Skip to content

SyncContext double-close risk in DefaultArtifactResolver and DefaultMetadataResolver #1992

Description

@elharo

Affected version: HEAD

Files:

  • maven-resolver-impl/src/main/java/org/eclipse/aether/internal/impl/DefaultArtifactResolver.java:189-190, 393-397, 430-432
  • maven-resolver-impl/src/main/java/org/eclipse/aether/internal/impl/DefaultMetadataResolver.java:142-143, 302-373

Two SyncContext instances (shared and exclusive) are created in try-with-resources. Inside resolve(), current starts as shared, and when switching to exclusive (line 393-396), current.close() is called, then current = exclusive. The outer try-with-resources also closes both on exit (line 202 for try-with-resources, and line 431 for the inner current.close()). While SyncContext.close() is documented as idempotent, any implementation that violates this contract would cause issues.

Originally reported in #1944.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingpriority:majorMajor loss of function

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions