This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit e21f114924532e45dbf2ee06d2f5c770c6e04d20 Author: opencode <[email protected]> AuthorDate: Fri Oct 16 10:12:00 2026 +0200 Account for the array offset when copying between OpenSSL FFM engine buffers and heap ByteBuffers The write and read helper methods of the FFM based OpenSSL SSLEngine used the buffer position directly as the index into the array returned by ByteBuffer.array(). For a heap buffer that is a view of a larger array, for example the result of slicing the buffer at a non-zero position, the index into the backing array is the array offset plus the position. The unadjusted position caused the engine to read from and write to the wrong offset, silently corrupting the application data of any wrap or unwrap call that used such a buffer. The buffers Tomcat itself passes to the engine are all direct or have a zero array offset, so this went unnoticed internally. It is a regression against the JNI based implementation, which uses ByteBuffer get and put methods that take the array offset into account implicitly. --- .../apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java index d5bd3eabeb..682c78f04a 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java @@ -251,7 +251,7 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn final int len = Math.min(src.remaining(), MAX_PLAINTEXT_LENGTH); MemorySegment srcSegment = src.isDirect() ? MemorySegment.ofBuffer(src) : bufSegment; if (!src.isDirect()) { - MemorySegment.copy(src.array(), pos, bufSegment, ValueLayout.JAVA_BYTE, 0, len); + MemorySegment.copy(src.array(), src.arrayOffset() + pos, bufSegment, ValueLayout.JAVA_BYTE, 0, len); } final int sslWrote = SSL_write(ssl, srcSegment, len); if (sslWrote > 0) { @@ -274,7 +274,7 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn final int len = src.remaining(); MemorySegment srcSegment = src.isDirect() ? MemorySegment.ofBuffer(src) : bufSegment; if (!src.isDirect()) { - MemorySegment.copy(src.array(), pos, bufSegment, ValueLayout.JAVA_BYTE, 0, len); + MemorySegment.copy(src.array(), src.arrayOffset() + pos, bufSegment, ValueLayout.JAVA_BYTE, 0, len); } final int netWrote = BIO_write(networkBIO, srcSegment, len); if (netWrote > 0) { @@ -299,7 +299,8 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn final int sslRead = SSL_read(ssl, dstSegment, len); if (sslRead > 0) { if (!dst.isDirect()) { - MemorySegment.copy(dstSegment, ValueLayout.JAVA_BYTE, 0, dst.array(), pos, sslRead); + MemorySegment.copy(dstSegment, ValueLayout.JAVA_BYTE, 0, dst.array(), dst.arrayOffset() + pos, + sslRead); } dst.position(pos + sslRead); return sslRead; @@ -322,7 +323,8 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn final int bioRead = BIO_read(networkBIO, dstSegment, pending); if (bioRead > 0) { if (!dst.isDirect()) { - MemorySegment.copy(dstSegment, ValueLayout.JAVA_BYTE, 0, dst.array(), pos, bioRead); + MemorySegment.copy(dstSegment, ValueLayout.JAVA_BYTE, 0, dst.array(), dst.arrayOffset() + pos, + bioRead); } dst.position(pos + bioRead); return bioRead; --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
