(tomcat) 04/10: Synchronise the check and assignment of the servlet instance in getServletMethods() to prevent a race which could result in a second, never initialised instance being retained by the wrapper

[re...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rmaucher pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit 7c81252180bc84a683742c48de5c9da683080453
Author: opencode <re...@apache.org>
AuthorDate: Wed Sep 30 13:30:21 2026 +0200

    Synchronise the check and assignment of the servlet instance in getServletMethods() to prevent a race which could result in a second, never initialised instance being retained by the wrapper
---
 java/org/apache/catalina/core/StandardWrapper.java | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/java/org/apache/catalina/core/StandardWrapper.java b/java/org/apache/catalina/core/StandardWrapper.java
index 8224acff03..ad9b0e2200 100644
--- a/java/org/apache/catalina/core/StandardWrapper.java
+++ b/java/org/apache/catalina/core/StandardWrapper.java
@@ -413,7 +413,14 @@ public class StandardWrapper extends ContainerBase implements ServletConfig, Wra
     @Override
     public String[] getServletMethods() throws ServletException {
 
-        instance = loadServlet();
+        // Synchronise the check and the assignment of the instance to avoid a
+        // race with other threads loading the servlet which could otherwise
+        // result in a second, uninitialised instance being retained
+        synchronized (this) {
+            if (instance == null) {
+                instance = loadServlet();
+            }
+        }
 
         Class<? extends Servlet> servletClazz = instance.getClass();
         if (!jakarta.servlet.http.HttpServlet.class.isAssignableFrom(servletClazz)) {


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org