-
Bug
-
Resolution: Done
-
Critical
-
2.2.19.Final
-
None
This may manifest in an infinite hot loop as the caller and callee disagree about whether or not data remains in the source buffers.
In this loop, 'length' of the buffers should be written, however length is used as a limit rather than length:
https://github.com/undertow-io/undertow/blob/e11eba5695c4bf09ed50f298765b876f01f9745c/core/src/main/java/io/undertow/conduits/ChunkedStreamSinkConduit.java#L216-L222
for (int i = offset; i < length; ++i) { if (srcs[i].hasRemaining()) { return write(srcs[i]); } }
should be
for (int i = offset; i < offset + length; ++i) { if (srcs[i].hasRemaining()) { return write(srcs[i]); } }
- is incorporated by
-
WFCORE-6057 Upgrade Undertow to 2.3.0.Final (CVE-2022-2764)
- Closed
-
WFLY-17017 Upgrade Undertow to 2.3.0.Beta1
- Closed
-
WFCORE-6056 Upgrade Undertow to 2.3.0.Beta1
- Closed
-
WFLY-17107 Upgrade Undertow legacy to 2.2.20.Final
- Closed