Skip to content

Fix IllegalReferenceCountException on invalid upgrade response#15602

Merged
normanmaurer merged 2 commits intonetty:4.2from
yawkat:double-release
Sep 2, 2025
Merged

Fix IllegalReferenceCountException on invalid upgrade response#15602
normanmaurer merged 2 commits intonetty:4.2from
yawkat:double-release

Conversation

@yawkat
Copy link
Copy Markdown
Contributor

@yawkat yawkat commented Sep 1, 2025

Motivation:

When HttpClientUpgradeHandler receives a response with an invalid upgrade header, it would release the response but still keep it in the out list. Downstream code would then get an IllegalReferenceCountException when releasing the response.

Modification:

Remove unnecessary release. I don't think it's ever appropriate.

Result:

No IllegalReferenceCountException.

Found by fuzzing

Motivation:

When HttpClientUpgradeHandler receives a response with an invalid upgrade header, it would release the response but still keep it in the `out` list. Downstream code would then get an IllegalReferenceCountException when releasing the response.

Modification:

Remove unnecessary release. I don't think it's ever appropriate.

Result:

No IllegalReferenceCountException.

Found by fuzzing
@normanmaurer
Copy link
Copy Markdown
Member

@yawkat please fix check style

@He-Pin
Copy link
Copy Markdown
Contributor

He-Pin commented Sep 1, 2025

@normanmaurer will https://autofix.ci help?

@yawkat
Copy link
Copy Markdown
Contributor Author

yawkat commented Sep 1, 2025

I think for that it would require an autoformatter, not just a check

@normanmaurer normanmaurer added this to the 4.2.5.Final milestone Sep 2, 2025
@normanmaurer normanmaurer merged commit 81d813d into netty:4.2 Sep 2, 2025
16 of 18 checks passed
normanmaurer pushed a commit that referenced this pull request Sep 2, 2025
Motivation:

When HttpClientUpgradeHandler receives a response with an invalid
upgrade header, it would release the response but still keep it in the
`out` list. Downstream code would then get an
IllegalReferenceCountException when releasing the response.

Modification:

Remove unnecessary release. I don't think it's ever appropriate.

Result:

No IllegalReferenceCountException.

Found by fuzzing
normanmaurer added a commit that referenced this pull request Sep 2, 2025
… (#15606)

Motivation:

When HttpClientUpgradeHandler receives a response with an invalid
upgrade header, it would release the response but still keep it in the
`out` list. Downstream code would then get an
IllegalReferenceCountException when releasing the response.

Modification:

Remove unnecessary release. I don't think it's ever appropriate.

Result:

No IllegalReferenceCountException.

Found by fuzzing

---------

Co-authored-by: Jonas Konrad <jonas.konrad@oracle.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants