This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 08828b121852b72923402d30a1a16c56783c9f12 Author: opencode <[email protected]> AuthorDate: Fri Oct 16 07:59:20 2026 +0200 Make the lazily parsed wrapped certificate field volatile in OpenSSLX509Certificate OpenSSLX509Certificate lazily parses its final DER bytes into a JDK X509Certificate in the unsynchronized unwrap() method. Instances are cached in the engine peer-certificate array which is handed out repeatedly to potentially concurrent application threads through SSLSession.getPeerCertificates() and getPeerPrincipal(). Without volatile there is no happens-before edge from the parse in one thread to a read in another, so a thread may never observe the parsed certificate and re-parse the DER bytes on every call, and in principle could observe a partially initialized certificate object. Marking the field volatile makes the lazy publication safe; the remaining benign check-then-act race is an idempotent redundant parse, matching the existing lock-free design. Applied to both the JNI and the Panama implementations. --- java/org/apache/tomcat/util/net/openssl/OpenSSLX509Certificate.java | 2 +- .../apache/tomcat/util/net/openssl/panama/OpenSSLX509Certificate.java | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/java/org/apache/tomcat/util/net/openssl/OpenSSLX509Certificate.java b/java/org/apache/tomcat/util/net/openssl/OpenSSLX509Certificate.java index 81d1aa3f88..c7887507ec 100644 --- a/java/org/apache/tomcat/util/net/openssl/OpenSSLX509Certificate.java +++ b/java/org/apache/tomcat/util/net/openssl/OpenSSLX509Certificate.java @@ -35,7 +35,7 @@ import java.util.Set; final class OpenSSLX509Certificate extends X509Certificate { private final byte[] bytes; - private X509Certificate wrapped; + private volatile X509Certificate wrapped; OpenSSLX509Certificate(byte[] bytes) { this.bytes = bytes; diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLX509Certificate.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLX509Certificate.java index 0011c1be54..3f9aa69d81 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLX509Certificate.java +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLX509Certificate.java @@ -35,7 +35,7 @@ import java.util.Set; final class OpenSSLX509Certificate extends X509Certificate { private final byte[] bytes; - private X509Certificate wrapped; + private volatile X509Certificate wrapped; OpenSSLX509Certificate(byte[] bytes) { this.bytes = bytes; --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
