Repository navigation
Potential integer overflow in ExecutorConfigurationSupport.setAwaitTerminationSeconds(int) and AbstractResourceBasedMessageSource.setCacheSeconds(int) #25613
Description
Affects: 5.2.8.RELEASE
There is a small bug in the class org.springframework.scheduling.concurrent.ExecutorConfigurationSupport
in the method :
public void setAwaitTerminationSeconds(int awaitTerminationSeconds) {
this.awaitTerminationMillis = awaitTerminationSeconds * 1000;
}When the input parameter awaitTerminationSeconds is bigger then Integer.MAX_VALUE/1000
the value asigned to long this.awaitTerminationMillis can even be negative !
I recommend changing the 1000 to the 1000l long version as below
public void setAwaitTerminationSeconds(int awaitTerminationSeconds) {
this.awaitTerminationMillis = awaitTerminationSeconds * 1000l;
}
Activity
[-]Bug in method : public void setAwaitTerminationSeconds(int ) of org.springframework.scheduling.concurrent.ExecutorConfigurationSupport[/-][+]Bug in the method : public void setAwaitTerminationSeconds(int ) of org.springframework.scheduling.concurrent.ExecutorConfigurationSupport[/+][-]Bug in the method : public void setAwaitTerminationSeconds(int ) of org.springframework.scheduling.concurrent.ExecutorConfigurationSupport[/-][+]Potential integer overflow in ExecutorConfigurationSupport.setAwaitTerminationSeconds(int)[/+]jhoeller commentedon Aug 25, 2020
Thanks for spotting this! It may be rare to specify such a large value there but it still needs to work correctly.
This also applies to
AbstractResourceBasedMessageSource.setCacheSecondswhere I'll fix it the same way.Avoid potential integer overflow in seconds->millis transformation
[-]Potential integer overflow in ExecutorConfigurationSupport.setAwaitTerminationSeconds(int)[/-][+]Potential integer overflow in ExecutorConfigurationSupport.setAwaitTerminationSeconds(int) and AbstractResourceBasedMessageSource.setCacheSeconds(int)[/+]Avoid potential integer overflow in seconds->millis transformation
Avoid potential integer overflow in seconds->millis transformation
Avoid potential integer overflow in seconds->millis transformation
Avoid potential integer overflow in seconds->millis transformation
Avoid potential integer overflow in seconds->millis transformation
Avoid int overflow in expiration calculations in MockMvc and FlashMap