JDK-8334670 : SSLSocketOutputRecord buffer miscalculation
  • Type: Bug
  • Component: security-libs
  • Sub-Component: javax.net.ssl
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2024-06-20
  • Updated: 2025-02-14
  • Resolved: 2024-06-26
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 24
24 b04Fixed
Related Reports
Blocks :  
Blocks :  
Relates :  
Description
SSLSocketOutputRecord was found to not calculate the buffer sizes correctly when it was doing a Math.min check:

~ line 170:
                int remains = (limit - offset) + (count - position);
                int fragLen = Math.min(fragLimit, remains);
                write(source, offset, fragLen);

fragLen should be:
                int fragLen = Math.min(fragLimit - count + position, limit - offset);

After this change, putting a lot of data in the HandshakeOutStream buffer resulted in no errors.  Since handshake operations are usually small, this seldom occurs.  This was not observed with application data, which would tend to be larger data sizes, so there must be other checks that mitigate this in that case.

Server failed: javax.net.ssl.SSLException: (internal_error) Range [0, 0 + 16367) out of bounds for length 1268
javax.net.ssl.SSLException: (internal_error) Range [0, 0 + 16367) out of bounds for length 1268
        at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:132)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:380)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:316)
        at java.base/sun.security.ssl.SSLSocketImpl.handleException(SSLSocketImpl.java:1713)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:470)
        at java.base/sun.security.ssl.SSLSocketImpl.ensureNegotiated(SSLSocketImpl.java:924)
        at java.base/sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:1015)
        at java.base/sun.nio.cs.StreamDecoder.readBytes(StreamDecoder.java:350)
        at java.base/sun.nio.cs.StreamDecoder.implRead(StreamDecoder.java:393)
        at java.base/sun.nio.cs.StreamDecoder.lockedRead(StreamDecoder.java:217)
        at java.base/sun.nio.cs.StreamDecoder.read(StreamDecoder.java:171)
        at java.base/java.io.InputStreamReader.read(InputStreamReader.java:190)
        at java.base/java.io.BufferedReader.fill(BufferedReader.java:160)
        at java.base/java.io.BufferedReader.implReadLine(BufferedReader.java:370)
        at java.base/java.io.BufferedReader.readLine(BufferedReader.java:347)
        at java.base/java.io.BufferedReader.readLine(BufferedReader.java:436)
        at SSLSocketBruteForceClose.runServerApplication(SSLSocketBruteForceClose.java:64)
        at SSLSocketTemplate.doServerSide(SSLSocketTemplate.java:223)
        at SSLSocketTemplate.startServer(SSLSocketTemplate.java:427)
        at SSLSocketTemplate.bootup(SSLSocketTemplate.java:341)
        at SSLSocketTemplate.run(SSLSocketTemplate.java:73)
        at SSLSocketBruteForceClose.main(SSLSocketBruteForceClose.java:48)
        at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
        at java.base/java.lang.reflect.Method.invoke(Method.java:580)
        at com.sun.javatest.regtest.agent.MainWrapper$MainTask.run(MainWrapper.java:138)
        at java.base/java.lang.Thread.run(Thread.java:1575)
Caused by: java.lang.IndexOutOfBoundsException: Range [0, 0 + 16367) out of bounds for length 1268
        at java.base/jdk.internal.util.Preconditions.outOfBounds(Preconditions.java:100)
        at java.base/jdk.internal.util.Preconditions.outOfBoundsCheckFromIndexSize(Preconditions.java:118)
        at java.base/jdk.internal.util.Preconditions.checkFromIndexSize(Preconditions.java:397)
        at java.base/java.util.Objects.checkFromIndexSize(Objects.java:417)
        at java.base/java.io.ByteArrayOutputStream.write(ByteArrayOutputStream.java:131)
        at java.base/sun.security.ssl.SSLSocketOutputRecord.encodeHandshake(SSLSocketOutputRecord.java:175)
        at java.base/sun.security.ssl.HandshakeOutStream.complete(HandshakeOutStream.java:62)
        at java.base/sun.security.ssl.SSLHandshake$HandshakeMessage.write(SSLHandshake.java:570)
Comments
A pull request was submitted for review. Branch: master URL: https://git.openjdk.org/jdk/pull/19862 Date: 2024-06-24 15:57:57 +0000
14-02-2025

Changeset: 07bc523d Author: Anthony Scarpino <ascarpino@openjdk.org> Date: 2024-06-26 22:28:33 +0000 URL: https://git.openjdk.org/jdk/commit/07bc523df85fde81bf736fedac62874d3cb11ee3
26-06-2024