From 28229fe98d5818f2329cb42151c31471367f20c3 Mon Sep 17 00:00:00 2001 From: liyajie Date: Fri, 29 Nov 2024 03:44:57 +0800 Subject: [PATCH 1/1] Fix CVE-2024-4109 https://github.com/apache/tomcat/commit/8d2fe6894d6e258a6d615d7f786acca80e6020cb --- .../io/undertow/protocols/http2/HpackDecoder.java | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/core/src/main/java/io/undertow/protocols/http2/HpackDecoder.java b/core/src/main/java/io/undertow/protocols/http2/HpackDecoder.java index 8643130..f21dc1d 100644 --- a/core/src/main/java/io/undertow/protocols/http2/HpackDecoder.java +++ b/core/src/main/java/io/undertow/protocols/http2/HpackDecoder.java @@ -66,8 +66,6 @@ public class HpackDecoder { */ private int maxMemorySize; - private final StringBuilder stringBuilder = new StringBuilder(); - public HpackDecoder(int maxMemorySize) { this.maxMemorySize = maxMemorySize; headerTable = new HeaderField[DEFAULT_RING_BUFFER_SIZE]; @@ -227,19 +225,16 @@ public class HpackDecoder { if (huffman) { return readHuffmanString(length, buffer); } + StringBuilder stringBuilder = new StringBuilder(); for (int i = 0; i < length; ++i) { stringBuilder.append((char) buffer.get()); } - String ret = stringBuilder.toString(); - stringBuilder.setLength(0); - return ret; + return stringBuilder.toString(); } private String readHuffmanString(int length, ByteBuffer buffer) throws HpackException { - HPackHuffman.decode(buffer, length, stringBuilder); - String ret = stringBuilder.toString(); - stringBuilder.setLength(0); - return ret; + StringBuilder stringBuilder = new StringBuilder(length); + return stringBuilder.toString(); } private HttpString handleIndexedHeaderName(int index) throws HpackException { -- 2.43.0