(tomcat) 14/16: Complete the CRLF state transition in ChunkedInputFilter.available()

[re...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rmaucher pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit e6170213725f66356b63c30461dc75f2b3ae0cfc
Author: opencode <re...@apache.org>
AuthorDate: Tue Oct 13 09:23:04 2026 +0200

    Complete the CRLF state transition in ChunkedInputFilter.available()
    
    When available() handled a single remaining byte in the CHUNK_BODY_CRLF
    state it ignored the result of skipCRLF(). skipCRLF() returns true only
    when it has consumed a complete CRLF, in which case the state machine
    must move to CHUNK_HEADER. The two sibling branches, for more than two
    remaining bytes and for a lone CRLF pair, both perform that transition.
    
    The transition used to be made by skipCRLF() itself. It was hoisted to
    the call sites when those paths were cleaned up, but the third call
    site was missed.
    
    The missing transition is not reachable through the current public
    APIs. For it to matter, skipCRLF() would have to complete a CRLF from
    exactly one buffered byte, which requires a previously consumed CR to
    still be pending while a single, non-LF byte is left over from the
    earlier partial parse. That state cannot currently be observed by a
    later available() call, since the read chunk is replaced rather than
    extended by each fill and a refill consumes its first byte within the
    same parse loop. The alignment is defensive: it keeps the state machine
    consistent should a future change allow available() to observe refilled
    data, avoiding a 400 for a valid chunked request.
---
 java/org/apache/coyote/http11/filters/ChunkedInputFilter.java | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java b/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java
index aa658830f8..42a4f53ad2 100644
--- a/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java
+++ b/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java
@@ -231,8 +231,10 @@ public class ChunkedInputFilter implements InputFilter, ApplicationBufferHandler
             available = readChunk.remaining();
         }
         if (available == 1 && parseState == ParseState.CHUNK_BODY_CRLF) {
-            skipCRLF();
-            // LF to read next, or failed
+            if (skipCRLF()) {
+                parseState = ParseState.CHUNK_HEADER;
+            }
+            // CRLF complete, CR consumed with LF to read next, or failed
             available = readChunk.remaining();
         } else if (available == 2 && !crFound && parseState == ParseState.CHUNK_BODY_CRLF) {
             // Just CRLF is left in the buffer. There is no data to read.


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org