This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 11.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit ab1b1e0fd3b7d3f5133c3703a85af8c1c88c146a Author: opencode <[email protected]> AuthorDate: Sat Oct 17 12:46:36 2026 +0200 Fix 32-bit truncation of the session close timeout WsSession.getSessionCloseTimeout() read the Long value of the org.apache.tomcat.websocket.SESSION_CLOSE_TIMEOUT user property with intValue(), silently truncating it to 32 bits. A configured timeout greater than 2^31-1 ms (~24.8 days) was misinterpreted: a value whose low 32 bits are negative (e.g. 30 days) was rejected by the check for a non-positive value and silently replaced with the 30 second default, while other large values were silently shortened to their low 32 bits. Use longValue(), matching the sibling methods getAbnormalSessionCloseSendTimeout() and getBlockingSendTimeout(). The close timeout expiry is compared using the wrap-safe System.nanoTime() subtraction form, so the now usable full long range does not introduce any overflow related regression. --- java/org/apache/tomcat/websocket/WsSession.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java/org/apache/tomcat/websocket/WsSession.java b/java/org/apache/tomcat/websocket/WsSession.java index 9f3ed1c01a..1569654e0f 100644 --- a/java/org/apache/tomcat/websocket/WsSession.java +++ b/java/org/apache/tomcat/websocket/WsSession.java @@ -698,7 +698,7 @@ public class WsSession implements Session { long result = 0; Object obj = userProperties.get(Constants.SESSION_CLOSE_TIMEOUT_PROPERTY); if (obj instanceof Long) { - result = ((Long) obj).intValue(); + result = ((Long) obj).longValue(); } if (result <= 0) { result = Constants.DEFAULT_SESSION_CLOSE_TIMEOUT; --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
