This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 11.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 28177b3c97794348a580af017f63e1653cc10a1a Author: opencode <[email protected]> AuthorDate: Fri Oct 16 10:12:00 2026 +0200 Account for the array offset when copying between OpenSSL FFM engine buffers and heap ByteBuffers The write and read helper methods of the FFM based OpenSSL SSLEngine used the buffer position directly as the index into the array returned by ByteBuffer.array(). For a heap buffer that is a view of a larger array, for example the result of slicing the buffer at a non-zero position, the index into the backing array is the array offset plus the position. The unadjusted position caused the engine to read from and write to the wrong offset, silently corrupting the application data of any wrap or unwrap call that used such a buffer. The buffers Tomcat itself passes to the engine are all direct or have a zero array offset, so this went unnoticed internally. It is a regression against the JNI based implementation, which uses ByteBuffer get and put methods that take the array offset into account implicitly. --- .../apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java index 8c9aa52cf7..84e13bc83f 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java @@ -251,7 +251,7 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn final int len = Math.min(src.remaining(), MAX_PLAINTEXT_LENGTH); MemorySegment srcSegment = src.isDirect() ? MemorySegment.ofBuffer(src) : bufSegment; if (!src.isDirect()) { - MemorySegment.copy(src.array(), pos, bufSegment, ValueLayout.JAVA_BYTE, 0, len); + MemorySegment.copy(src.array(), src.arrayOffset() + pos, bufSegment, ValueLayout.JAVA_BYTE, 0, len); } final int sslWrote = SSL_write(ssl, srcSegment, len); if (sslWrote > 0) { @@ -274,7 +274,7 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn final int len = src.remaining(); MemorySegment srcSegment = src.isDirect() ? MemorySegment.ofBuffer(src) : bufSegment; if (!src.isDirect()) { - MemorySegment.copy(src.array(), pos, bufSegment, ValueLayout.JAVA_BYTE, 0, len); + MemorySegment.copy(src.array(), src.arrayOffset() + pos, bufSegment, ValueLayout.JAVA_BYTE, 0, len); } final int netWrote = BIO_write(networkBIO, srcSegment, len); if (netWrote > 0) { @@ -299,7 +299,8 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn final int sslRead = SSL_read(ssl, dstSegment, len); if (sslRead > 0) { if (!dst.isDirect()) { - MemorySegment.copy(dstSegment, ValueLayout.JAVA_BYTE, 0, dst.array(), pos, sslRead); + MemorySegment.copy(dstSegment, ValueLayout.JAVA_BYTE, 0, dst.array(), dst.arrayOffset() + pos, + sslRead); } dst.position(pos + sslRead); return sslRead; @@ -322,7 +323,8 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn final int bioRead = BIO_read(networkBIO, dstSegment, pending); if (bioRead > 0) { if (!dst.isDirect()) { - MemorySegment.copy(dstSegment, ValueLayout.JAVA_BYTE, 0, dst.array(), pos, bioRead); + MemorySegment.copy(dstSegment, ValueLayout.JAVA_BYTE, 0, dst.array(), dst.arrayOffset() + pos, + bioRead); } dst.position(pos + bioRead); return bioRead; --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
