[pgjdbc/pgjdbc] PR #3492: fix: ArrayIndexOutOfBounds when write big object into GSS enabled connection

pgjdbc/pgjdbc GitHub issues and pull requests (mirror)  
help / color / mirror / Atom feed

From: Sasasu (@Sasasu) <[email protected]>
To: pgjdbc/pgjdbc <[email protected]>
Subject: [pgjdbc/pgjdbc] PR #3492: fix: ArrayIndexOutOfBounds when write big object into GSS enabled connection
Date: Wed, 22 Jan 2025 08:33:27 +0000
Message-ID: <[email protected]> (raw)

fix this error stack

```
java.lang.ArrayIndexOutOfBoundsException: null
        at java.security.jgss/sun.security.jgss.GSSContextImpl.unwrap
        at sun.security.jgss.GSSContextImpl.wrap(GSSContextImpl.java:385)
        at org.postgresql.gss.GSSOutputStream.writeWrapped(GSSOutputStream.java:52)
        at org.postgresql.gss.GSSOutputStream.write(GSSOutputStream.java:76)
        at java.io.FilterOutputStream.write(FilterOutputStream.java:97)
        at org.postgresql.core.PGStream.send(PGStream.java:398)
```

`GSSOutputStream` does not handle the buffer switch correctly, when a message is bigger than the GSS buffer, GSSOutputStream will pass the input buffer offset as the GSS buffer offset into GSSContext. The offset is much bigger than the GSS buffer, so will cause ArrayIndexOutOfBounds.

Fix this by adding the buffer switch logic into `GSSOutputStream.write()` and also adding a test to demo how to reproduce this bug.

### All Submissions:

* [x] Have you followed the guidelines in our [Contributing](https://github.com/pgjdbc/pgjdbc/blob/master/CONTRIBUTING.md) document?
* [x] Have you checked to ensure there aren't other open [Pull Requests](../../pulls) for the same update/change?

### New Feature Submissions:

1. [x] Does your submission pass tests?
2. [x] Does `./gradlew styleCheck` pass ?
3. [x] Have you added your new test classes to an existing test suite in alphabetical order?

### Changes to Existing Features:

* [x] Not breaking existing behaviour
* [x] Have you added an explanation of what your changes do and why you'd like us to include them?
* [x] Have you written new tests for your core changes, as applicable?
* [x] Have you successfully run tests with your changes locally?

view thread (13+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: github://pgjdbc/pgjdbc
  Cc: [email protected], [email protected]
  Subject: Re: [pgjdbc/pgjdbc] PR #3492: fix: ArrayIndexOutOfBounds when write big object into GSS enabled connection
  In-Reply-To: <<[email protected]>>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox