Skip to content

Commit

Permalink
Fix possible OOME in ChannelInputStream
Browse files Browse the repository at this point in the history
If the buffer is read slower than than incoming data arrives,
the buffer might continuing growing endlessly, finally resulting
in an OOME.
  • Loading branch information
mstrap committed Jun 21, 2018
1 parent db48ff8 commit e8458c5
Showing 1 changed file with 18 additions and 0 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,24 @@ public void receive(byte[] data, int offset, int len)
buf.putRawBytes(data, offset, len);
buf.notifyAll();
}

// For slow readers, wait until the buffer has been completely read; this ensures that the buffer will be cleared
// in #read and the window position will be reset to 0. Otherwise, if the buffer is read slower than incoming data
// arrives, the buffer might continuing growing endlessly, finally resulting in an OOME.
// Note, that the buffer may still double its size once (provided that the maximum received chunk size is less
// than chan.getLocalMaxPacketSize).
for (; ; ) {
synchronized (buf) {
if (buf.wpos() >= chan.getLocalMaxPacketSize() && buf.available() > 0) {
buf.notifyAll();
Thread.yield();
}
else {
break;
}
}
}

// Potential fix for #203 (window consumed below 0).
// This seems to be a race condition if we receive more data, while we're already sending a SSH_MSG_CHANNEL_WINDOW_ADJUST
// And the window has not expanded yet.
Expand Down

0 comments on commit e8458c5

Please sign in to comment.