Issue #4828 Buffer Corruption (#4864)

+ improve synchronization around releaseBuffer + improve synchronization around acquireBuffer + made acquireBuffer private. Signed-off-by: Greg Wilkins <[email protected]>
jetty · May 11, 2020 · e869773 · e869773
1 parent 933ab64
commit e869773
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 8 deletions.
diff --git a/jetty-server/src/main/java/org/eclipse/jetty/server/HttpOutput.java b/jetty-server/src/main/java/org/eclipse/jetty/server/HttpOutput.java
@@ -487,8 +487,8 @@ public void completed()
         synchronized (_channelState)
         {
             _state = State.CLOSED;
+            releaseBuffer();
         }
-        releaseBuffer();
     }
 
     @Override
@@ -613,10 +613,13 @@ public void close() throws IOException
 
     public ByteBuffer getBuffer()
     {
-        return _aggregate;
+        synchronized (_channelState)
+        {
+            return acquireBuffer();
+        }
     }
 
-    public ByteBuffer acquireBuffer()
+    private ByteBuffer acquireBuffer()
     {
         if (_aggregate == null)
             _aggregate = _channel.getByteBufferPool().acquire(getBufferSize(), _interceptor.isOptimizedForDirectBuffers());
@@ -1410,10 +1413,13 @@ public void recycle()
 
     public void resetBuffer()
     {
-        _interceptor.resetBuffer();
-        if (BufferUtil.hasContent(_aggregate))
-            BufferUtil.clear(_aggregate);
-        _written = 0;
+        synchronized (_channelState)
+        {
+            _interceptor.resetBuffer();
+            if (BufferUtil.hasContent(_aggregate))
+                BufferUtil.clear(_aggregate);
+            _written = 0;
+        }
     }
 
     @Override

diff --git a/jetty-server/src/main/java/org/eclipse/jetty/server/handler/ErrorHandler.java b/jetty-server/src/main/java/org/eclipse/jetty/server/handler/ErrorHandler.java
@@ -305,7 +305,7 @@ protected void generateAcceptableResponse(Request baseRequest, HttpServletReques
                 // TODO error page may cause a BufferOverflow.  In which case we try
                 // TODO again with stacks disabled. If it still overflows, it is
                 // TODO written without a body.
-                ByteBuffer buffer = baseRequest.getResponse().getHttpOutput().acquireBuffer();
+                ByteBuffer buffer = baseRequest.getResponse().getHttpOutput().getBuffer();
                 ByteBufferOutputStream out = new ByteBufferOutputStream(buffer);
                 PrintWriter writer = new PrintWriter(new OutputStreamWriter(out, charset));