3d54c6bfd0 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java @@ -251,7 +251,7 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn final int len = Math.min(src.remaining(), MAX_PLAINTEXT_LENGTH); MemorySegment srcSegment = src.isDirect() ? MemorySegment.ofBuffer(src) : bufSegment; if (!src.isDirect()) { - MemorySegment.copy(src.array(), pos, bufSegment, ValueLayout.JAVA_BYTE, 0, len); + MemorySegment.copy(src.array(), src.arrayOffset() + pos, bufSegment, ValueLayout.JAVA_BYTE, 0, len); } final int sslWrote = SSL_write(ssl, srcSegment, len); if (sslWrote > 0) { @@ -274,7 +274,7 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn final int len = src.remaining(); MemorySegment srcSegment = src.isDirect() ? MemorySegment.ofBuffer(src) : bufSegment; if (!src.isDirect()) { - MemorySegment.copy(src.array(), pos, bufSegment, ValueLayout.JAVA_BYTE, 0, len); + MemorySegment.copy(src.array(), src.arrayOffset() + pos, bufSegment, ValueLayout.JAVA_BYTE, 0, len); } final int netWrote = BIO_write(networkBIO, srcSegment, len); if (netWrote > 0) { @@ -299,7 +299,8 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn final int sslRead = SSL_read(ssl, dstSegment, len); if (sslRead > 0) { if (!dst.isDirect()) { - MemorySegment.copy(dstSegment, ValueLayout.JAVA_BYTE, 0, dst.array(), pos, sslRead); + MemorySegment.copy(dstSegment, ValueLayout.JAVA_BYTE, 0, dst.array(), dst.arrayOffset() + pos, + sslRead); } dst.position(pos + sslRead); return sslRead; @@ -322,7 +323,8 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn final int bioRead = BIO_read(networkBIO, dstSegment, pending); if (bioRead > 0) { if (!dst.isDirect()) { - MemorySegment.copy(dstSegment, ValueLayout.JAVA_BYTE, 0, dst.array(), pos, bioRead); + MemorySegment.copy(dstSegment, ValueLayout.JAVA_BYTE, 0, dst.array(), dst.arrayOffset() + pos, + bioRead); } dst.position(pos + bioRead); return bioRead; --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
