[ 
https://issues.apache.org/jira/browse/SSHD-1032?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17162173#comment-17162173
 ] 

Evgeny Pasynkov commented on SSHD-1032:
---------------------------------------

I've investigated the issue deeper and have an idea how this could happen, and 
this looks like a race in sshd code.

In ChannelAsyncOutputStream class in doWriteIfPossible method you have the code:
{code:java}
int total = buffer.available();
if (total > 0) {
    Channel channel = getChannel();
    Window remoteWindow = channel.getRemoteWindow();
    long length;
    if (total > remoteWindow.getSize()) {
        // if we have a big message and there is enough space, send the next 
chunk
        if (remoteWindow.getSize() >= remoteWindow.getPacketSize()) {
            // send the first chunk as we have enough space in the window
            length = remoteWindow.getPacketSize();

{code}
Looks like remoteWindow.getSize() is changes asynchronously, thus length get 
the packet size (in my case 32k), and then it fails to copy buffer since buffer 
length is 16k only.

 

I've proved this hypothesis by setting breakpoint on the "length = ..." line, 
and it was hit, and in that exact moment condition "total > 
remoteWindow.getSize()" is FALSE

> java.lang.ArrayIndexOutOfBoundsException arraycopy
> --------------------------------------------------
>
>                 Key: SSHD-1032
>                 URL: https://issues.apache.org/jira/browse/SSHD-1032
>             Project: MINA SSHD
>          Issue Type: Bug
>    Affects Versions: 2.5.0
>            Reporter: Evgeny Pasynkov
>            Priority: Major
>
> When invoking writePacket, I quite often get the following exception:
> {noformat}
> Caused by: java.lang.ArrayIndexOutOfBoundsException arraycopy: last source 
> index 32768 out of bounds for byte[8192] 
> at java.base/java.lang.System.arraycopy(Native Method) 
> at 
> org.apache.sshd.common.util.buffer.ByteArrayBuffer.putRawBytes(ByteArrayBuffer.java:230)
>  
> at 
> org.apache.sshd.common.channel.ChannelAsyncOutputStream.createSendBuffer(ChannelAsyncOutputStream.java:229)
>  
> at 
> org.apache.sshd.common.channel.ChannelAsyncOutputStream.doWriteIfPossible(ChannelAsyncOutputStream.java:164)
>  
> at 
> org.apache.sshd.common.channel.ChannelAsyncOutputStream.writePacket(ChannelAsyncOutputStream.java:70){noformat}
> This never happened in 2.4.0, so it is definitely a regression



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@mina.apache.org
For additional commands, e-mail: dev-h...@mina.apache.org

Reply via email to