Skip to content

Commit e8458c5

Browse files
committed
Fix possible OOME in ChannelInputStream
If the buffer is read slower than than incoming data arrives, the buffer might continuing growing endlessly, finally resulting in an OOME.
1 parent db48ff8 commit e8458c5

File tree

1 file changed

+18
-0
lines changed

1 file changed

+18
-0
lines changed

src/main/java/net/schmizz/sshj/connection/channel/ChannelInputStream.java

+18
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,24 @@ public void receive(byte[] data, int offset, int len)
126126
buf.putRawBytes(data, offset, len);
127127
buf.notifyAll();
128128
}
129+
130+
// For slow readers, wait until the buffer has been completely read; this ensures that the buffer will be cleared
131+
// in #read and the window position will be reset to 0. Otherwise, if the buffer is read slower than incoming data
132+
// arrives, the buffer might continuing growing endlessly, finally resulting in an OOME.
133+
// Note, that the buffer may still double its size once (provided that the maximum received chunk size is less
134+
// than chan.getLocalMaxPacketSize).
135+
for (; ; ) {
136+
synchronized (buf) {
137+
if (buf.wpos() >= chan.getLocalMaxPacketSize() && buf.available() > 0) {
138+
buf.notifyAll();
139+
Thread.yield();
140+
}
141+
else {
142+
break;
143+
}
144+
}
145+
}
146+
129147
// Potential fix for #203 (window consumed below 0).
130148
// This seems to be a race condition if we receive more data, while we're already sending a SSH_MSG_CHANNEL_WINDOW_ADJUST
131149
// And the window has not expanded yet.

0 commit comments

Comments
 (0)