BufferOverflowException in SocketChannelOutputBuffer

[glassfishrobot]

public void realWriteBytes(byte cbuf[], int off, int len)
throws IOException {
if (len > 0) {
if (len > outputByteBuffer.remaining())

{ ByteBuffer tmp = ByteBuffer.allocate( outputByteBuffer.capacity() * 2 + len); outputByteBuffer.flip(); tmp.put(outputByteBuffer); outputByteBuffer = tmp; }

outputByteBuffer.put(cbuf, off, len);
}
}

if position + len is bigger than capacity * 2, outputByteBuffer overflows.

Environment

Operating System: All
Platform: All

Affected Versions

[1.9.22]

[glassfishrobot]

@glassfishrobot Commented
Reported by iasandcb@java.net

[glassfishrobot]

@glassfishrobot Commented
Was assigned to grizzly-issues

[glassfishrobot]

@glassfishrobot Commented
iasandcb@java.net said:
Created an attachment (id=3)
patch for this issue

[glassfishrobot]

@glassfishrobot Commented
File: ias-2007-09-17.patch
Attached By: iasandcb@java.net

[glassfishrobot]

@glassfishrobot Commented
iasandcb@java.net said:
Oops, sorry. The original code is
public void realWriteBytes(byte cbuf[], int off, int len)
throws IOException {
if (len > 0) {
if (len > outputByteBuffer.remaining())

{ ByteBuffer tmp = ByteBuffer.allocate( outputByteBuffer.capacity() * 2); outputByteBuffer.flip(); tmp.put(outputByteBuffer); outputByteBuffer = tmp; }

outputByteBuffer.put(cbuf, off, len);
}
}

[glassfishrobot]

@glassfishrobot Commented
jfarcand@java.net said:
Thanks! It was fixed in 1.0, but I forgot to port the fix.

[glassfishrobot]

@glassfishrobot Commented
jfarcand@java.net said:
What about the fix from 1.0:

public void realWriteBytes(byte cbuf[], int off, int len)
throws IOException {
if (len > 0) {
if (len > outputByteBuffer.remaining())

{ int size = Math.max(outputByteBuffer.capacity() * 2, len + outputByteBuffer.position()); ByteBuffer tmp = ByteBuffer.allocate(size); outputByteBuffer.flip(); tmp.put(outputByteBuffer); outputByteBuffer = tmp; }

outputByteBuffer.put(cbuf, off, len);
}
}

[glassfishrobot]

@glassfishrobot Commented
iasandcb@java.net said:
+1

[glassfishrobot]

@glassfishrobot Commented
jfarcand@java.net said:
Fixed. Thanks!!

[ja120114@localhost trunk]$ svn commit
Sending
trunk/modules/http/src/main/java/com/sun/grizzly/http/SocketChannelOutputBuffer.java
Transmitting file data .
Committed revision 510.

[glassfishrobot]

@glassfishrobot Commented
jfarcand@java.net said:
Fix milestones

[glassfishrobot]

@glassfishrobot Commented
Marked as fixed on Wednesday, December 16th 2009, 6:14:16 pm

[glassfishrobot]

@glassfishrobot Commented
This issue was imported from java.net JIRA GRIZZLY-23

[glassfishrobot]

• Issue Imported From: BufferOverflowException in SocketChannelOutputBuffer javaee/grizzly#23
• Original Issue Raised By:@glassfishrobot
• Original Issue Assigned To: @glassfishrobot
• Original Issue Closed By:@glassfishrobot