Protect against infinite loops in the HTTP NIO connector if sendfile is configured...

git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1145383 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/java/org/apache/tomcat/util/net/NioEndpoint.java b/java/org/apache/tomcat/util/net/NioEndpoint.java
index 3a902a0..0fa9dd1 100644 (file)
--- a/java/org/apache/tomcat/util/net/NioEndpoint.java
+++ b/java/org/apache/tomcat/util/net/NioEndpoint.java
@@ -1240,6 +1240,13 @@ public class NioEndpoint extends AbstractEndpoint {
                         sd.pos += written;
                         sd.length -= written;
                         attachment.access();
+                    } else {
+                        // Unusual not to be unable to transfer any bytes
+                        // Check the length was set correctly
+                        if (sd.fchannel.size() <= sd.pos) {
+                            throw new IOException("Sendfile configured to " +
+                                    "send more data than was available");
+                        }
                     }
                 }
                 if ( sd.length <= 0 && sc.getOutboundRemaining()<=0) {

diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index d614a68..3a100af 100644 (file)
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -120,6 +120,10 @@
         Add missing thread name in RequestProcessor when Servlet 3 Async
         is used. Fixes null thread name in access log and JMX MBean. (rjung)
       </fix>
+      <fix>
+        Protect against infinite loops in the HTTP NIO connector if sendfile is
+        configured to send more data than is available in the file. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Cluster">