This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 10.1.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit e57516ff7094a6d711e6b54918fe851fc3e02e82 Author: opencode <[email protected]> AuthorDate: Fri Oct 16 10:12:00 2026 +0200 Account for the array offset when copying between OpenSSL FFM engine buffers and heap ByteBuffers The write and read helper methods of the FFM based OpenSSL SSLEngine used the buffer position directly as the index into the array returned by ByteBuffer.array(). For a heap buffer that is a view of a larger array, for example the result of slicing the buffer at a non-zero position, the index into the backing array is the array offset plus the position. The unadjusted position caused the engine to read from and write to the wrong offset, silently corrupting the application data of any wrap or unwrap call that used such a buffer. The buffers Tomcat itself passes to the engine are all direct or have a zero array offset, so this went unnoticed internally. It is a regression against the JNI based implementation, which uses ByteBuffer get and put methods that take the array offset into account implicitly. --- .../apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java index 556f9854e8..a5c2ae2acf 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java @@ -251,7 +251,7 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn final int len = Math.min(src.remaining(), MAX_PLAINTEXT_LENGTH); MemorySegment srcSegment = src.isDirect() ? MemorySegment.ofBuffer(src) : bufSegment; if (!src.isDirect()) { - MemorySegment.copy(src.array(), pos, bufSegment, ValueLayout.JAVA_BYTE, 0, len); + MemorySegment.copy(src.array(), src.arrayOffset() + pos, bufSegment, ValueLayout.JAVA_BYTE, 0, len); } final int sslWrote = SSL_write(ssl, srcSegment, len); if (sslWrote > 0) { @@ -274,7 +274,7 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn final int len = src.remaining(); MemorySegment srcSegment = src.isDirect() ? MemorySegment.ofBuffer(src) : bufSegment; if (!src.isDirect()) { - MemorySegment.copy(src.array(), pos, bufSegment, ValueLayout.JAVA_BYTE, 0, len); + MemorySegment.copy(src.array(), src.arrayOffset() + pos, bufSegment, ValueLayout.JAVA_BYTE, 0, len); } final int netWrote = BIO_write(networkBIO, srcSegment, len); if (netWrote > 0) { @@ -299,7 +299,8 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn final int sslRead = SSL_read(ssl, dstSegment, len); if (sslRead > 0) { if (!dst.isDirect()) { - MemorySegment.copy(dstSegment, ValueLayout.JAVA_BYTE, 0, dst.array(), pos, sslRead); + MemorySegment.copy(dstSegment, ValueLayout.JAVA_BYTE, 0, dst.array(), dst.arrayOffset() + pos, + sslRead); } dst.position(pos + sslRead); return sslRead; @@ -322,7 +323,8 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn final int bioRead = BIO_read(networkBIO, dstSegment, pending); if (bioRead > 0) { if (!dst.isDirect()) { - MemorySegment.copy(dstSegment, ValueLayout.JAVA_BYTE, 0, dst.array(), pos, bioRead); + MemorySegment.copy(dstSegment, ValueLayout.JAVA_BYTE, 0, dst.array(), dst.arrayOffset() + pos, + bioRead); } dst.position(pos + bioRead); return bioRead; --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
