You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by re...@apache.org on 2026/09/29 18:49:24 UTC
(tomcat) 07/14: Prevent oversized 'idle' values from expiring all sessions via integer overflow in the sessions/expire command
This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 527314bd98c0fb11c8b98a85e29697e80275e271
Author: opencode <re...@apache.org>
AuthorDate: Tue Sep 29 19:16:34 2026 +0200
Prevent oversized 'idle' values from expiring all sessions via integer overflow in the sessions/expire command
---
java/org/apache/catalina/ant/SessionsTask.java | 7 ++++++-
java/org/apache/catalina/manager/ManagerServlet.java | 2 +-
2 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/java/org/apache/catalina/ant/SessionsTask.java b/java/org/apache/catalina/ant/SessionsTask.java
index a6bf92c602..94184c0eb4 100644
--- a/java/org/apache/catalina/ant/SessionsTask.java
+++ b/java/org/apache/catalina/ant/SessionsTask.java
@@ -65,7 +65,12 @@ public class SessionsTask extends AbstractCatalinaCommandTask {
if (path != null && idle != null) {
buffer.append("&idle=");
try {
- buffer.append(Integer.valueOf(idle));
+ int idleMinutes = Integer.parseInt(idle);
+ if (idleMinutes < 0 || idleMinutes > Integer.MAX_VALUE / 60) {
+ throw new BuildException("Invalid 'idle' attribute (must be a non-negative integer no greater "
+ + "than " + (Integer.MAX_VALUE / 60) + "): [" + idle + "]");
+ }
+ buffer.append(idleMinutes);
} catch (NumberFormatException nfe) {
throw new BuildException("Invalid 'idle' attribute (must be an integer): [" + idle + "]", nfe);
}
diff --git a/java/org/apache/catalina/manager/ManagerServlet.java b/java/org/apache/catalina/manager/ManagerServlet.java
index 953b5f6a6c..0c55535fa4 100644
--- a/java/org/apache/catalina/manager/ManagerServlet.java
+++ b/java/org/apache/catalina/manager/ManagerServlet.java
@@ -1288,7 +1288,7 @@ public class ManagerServlet extends HttpServlet implements ContainerServlet {
int expired = 0;
for (Session session : sessions) {
int time = (int) (session.getIdleTimeInternal() / 1000L);
- if (idle >= 0 && time >= idle * 60) {
+ if (idle >= 0 && time >= (long) idle * 60) {
session.expire();
expired++;
}
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org