> DTLSReassembler can queue fragments of the same handshake message with > different total messageLength values. Reassembly holes are initialized from > the first fragment, while the output array is allocated using the fragment > with the lowest offset. > > For the same epoch, message sequence, and HELLO_REQUEST type, submit these > fragments in order: > offset 5, length 50, total message length 100; > offset 0, length 5, total message length 10; > offset 55, length 45, total message length 100. > > The final fragment completes the holes, but copying the buffered fragments > into the array sized for a ten-byte message triggers > ArrayIndexOutOfBoundsException. SSLEngineImpl catches this runtime exception > and reports a fatal SSLException; it does not establish a JVM crash. > > Expected behavior the inconsistent handshake metadata must be rejected as a > protocol error before fragment reassembly. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai).
Timofei Fedotov has updated the pull request incrementally with one additional commit since the last revision: Update test/jdk/javax/net/ssl/DTLS/InconsistentFragmentLength.java Co-authored-by: Daniel Jelinski <[email protected]> ------------- Changes: - all: https://git.openjdk.org/jdk/pull/33633/files - new: https://git.openjdk.org/jdk/pull/33633/files/d3484459..9df8ebfa Webrevs: - full: https://webrevs.openjdk.org/?repo=jdk&pr=33633&range=05 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=33633&range=04-05 Stats: 1 line in 1 file changed: 0 ins; 0 del; 1 mod Patch: https://git.openjdk.org/jdk/pull/33633.diff Fetch: git fetch https://git.openjdk.org/jdk.git pull/33633/head:pull/33633 PR: https://git.openjdk.org/jdk/pull/33633
