Project: Tomcat
Bug 45608 Race conditions on field countAllocated of class org.apache.catalina.core.StandardWrapper
Reported: 2008-08-10 21:27:37 | Status: resolved fixed

We found field countAllocated are accessed by allocate() and deallocate() without any protections by locks. Here is a trace log, Thread http-8081-1 id: 23 : READ [org.apache.catalina.core.StandardWrapper : allocate : 820] [org.apache.catalina.core.StandardWrapperValve : invoke : 129] [org.apache.catalina.core.StandardContextValve : invoke : 175] [org.apache.catalina.core.StandardHostValve : invoke : 128] [org.apache.catalina.valves.ErrorReportValve : invoke : 104] [org.apache.catalina.core.StandardEngineValve : invoke : 109] [org.apache.catalina.connector.CoyoteAdapter : service : 261] [org.apache.coyote.http11.Http11Processor : process : 844] [org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler : process : 581] [org.apache.tomcat.util.net.JIoEndpoint$Worker : run : 447] [java.lang.Thread : run : 735] Thread http-8081-4 id: 26 : WRITE [org.apache.catalina.core.StandardWrapper : deallocate : 871] [org.apache.catalina.core.StandardWrapperValve : invoke : 298] [org.apache.catalina.core.StandardContextValve : invoke : 175] [org.apache.catalina.core.StandardHostValve : invoke : 128] [org.apache.catalina.valves.ErrorReportValve : invoke : 104] [org.apache.catalina.core.StandardEngineValve : invoke : 109] [org.apache.catalina.connector.CoyoteAdapter : service : 261] [org.apache.coyote.http11.Http11Processor : process : 844] [org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler : process : 581] [org.apache.tomcat.util.net.JIoEndpoint$Worker : run : 447] [java.lang.Thread : run : 735] Thread http-8081-4 and http-8081-1 will access countAllocated in parallel. Since increment and decrement is *NOT* atomic, we think it is a potential race condition.

Files changed in fix:
java/org/apache/catalina/core/StandardWrapper.java