stan/jdk-24
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

8214129: SSL session resumption/SNI with TLS1.2 causes StackOverflowError

Browse Source 
Reviewed-by: xuelei, jjiang
This commit is contained in:
Jamil Nimeh 2018-12-06 22:05:31 -08:00
parent ffccf955f5
commit 9947fc1532
2 changed files with 19 additions and 10 deletions
src/java.base/share/classes/sun/security/ssl
SSLSessionImpl.javaServerNameExtension.java

19
src/java.base/share/classes/sun/security/ssl/SSLSessionImpl.java

@ -176,7 +176,11 @@ final class SSLSessionImpl extends ExtendedSSLSession {
/*
* Record a new session, using a given cipher spec, session ID,
* and creation time
* and creation time.
* Note: For the unmodifiable collections and lists we are creating new
* collections as inputs to avoid potential deep nesting of
* unmodifiable collections that can cause StackOverflowErrors
* (see JDK-6323374).
*/
SSLSessionImpl(HandshakeContext hc,
CipherSuite cipherSuite, SessionId id, long creationTime) {
@ -187,10 +191,11 @@ final class SSLSessionImpl extends ExtendedSSLSession {
this.port = hc.conContext.transport.getPeerPort();
this.localSupportedSignAlgs = hc.localSupportedSignAlgs == null ?
Collections.emptySet() :
Collections.unmodifiableCollection(hc.localSupportedSignAlgs);
Collections.unmodifiableCollection(
new ArrayList<>(hc.localSupportedSignAlgs));
this.serverNameIndication = hc.negotiatedServerName;
this.requestedServerNames = Collections.<SNIServerName>unmodifiableList(
hc.getRequestedServerNames());
this.requestedServerNames = Collections.unmodifiableList(
new ArrayList<>(hc.getRequestedServerNames()));
if (hc.sslConfig.isClientMode) {
this.useExtendedMasterSecret =
(hc.handshakeExtensions.get(
@ -219,10 +224,8 @@ final class SSLSessionImpl extends ExtendedSSLSession {
this.host = baseSession.getPeerHost();
this.port = baseSession.getPeerPort();
this.localSupportedSignAlgs =
baseSession.localSupportedSignAlgs == null ?
Collections.emptySet() :
Collections.unmodifiableCollection(
baseSession.localSupportedSignAlgs);
baseSession.localSupportedSignAlgs == null ?
Collections.emptySet() : baseSession.localSupportedSignAlgs;
this.peerSupportedSignAlgs =
baseSession.getPeerSupportedSignatureAlgorithms();
this.serverNameIndication = baseSession.serverNameIndication;

10
src/java.base/share/classes/sun/security/ssl/ServerNameExtension.java

@ -82,9 +82,15 @@ final class ServerNameExtension {
// +2: Name length
final List<SNIServerName> serverNames;
/*
* Note: For the unmodifiable collection we are creating new
* collections as inputs to avoid potential deep nesting of
* unmodifiable collections that can cause StackOverflowErrors
* (see JDK-6323374).
*/
private CHServerNamesSpec(List<SNIServerName> serverNames) {
this.serverNames =
Collections.<SNIServerName>unmodifiableList(serverNames);
this.serverNames = Collections.<SNIServerName>unmodifiableList(
new ArrayList<>(serverNames));
}
private CHServerNamesSpec(ByteBuffer buffer) throws IOException {