On Fri, 30 Oct 2026 12:57:18 GMT, Timofei Fedotov <[email protected]> wrote:
>> DTLSReassembler can queue fragments of the same handshake message with >> different total messageLength values. Reassembly holes are initialized from >> the first fragment, while the output array is allocated using the fragment >> with the lowest offset. >> >> For the same epoch, message sequence, and HELLO_REQUEST type, submit these >> fragments in order: >> offset 5, length 50, total message length 100; >> offset 0, length 5, total message length 10; >> offset 55, length 45, total message length 100. >> >> The final fragment completes the holes, but copying the buffered fragments >> into the array sized for a ten-byte message triggers >> ArrayIndexOutOfBoundsException. SSLEngineImpl catches this runtime exception >> and reports a fatal SSLException; it does not establish a JVM crash. >> >> Expected behavior the inconsistent handshake metadata must be rejected as a >> protocol error before fragment reassembly. >> >> --------- >> - [x] I confirm that I make this contribution in accordance with the >> [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai). > > Timofei Fedotov has updated the pull request incrementally with one > additional commit since the last revision: > > Update test/jdk/javax/net/ssl/DTLS/InconsistentFragmentLength.java > > Co-authored-by: Daniel Jelinski <[email protected]> test/jdk/javax/net/ssl/DTLS/InconsistentFragmentLength.java line 78: > 76: engine.unwrap(record(2, 100, 55, 45), app); > 77: throw new AssertionError("Inconsistent length accepted"); > 78: } catch (SSLException expected) { We should expect `SSLProtocolException` here test/jdk/javax/net/ssl/DTLS/InconsistentFragmentLength.java line 79: > 77: throw new AssertionError("Inconsistent length accepted"); > 78: } catch (SSLException expected) { > 79: if (!expected.getMessage().contains("Inconsistent DTLS > handshake fragments")) throw expected; - Check for the exact exception message with `assertEquals`. - The line length should not exceed 80 characters. test/jdk/javax/net/ssl/DTLS/InconsistentFragmentLength.java line 87: > 85: engine = engine(); > 86: engine.unwrap(record(0, 100, 5, 50), app); > 87: engine.unwrap(record(1, 100, 0, 5), app); We should have a valid positive test case here which completes the reassembly. ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/33633#discussion_r4428024932 PR Review Comment: https://git.openjdk.org/jdk/pull/33633#discussion_r4428033785 PR Review Comment: https://git.openjdk.org/jdk/pull/33633#discussion_r4428039749
