Details
-
Bug
-
Status: Open
-
Minor
-
Resolution: Unresolved
-
0.23.0, 2.5.0
-
None
-
None
Description
In DataInputByteBuffer$Buffer class, the fields bidx and buffers, etc are unsynchronized when used in read() and reset() function. In certain circumstances, e.g., the reset() is invoked in a loop, the unsynchronized bidx and buffers can trigger a concurrency bug.
Here is the code snippet.
ByteBuffer[] buffers = new ByteBuffer[0]; int bidx, pos, length; @Override public int read(byte[] b, int off, int len) { if (bidx >= buffers.length) { return -1; } int cur = 0; do { int rem = Math.min(len, buffers[bidx].remaining()); buffers[bidx].get(b, off, rem); cur += rem; off += rem; len -= rem; } while (len > 0 && ++bidx < buffers.length); //bidx is unsynchronized pos += cur; return cur; } public void reset(ByteBuffer[] buffers) {//if one thread keeps calling reset() in a loop bidx = pos = length = 0; this.buffers = buffers; for (ByteBuffer b : buffers) { length += b.remaining(); } }