[jira] [Resolved] (CAMEL-24195) camel-aws2-s3 - StreamUploadProducer race condition and timeout task exception handling

["Claus Ibsen (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-24195?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Claus Ibsen resolved CAMEL-24195.
---------------------------------
    Resolution: Fixed

Fixed via https://github.com/apache/camel/pull/24872

> camel-aws2-s3 - StreamUploadProducer race condition and timeout task exception handling
> ---------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24195
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24195
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-aws
>            Reporter: Claus Ibsen
>            Assignee: Claus Ibsen
>            Priority: Minor
>              Labels: review-2026-07
>             Fix For: 4.22.0
>
>
> Split from CAMEL-24157 (medium-severity findings, group 3).
> *StreamUploadProducer race condition and timeout task cancellation*
> {{AWS2S3StreamUploadProducer:181-183}} — {{uploadAggregate}} is read and mutated outside the lock in {{processWithoutTimestampGrouping()}}. The timeout task ({{StreamingUploadTimeoutTask.run()}}) acquires the lock and can set {{uploadAggregate = null}}. Race: main thread reads {{uploadAggregate != null}}, timeout task nulls it, main thread dereferences → NPE.
> Additionally, {{StreamingUploadTimeoutTask.run()}} does not catch exceptions from {{uploadPart()}}/{{completeUpload()}}. Since {{ScheduledExecutorService.scheduleAtFixedRate}} silently cancels all future executions when the task throws an uncaught exception, any S3 API error in the timeout task permanently disables the timeout flush mechanism for the lifetime of the producer.
> Recent CAMEL-24153 fix addressed different bugs (maxRead clamping, orphaned multipart) but did not address the lock-ordering race or exception handling.
> *Fix approach:*
> - Move the {{uploadAggregate}} reads at lines 181-183 inside the lock
> - Wrap the timeout task body in try-catch to log and continue on S3 API errors



--
This message was sent by Atlassian Jira
(v8.20.10#820010)