This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 10.1.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit b64f560efb2636554cd4178fd45c6b09d1752ffc Author: opencode <[email protected]> AuthorDate: Fri Oct 16 11:28:13 2026 +0200 Bind the nonce value parameter of OCSP_request_add1_nonce as a pointer The C prototype is int OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len) but the FFM binding declared the second parameter with the JAVA_CHAR layout and the wrapper method accepted a Java char. A scalar is placed where the native code reads a pointer. The only call site passed (char) 0 which currently works out to a NULL pointer through zero-extension, but the binding was formally incorrect, a non-zero value would have produced an invalid pointer for OpenSSL to copy from, and the documented use of passing an explicit nonce value was impossible with this signature. Bind the parameter as a pointer, accept a MemorySegment in the wrapper and pass MemorySegment.NULL at the call site, as intended for generating a random nonce. The previous incorrect layout stemmed from hand-editing of the generated file; the corrected binding is what jextract itself generates for this prototype. No behavior change on the existing call path. --- java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java | 2 +- java/org/apache/tomcat/util/openssl/openssl_h.java | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java index 705c4f3b3e..3aa64aafd6 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java @@ -1408,7 +1408,7 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn X509_STORE_CTX_set_error(x509ctx, X509_V_ERR_UNABLE_TO_GET_CRL()); return V_OCSP_CERTSTATUS_UNKNOWN(); } - OCSP_request_add1_nonce(ocspRequest, (char) 0, -1); + OCSP_request_add1_nonce(ocspRequest, MemorySegment.NULL, -1); MemorySegment ocspRequestDerPointer = localArena.allocateFrom(ValueLayout.ADDRESS, MemorySegment.NULL); int requestLength = i2d_OCSP_REQUEST(ocspRequest, ocspRequestDerPointer); if (requestLength <= 0) { diff --git a/java/org/apache/tomcat/util/openssl/openssl_h.java b/java/org/apache/tomcat/util/openssl/openssl_h.java index 518bd7fb58..66b1a908c4 100644 --- a/java/org/apache/tomcat/util/openssl/openssl_h.java +++ b/java/org/apache/tomcat/util/openssl/openssl_h.java @@ -9132,7 +9132,7 @@ public class openssl_h { public static final FunctionDescriptor DESC = FunctionDescriptor.of( openssl_h.C_INT, openssl_h.C_POINTER, - ValueLayout.JAVA_CHAR, + openssl_h.C_POINTER, openssl_h.C_INT ); @@ -9176,7 +9176,7 @@ public class openssl_h { * int OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len) * } */ - public static int OCSP_request_add1_nonce(MemorySegment req, char val, int len) { + public static int OCSP_request_add1_nonce(MemorySegment req, MemorySegment val, int len) { var mh$ = OCSP_request_add1_nonce.HANDLE; try { if (TRACE_DOWNCALLS) { --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
