SimpleMergedByteBuffers: ArrayOutOfBounds Fix #71
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This fixes SimpleMergedByteBuffers.getNextBuffer to avoid an ArrayOutOfBounds fix when the buffer has been fully consumed. We must always check the currentBuffer index before we can attempt to access the array. In addition the EMPTY_BUFFER_ARRAY can not contain the empty buffer because it makes logic which compares the array length invalid.
jentfoo
changed the title
|
lgtm |
lwahlmeier
approved these changes
Oct 25, 2019
jentfoo
added a commit
to jentfoo/litesockets
that referenced
this pull request
Feb 13, 2020
This fixes ssl, which can be seen using litesockets-http-client when using https. The behavior would be the start of the handshake which would eventually hang. This regression was introduced in this PR: threadly#71 The specific flaw was introduced when the .duplicate() was removed here: https://github.com/threadly/litesockets/pull/71/files#diff-851d3597731b2cecc83331ede7aec7ebL143 It seems for SSL to work correctly we need to make sure that the MergedByteBuffer does not work against the original ByteBuffer that was originally passed in. This fixes that behavior by making sure that when ByteBuffers are added (or provided at construction), we do this .duplicate() then. This way when buffers are leaving the MergedByteBuffer we know it already has an independent experience from the one provided initially. The goal being that by having this duplicate action happen at a consistent point will make this safer. Overall I don't think we really add any .duplicate() actions, if anything at times we might have less. With it happening at the start we can safely avoid duplicate calls at other points we had them previously.
jentfoo
added a commit
to jentfoo/litesockets
that referenced
this pull request
Feb 13, 2020
This fixes ssl, which can be seen using litesockets-http-client when using https. The behavior would be the start of the handshake which would eventually hang. This regression was introduced in this PR: threadly#71 The specific flaw was introduced when the .duplicate() was removed here: https://github.com/threadly/litesockets/pull/71/files#diff-851d3597731b2cecc83331ede7aec7ebL143 It seems for SSL to work correctly we need to make sure that the MergedByteBuffer does not work against the original ByteBuffer that was originally passed in. This fixes that behavior by making sure that when ByteBuffers are added (or provided at construction), we do this .duplicate() then. This way when buffers are leaving the MergedByteBuffer we know it already has an independent experience from the one provided initially. The goal being that by having this duplicate action happen at a consistent point will make this safer. Overall I don't think we really add any .duplicate() actions, if anything at times we might have less. With it happening at the start we can safely avoid duplicate calls at other points we had them previously.
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This fixes SimpleMergedByteBuffers.getNextBuffer to avoid an ArrayOutOfBounds fix when the buffer has been fully consumed.
We must always check the currentBuffer index before we can attempt to access the array.
In addition the EMPTY_BUFFER_ARRAY can not contain the empty buffer because it makes logic which compares the array length invalid.