This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit adef4908df2596da3fc6161cddaf80bfa86eaa78 Author: opencode <[email protected]> AuthorDate: Sat Oct 17 12:46:36 2026 +0200 Fix 32-bit truncation of the session close timeout WsSession.getSessionCloseTimeout() read the Long value of the org.apache.tomcat.websocket.SESSION_CLOSE_TIMEOUT user property with intValue(), silently truncating it to 32 bits. A configured timeout greater than 2^31-1 ms (~24.8 days) was misinterpreted: a value whose low 32 bits are negative (e.g. 30 days) was rejected by the check for a non-positive value and silently replaced with the 30 second default, while other large values were silently shortened to their low 32 bits. Use longValue(), matching the sibling methods getAbnormalSessionCloseSendTimeout() and getBlockingSendTimeout(). The close timeout expiry is compared using the wrap-safe System.nanoTime() subtraction form, so the now usable full long range does not introduce any overflow related regression. --- java/org/apache/tomcat/websocket/WsSession.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java/org/apache/tomcat/websocket/WsSession.java b/java/org/apache/tomcat/websocket/WsSession.java index badef72406..6f83b6ce1a 100644 --- a/java/org/apache/tomcat/websocket/WsSession.java +++ b/java/org/apache/tomcat/websocket/WsSession.java @@ -792,7 +792,7 @@ public class WsSession implements Session { long result = 0; Object obj = userProperties.get(Constants.SESSION_CLOSE_TIMEOUT_PROPERTY); if (obj instanceof Long) { - result = ((Long) obj).intValue(); + result = ((Long) obj).longValue(); } if (result <= 0) { result = Constants.DEFAULT_SESSION_CLOSE_TIMEOUT; --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
