From 158c066084650c793476deca87d773eed8d4cd23 Mon Sep 17 00:00:00 2001 From: markt Date: Mon, 11 Jul 2011 22:27:06 +0000 Subject: [PATCH] Protect against infinite loops in the HTTP NIO connector if sendfile is configured to send more data than is available in the file. (markt) git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1145383 13f79535-47bb-0310-9956-ffa450edef68 --- java/org/apache/tomcat/util/net/NioEndpoint.java | 7 +++++++ webapps/docs/changelog.xml | 4 ++++ 2 files changed, 11 insertions(+) diff --git a/java/org/apache/tomcat/util/net/NioEndpoint.java b/java/org/apache/tomcat/util/net/NioEndpoint.java index 3a902a086..0fa9dd14d 100644 --- a/java/org/apache/tomcat/util/net/NioEndpoint.java +++ b/java/org/apache/tomcat/util/net/NioEndpoint.java @@ -1240,6 +1240,13 @@ public class NioEndpoint extends AbstractEndpoint { sd.pos += written; sd.length -= written; attachment.access(); + } else { + // Unusual not to be unable to transfer any bytes + // Check the length was set correctly + if (sd.fchannel.size() <= sd.pos) { + throw new IOException("Sendfile configured to " + + "send more data than was available"); + } } } if ( sd.length <= 0 && sc.getOutboundRemaining()<=0) { diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml index d614a686a..3a100af2d 100644 --- a/webapps/docs/changelog.xml +++ b/webapps/docs/changelog.xml @@ -120,6 +120,10 @@ Add missing thread name in RequestProcessor when Servlet 3 Async is used. Fixes null thread name in access log and JMX MBean. (rjung) + + Protect against infinite loops in the HTTP NIO connector if sendfile is + configured to send more data than is available in the file. (markt) + -- 2.11.0