(tomcat) 11/23: Bind the nonce value parameter of OCSP_request_add1_nonce as a pointer

[re...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rmaucher pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit 5aa34339b8bc6646cbbb25024776fd8b04dd4bb5
Author: opencode <re...@apache.org>
AuthorDate: Fri Oct 16 11:28:13 2026 +0200

    Bind the nonce value parameter of OCSP_request_add1_nonce as a pointer
    
    The C prototype is int OCSP_request_add1_nonce(OCSP_REQUEST *req,
    unsigned char *val, int len) but the FFM binding declared the second
    parameter with the JAVA_CHAR layout and the wrapper method accepted a
    Java char. A scalar is placed where the native code reads a pointer. The
    only call site passed (char) 0 which currently works out to a NULL
    pointer through zero-extension, but the binding was formally incorrect,
    a non-zero value would have produced an invalid pointer for OpenSSL to
    copy from, and the documented use of passing an explicit nonce value was
    impossible with this signature.
    
    Bind the parameter as a pointer, accept a MemorySegment in the wrapper
    and pass MemorySegment.NULL at the call site, as intended for generating
    a random nonce. The previous incorrect layout stemmed from hand-editing
    of the generated file; the corrected binding is what jextract itself
    generates for this prototype. No behavior change on the existing call
    path.
---
 java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java | 2 +-
 java/org/apache/tomcat/util/openssl/openssl_h.java                | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
index 96ab226282..1b9ebbe642 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
+++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
@@ -1408,7 +1408,7 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn
                 X509_STORE_CTX_set_error(x509ctx, X509_V_ERR_UNABLE_TO_GET_CRL());
                 return V_OCSP_CERTSTATUS_UNKNOWN();
             }
-            OCSP_request_add1_nonce(ocspRequest, (char) 0, -1);
+            OCSP_request_add1_nonce(ocspRequest, MemorySegment.NULL, -1);
             MemorySegment ocspRequestDerPointer = localArena.allocateFrom(ValueLayout.ADDRESS, MemorySegment.NULL);
             int requestLength = i2d_OCSP_REQUEST(ocspRequest, ocspRequestDerPointer);
             if (requestLength <= 0) {
diff --git a/java/org/apache/tomcat/util/openssl/openssl_h.java b/java/org/apache/tomcat/util/openssl/openssl_h.java
index 518bd7fb58..66b1a908c4 100644
--- a/java/org/apache/tomcat/util/openssl/openssl_h.java
+++ b/java/org/apache/tomcat/util/openssl/openssl_h.java
@@ -9132,7 +9132,7 @@ public class openssl_h {
         public static final FunctionDescriptor DESC = FunctionDescriptor.of(
             openssl_h.C_INT,
             openssl_h.C_POINTER,
-            ValueLayout.JAVA_CHAR,
+            openssl_h.C_POINTER,
             openssl_h.C_INT
         );
 
@@ -9176,7 +9176,7 @@ public class openssl_h {
      * int OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len)
      * }
      */
-    public static int OCSP_request_add1_nonce(MemorySegment req, char val, int len) {
+    public static int OCSP_request_add1_nonce(MemorySegment req, MemorySegment val, int len) {
         var mh$ = OCSP_request_add1_nonce.HANDLE;
         try {
             if (TRACE_DOWNCALLS) {


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org