This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit ec331681dbe31474373bdabf997e53eb8761b763 Author: opencode <[email protected]> AuthorDate: Sat Oct 17 12:46:36 2026 +0200 Fix 32-bit truncation of the session close timeout WsSession.getSessionCloseTimeout() read the Long value of the org.apache.tomcat.websocket.SESSION_CLOSE_TIMEOUT user property with intValue(), silently truncating it to 32 bits. A configured timeout greater than 2^31-1 ms (~24.8 days) was misinterpreted: a value whose low 32 bits are negative (e.g. 30 days) was rejected by the check for a non-positive value and silently replaced with the 30 second default, while other large values were silently shortened to their low 32 bits. Use longValue(), matching the sibling methods getAbnormalSessionCloseSendTimeout() and getBlockingSendTimeout(). The close timeout expiry is compared using the wrap-safe System.nanoTime() subtraction form, so the now usable full long range does not introduce any overflow related regression. --- java/org/apache/tomcat/websocket/WsSession.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java/org/apache/tomcat/websocket/WsSession.java b/java/org/apache/tomcat/websocket/WsSession.java index 9f3ed1c01a..1569654e0f 100644 --- a/java/org/apache/tomcat/websocket/WsSession.java +++ b/java/org/apache/tomcat/websocket/WsSession.java @@ -698,7 +698,7 @@ public class WsSession implements Session { long result = 0; Object obj = userProperties.get(Constants.SESSION_CLOSE_TIMEOUT_PROPERTY); if (obj instanceof Long) { - result = ((Long) obj).intValue(); + result = ((Long) obj).longValue(); } if (result <= 0) { result = Constants.DEFAULT_SESSION_CLOSE_TIMEOUT; --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
