[HTTPCORE-430] Unsafe decrement LengthDelimitedEncoder's remaining value.

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 4.4.5
• Component/s: HttpCore NIO
• Environment: Linux 2.6.32-642.1.1.el6.x86_64
• Assignee: Unassigned
• Reporter: Nhan Thuan Nguyen
• Created: 03/Aug/16 19:06
• Updated: 05/Aug/16 19:09
• Resolved: 05/Aug/16 19:09

Description

Durring a large HTTP POST if the SSLIOSession.writePlain "this.status" become not equal to ACTIVE (0) then it will return "-1" to LengthDelimitedEncoder. The "write" loop test for "this.remaining > 0" will always be true, and the loop will never exit.

In LengthDelimitedEncoder.write() (line 100)

while (src.hasRemaining() && this.remaining > 0) {
if (this.buffer.hasData() || this.fragHint > 0) {
final int chunk = nextChunk(src);
if (chunk <= this.fragHint) {
final int capacity = this.fragHint - this.buffer.length();
if (capacity > 0)

{ final int limit = Math.min(capacity, chunk); final int bytesWritten = writeToBuffer(src, limit); this.remaining -= bytesWritten; total += bytesWritten; }

}
}
if (this.buffer.hasData()) {
final int chunk = nextChunk(src);
if (this.buffer.length() >= this.fragHint || chunk > 0) {
final int bytesWritten = flushToChannel();
if (bytesWritten == 0)

{ break; }

}
}
if (!this.buffer.hasData()) {
final int chunk = nextChunk(src);
if (chunk > this.fragHint) {
final int bytesWritten = writeToChannel(src, chunk);
this.remaining -= bytesWritten;
total += bytesWritten;
if (bytesWritten == 0)

{ //PROPOSAL: can this change to <= 0 instead == 0? break; }

}
}
}
Version:
httpcore-nio-4.4.1.jar

Stack trace:
"I/O dispatcher 587" #3550 prio=5 os_prio=0 tid=0x00007f365e664000 nid=0xec0 runnable [0x00007f364aad4000]
java.lang.Thread.State: RUNNABLE
at ch.qos.logback.classic.Logger.callAppenders(Logger.java:256)
at ch.qos.logback.classic.Logger.buildLoggingEventAndAppend(Logger.java:421)
at ch.qos.logback.classic.Logger.filterAndLog_0_Or3Plus(Logger.java:383)
at ch.qos.logback.classic.Logger.log(Logger.java:765)
at org.apache.commons.logging.impl.SLF4JLocationAwareLog.debug(SLF4JLocationAwareLog.java:131)
at org.apache.http.impl.nio.conn.LoggingIOSession$LoggingByteChannel.write(LoggingIOSession.java:222)
at org.apache.http.impl.nio.codecs.AbstractContentEncoder.doWriteChunk(AbstractContentEncoder.java:173)
at org.apache.http.impl.nio.codecs.AbstractContentEncoder.doWriteChunk(AbstractContentEncoder.java:166)
at org.apache.http.impl.nio.codecs.AbstractContentEncoder.writeToChannel(AbstractContentEncoder.java:140)
at org.apache.http.impl.nio.codecs.LengthDelimitedEncoder.write(LengthDelimitedEncoder.java:132)
at org.apache.http.nio.entity.NByteArrayEntity.produceContent(NByteArrayEntity.java:137)
at org.apache.http.nio.protocol.BasicAsyncRequestProducer.produceContent(BasicAsyncRequestProducer.java:125)
at org.apache.http.impl.nio.client.MainClientExec.produceContent(MainClientExec.java:262)
at org.apache.http.impl.nio.client.DefaultClientExchangeHandlerImpl.produceContent(DefaultClientExchangeHandlerImpl.java:136)
at org.apache.http.nio.protocol.HttpAsyncRequestExecutor.outputReady(HttpAsyncRequestExecutor.java:229)
at org.apache.http.impl.nio.client.InternalRequestExecutor.outputReady(InternalRequestExecutor.java:96)
at org.apache.http.impl.nio.DefaultNHttpClientConnection.produceOutput(DefaultNHttpClientConnection.java:292)
at org.apache.http.impl.nio.client.InternalIODispatch.onOutputReady(InternalIODispatch.java:86)
at org.apache.http.impl.nio.client.InternalIODispatch.onOutputReady(InternalIODispatch.java:39)
at org.apache.http.impl.nio.reactor.AbstractIODispatch.outputReady(AbstractIODispatch.java:154)
at org.apache.http.impl.nio.reactor.BaseIOReactor.writable(BaseIOReactor.java:190)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:343)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:317)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:278)
at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:106)
at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:590)
at java.lang.Thread.run(Thread.java:745)