This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 10.1.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 108be07936c53d7051d5d3239a7f29f03421eaf5 Author: opencode <[email protected]> AuthorDate: Sat Oct 17 12:46:36 2026 +0200 Fix 32-bit truncation of the session close timeout WsSession.getSessionCloseTimeout() read the Long value of the org.apache.tomcat.websocket.SESSION_CLOSE_TIMEOUT user property with intValue(), silently truncating it to 32 bits. A configured timeout greater than 2^31-1 ms (~24.8 days) was misinterpreted: a value whose low 32 bits are negative (e.g. 30 days) was rejected by the check for a non-positive value and silently replaced with the 30 second default, while other large values were silently shortened to their low 32 bits. Use longValue(), matching the sibling methods getAbnormalSessionCloseSendTimeout() and getBlockingSendTimeout(). The close timeout expiry is compared using the wrap-safe System.nanoTime() subtraction form, so the now usable full long range does not introduce any overflow related regression. --- java/org/apache/tomcat/websocket/WsSession.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java/org/apache/tomcat/websocket/WsSession.java b/java/org/apache/tomcat/websocket/WsSession.java index 90f532fd82..e8dff8d270 100644 --- a/java/org/apache/tomcat/websocket/WsSession.java +++ b/java/org/apache/tomcat/websocket/WsSession.java @@ -698,7 +698,7 @@ public class WsSession implements Session { long result = 0; Object obj = userProperties.get(Constants.SESSION_CLOSE_TIMEOUT_PROPERTY); if (obj instanceof Long) { - result = ((Long) obj).intValue(); + result = ((Long) obj).longValue(); } if (result <= 0) { result = Constants.DEFAULT_SESSION_CLOSE_TIMEOUT; --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
