This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new 2e4e1b7198 Review "Fix zero-length read handling in the input
stream..."
2e4e1b7198 is described below
commit 2e4e1b719827ed2a6924c671c093b9c3fbb999ef
Author: Mark Thomas <[email protected]>
AuthorDate: Mon Nov 2 12:12:50 2026 +0000
Review "Fix zero-length read handling in the input stream..."
Negative lengths are invalid
Expand checks on provided arguments for read
---
.../coyote/http11/upgrade/LocalStrings.properties | 1 +
.../http11/upgrade/UpgradeServletInputStream.java | 17 +++++++++++++++--
2 files changed, 16 insertions(+), 2 deletions(-)
diff --git a/java/org/apache/coyote/http11/upgrade/LocalStrings.properties
b/java/org/apache/coyote/http11/upgrade/LocalStrings.properties
index 3a9aa98b4f..ac6b3896c1 100644
--- a/java/org/apache/coyote/http11/upgrade/LocalStrings.properties
+++ b/java/org/apache/coyote/http11/upgrade/LocalStrings.properties
@@ -21,6 +21,7 @@ upgrade.sis.isFinished.ise=It is illegal to call isFinished()
when the ServletIn
upgrade.sis.isReady.ise=It is illegal to call isReady() when the
ServletInputStream is not in non-blocking mode (i.e. setReadListener() must be
called first)
upgrade.sis.onErrorFail=onError processing for the registered ReadListener
triggered this further error which was swallowed
upgrade.sis.read.closed=The InputStream has been closed
+upgrade.sis.read.ioobe=The offset [{0}] and length [{1}] are not valid for a
buffer of length [{2}]
upgrade.sis.read.ise=It is illegal to call any of the read() methods in
non-blocking mode without first checking that there is data available by
calling isReady()
upgrade.sis.readListener.null=It is illegal to pass null to setReadListener()
upgrade.sis.readListener.set=It is illegal to call setReadListener() more than
once for the same upgraded connection
diff --git
a/java/org/apache/coyote/http11/upgrade/UpgradeServletInputStream.java
b/java/org/apache/coyote/http11/upgrade/UpgradeServletInputStream.java
index 47dda937d5..0c64c233c7 100644
--- a/java/org/apache/coyote/http11/upgrade/UpgradeServletInputStream.java
+++ b/java/org/apache/coyote/http11/upgrade/UpgradeServletInputStream.java
@@ -17,6 +17,7 @@
package org.apache.coyote.http11.upgrade;
import java.io.IOException;
+import java.util.Objects;
import java.util.concurrent.atomic.AtomicBoolean;
import javax.servlet.ReadListener;
@@ -176,10 +177,12 @@ public class UpgradeServletInputStream extends
ServletInputStream {
@Override
public final int readLine(byte[] b, int off, int len) throws IOException {
preReadChecks();
+ bufferChecks(b, off, len);
- if (len <= 0) {
+ if (len == 0) {
return 0;
}
+
int count = 0, c;
while ((c = readInternal()) != -1) {
@@ -201,9 +204,10 @@ public class UpgradeServletInputStream extends
ServletInputStream {
@Override
public final int read(byte[] b, int off, int len) throws IOException {
preReadChecks();
+ bufferChecks(b, off, len);
// The input must not be touched if the caller requested zero bytes.
- if (len <= 0) {
+ if (len == 0) {
return 0;
}
@@ -241,6 +245,15 @@ public class UpgradeServletInputStream extends
ServletInputStream {
}
+ private void bufferChecks(byte[] b, int off, int len) {
+ Objects.requireNonNull(b);
+ if (off < 0 || len < 0 || off > b.length - len) {
+ throw new
IndexOutOfBoundsException(sm.getString("upgrade.sis.read.ioobe",
+ Integer.valueOf(off), Integer.valueOf(len),
Integer.valueOf(b.length)));
+ }
+ }
+
+
private int readInternal() throws IOException {
// Single byte reads for non-blocking need special handling so all
// single byte reads run through this method.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
