(tomcat) 12/16: Report a content length of Integer.MAX_VALUE as an int

[re...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rmaucher pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit 138c3a320e80da8952f2c8af986a881727ef0244
Author: opencode <re...@apache.org>
AuthorDate: Mon Oct 12 23:32:36 2026 +0200

    Report a content length of Integer.MAX_VALUE as an int
    
    The int form of getContentLength() in the coyote Request and Response
    classes narrowed the long value only when it was strictly less than
    Integer.MAX_VALUE. A content length of exactly Integer.MAX_VALUE is
    representable as an int but was reported as -1, the value that signals
    an unknown length. For the Response this also contradicted the
    documented contract of the method, which states that -1 is returned
    when the length exceeds Integer.MAX_VALUE.
    
    Change the comparison so that a content length of exactly
    Integer.MAX_VALUE is returned as an int. Applications that set or
    receive such a length now observe it through the int based API instead
    of -1. No internal component treats the previously returned -1 and the
    now returned Integer.MAX_VALUE differently in a way that introduces a
    new failure mode. The code paths that consume large content lengths,
    for example the POST size check during parameter parsing, were already
    exposed to values close to Integer.MAX_VALUE before this change.
    
    Document the -1 return value in the Javadoc of the Request method.
    Add boundary tests for Integer.MAX_VALUE and Integer.MAX_VALUE plus
    one, as well as for the default unknown length.
---
 java/org/apache/coyote/Request.java      |  5 +++--
 java/org/apache/coyote/Response.java     |  2 +-
 test/org/apache/coyote/TestRequest.java  | 14 ++++++++++++++
 test/org/apache/coyote/TestResponse.java | 14 ++++++++++++++
 4 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/java/org/apache/coyote/Request.java b/java/org/apache/coyote/Request.java
index 18db330afd..c5b8fd80f1 100644
--- a/java/org/apache/coyote/Request.java
+++ b/java/org/apache/coyote/Request.java
@@ -660,12 +660,13 @@ public final class Request {
     /**
      * Return the content length.
      *
-     * @return the content length
+     * @return the content length, or -1 if the length is unknown or exceeds
+     *             Integer.MAX_VALUE
      */
     public int getContentLength() {
         long length = getContentLengthLong();
 
-        if (length < Integer.MAX_VALUE) {
+        if (length <= Integer.MAX_VALUE) {
             return (int) length;
         }
         return -1;
diff --git a/java/org/apache/coyote/Response.java b/java/org/apache/coyote/Response.java
index b0de0cbc77..6f05860289 100644
--- a/java/org/apache/coyote/Response.java
+++ b/java/org/apache/coyote/Response.java
@@ -752,7 +752,7 @@ public final class Response {
     public int getContentLength() {
         long length = getContentLengthLong();
 
-        if (length < Integer.MAX_VALUE) {
+        if (length <= Integer.MAX_VALUE) {
             return (int) length;
         }
         return -1;
diff --git a/test/org/apache/coyote/TestRequest.java b/test/org/apache/coyote/TestRequest.java
index 7be14c088f..a86388dd2a 100644
--- a/test/org/apache/coyote/TestRequest.java
+++ b/test/org/apache/coyote/TestRequest.java
@@ -172,6 +172,20 @@ public class TestRequest {
     }
 
 
+    @Test
+    public void testGetContentLengthIntegerMaxValue() {
+        Request newRequest = new Request();
+
+        Assert.assertEquals(-1, newRequest.getContentLength());
+
+        newRequest.setContentLength(Integer.MAX_VALUE);
+        Assert.assertEquals(Integer.MAX_VALUE, newRequest.getContentLength());
+
+        newRequest.setContentLength(Integer.MAX_VALUE + 1L);
+        Assert.assertEquals(-1, newRequest.getContentLength());
+    }
+
+
     private void configureMockForOneAcknowledgementWrite(SocketWrapperBase<?> socketWrapper) throws IOException {
         EasyMock.reset(socketWrapper);
         socketWrapper.write(true, Constants.ACK_BYTES, 0, Constants.ACK_BYTES.length);
diff --git a/test/org/apache/coyote/TestResponse.java b/test/org/apache/coyote/TestResponse.java
index 522d30e2e9..153ce03e30 100644
--- a/test/org/apache/coyote/TestResponse.java
+++ b/test/org/apache/coyote/TestResponse.java
@@ -125,6 +125,20 @@ public class TestResponse extends TomcatBaseTest {
     }
 
 
+    @Test
+    public void testGetContentLengthIntegerMaxValue() {
+        Response response = new Response();
+
+        Assert.assertEquals(-1, response.getContentLength());
+
+        response.setContentLength(Integer.MAX_VALUE);
+        Assert.assertEquals(Integer.MAX_VALUE, response.getContentLength());
+
+        response.setContentLength(Integer.MAX_VALUE + 1L);
+        Assert.assertEquals(-1, response.getContentLength());
+    }
+
+
     private static class ContentTypeServlet extends HttpServlet {
 
         private static final long serialVersionUID = 1L;


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org