Uploaded image for project: 'EJB Client Library (AS7+)'
  1. EJB Client Library (AS7+)
  2. EJBCLIENT-378

CVE-2020-14297 EJBTransactionOperations.executeSimpleInvocation not removing invocationTransaction

XMLWordPrintable

    Similar to EJBCLIENT-376, but a bit different

    org.jboss.ejb.protocol.remote.EJBTransactionOperations$PlainTransactionInvocations are accumulating in the InvocationTracker. That wouldn't seem to be impacted by this patch:

    Looks like those are added here:

    https://github.com/wildfly/jboss-ejb-client/blob/c60aac6d1b6586e0a9ce5c26185cdcbafc5dab1c/src/main/java/org/jboss/ejb/protocol/remote/EJBTransactionOperations.java#L91

    And we see that taking place in the thread dump:

     "default-threads - 6" #1677 prio=5 os_prio=0 tid=0x000000000c6cd800 nid=0x3f1a runnable [0x00007f4c94b7e000]
       java.lang.Thread.State: RUNNABLE
    	at org.jboss.remoting3._private.IntIndexHashMap.doGet(IntIndexHashMap.java:521)
    	at org.jboss.remoting3._private.IntIndexHashMap.containsKey(IntIndexHashMap.java:178)
    	at org.jboss.remoting3.util.InvocationTracker.addInvocation(InvocationTracker.java:122)
    	at org.jboss.ejb.protocol.remote.EJBTransactionOperations.executeSimpleInvocation(EJBTransactionOperations.java:91)
    	at org.jboss.ejb.protocol.remote.EJBTransactionOperations.commit(EJBTransactionOperations.java:86)
    	at org.wildfly.transaction.client.provider.remoting.RemotingRemoteTransactionPeer$1.commit(RemotingRemoteTransactionPeer.java:193)
    	at org.wildfly.transaction.client.SubordinateXAResource.commit(SubordinateXAResource.java:170)
    	at com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelCommit(XAResourceRecord.java:473)
    	at com.arjuna.ats.arjuna.coordinator.BasicAction.doCommit(BasicAction.java:2892)
    	at com.arjuna.ats.arjuna.coordinator.BasicAction.doCommit(BasicAction.java:2808)
    	at com.arjuna.ats.arjuna.coordinator.BasicAction.phase2Commit(BasicAction.java:1873)
    	- locked <0x000000075d83cc48> (a com.arjuna.ats.internal.jta.transaction.arjunacore.AtomicAction)
    	at com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1529)
    	- locked <0x000000075d83cc48> (a com.arjuna.ats.internal.jta.transaction.arjunacore.AtomicAction)
    	at com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
    	at com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
    	at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1287)
    	at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
    	at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:94)
    	at org.wildfly.transaction.client.LocalTransaction.commitAndDissociate(LocalTransaction.java:75)
    	at org.wildfly.transaction.client.ContextTransactionManager.commit(ContextTransactionManager.java:71)
    	at org.jboss.as.ejb3.inflow.MessageEndpointInvocationHandler.afterDelivery(MessageEndpointInvocationHandler.java:71)
    	at sun.reflect.GeneratedMethodAccessor194.invoke(Unknown Source)
    	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    	at java.lang.reflect.Method.invoke(Method.java:498)
    	at org.jboss.as.ejb3.inflow.AbstractInvocationHandler.handle(AbstractInvocationHandler.java:60)
    	at org.jboss.as.ejb3.inflow.MessageEndpointInvocationHandler.doInvoke(MessageEndpointInvocationHandler.java:135)
    	at org.jboss.as.ejb3.inflow.AbstractInvocationHandler.invoke(AbstractInvocationHandler.java:73)
    	at com.jboss.examples.ejb.ExampleMessageReceiver$$$endpoint45.afterDelivery(Unknown Source)
    	at org.apache.activemq.ra.MessageEndpointProxy$MessageEndpointAlive.afterDelivery(MessageEndpointProxy.java:128)
    	at org.apache.activemq.ra.MessageEndpointProxy.afterDelivery(MessageEndpointProxy.java:69)
    	at org.apache.activemq.ra.ServerSessionImpl.afterDelivery(ServerSessionImpl.java:225)
    	at org.apache.activemq.ActiveMQSession.run(ActiveMQSession.java:1059)
    

     

          flaviarnn Flavia Rainone
          rhn-support-bmaxwell Brad Maxwell
          Aaron Ogburn, Alessio Soldano, Cheng Fang, Ilia Vassilev, Ivo Studensky, Joerg Baesner, Kunjan Rathod (Inactive), Ricardo Martin Camarero, Stefano Maestri, TJ Cowhey, Tomasz Adamski, Tom Jenkinson, Tommaso Borgato
          Votes:
          0 Vote for this issue
          Watchers:
          5 Start watching this issue

            Created:
            Updated:
            Resolved: