Avoid potential IndexOutOfBoundsException when matching HTTP/2 preface. Submitted #551 by 刘文章.

aooohan · aooohan · commit 0feed3deb868 · 2022-09-07T15:44:06.000+08:00
diff --git a/java/org/apache/coyote/http11/Http11InputBuffer.java b/java/org/apache/coyote/http11/Http11InputBuffer.java
@@ -381,7 +381,7 @@ boolean parseRequestLine(boolean keptAlive) throws IOException {
                     // Switch to the socket timeout.
                     wrapper.setReadTimeout(wrapper.getEndpoint().getConnectionTimeout());
                 }
-                if (!keptAlive && byteBuffer.position() == 0 && byteBuffer.limit() >= CLIENT_PREFACE_START.length - 1) {
+                if (!keptAlive && byteBuffer.position() == 0 && byteBuffer.limit() >= CLIENT_PREFACE_START.length) {
                     boolean prefaceMatch = true;
                     for (int i = 0; i < CLIENT_PREFACE_START.length && prefaceMatch; i++) {
                         if (CLIENT_PREFACE_START[i] != byteBuffer.get(i)) {
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
@@ -172,6 +172,11 @@
         the maximum value to 255. Based on a PR <pr>548</pr> by Stefan Mayr.
         (lihan)
       </fix>
+      <fix>
+        <pr>551</pr>: Avoid potential IndexOutOfBoundsException by fixing
+        incorrect check when matching HTTP/2 preface. Submitted by 刘文章.
+        (lihan)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Jasper">

Original file line number	Diff line number	Diff line change
`@@ -381,7 +381,7 @@ boolean parseRequestLine(boolean keptAlive) throws IOException {`
`381`	`381`	`// Switch to the socket timeout.`
`382`	`382`	`wrapper.setReadTimeout(wrapper.getEndpoint().getConnectionTimeout());`
`383`	`383`	`}`
`384`		`- if (!keptAlive && byteBuffer.position() == 0 && byteBuffer.limit() >= CLIENT_PREFACE_START.length - 1) {`
	`384`	`+ if (!keptAlive && byteBuffer.position() == 0 && byteBuffer.limit() >= CLIENT_PREFACE_START.length) {`
`385`	`385`	`boolean prefaceMatch = true;`
`386`	`386`	`for (int i = 0; i < CLIENT_PREFACE_START.length && prefaceMatch; i++) {`
`387`	`387`	`if (CLIENT_PREFACE_START[i] != byteBuffer.get(i)) {`