From e86977394e78691807cbd8858b9f9d0632194b44 Mon Sep 17 00:00:00 2001
From: Greg Wilkins <gregw@webtide.com>
Date: Mon, 11 May 2020 21:48:06 +0200
Subject: [PATCH] Issue #4828 Buffer Corruption (#4864)

+ improve synchronization around releaseBuffer
 + improve synchronization around acquireBuffer
 + made acquireBuffer private.

Signed-off-by: Greg Wilkins <gregw@webtide.com>
---
 .../org/eclipse/jetty/server/HttpOutput.java  | 20 ++++++++++++-------
 .../jetty/server/handler/ErrorHandler.java    |  2 +-
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/jetty-server/src/main/java/org/eclipse/jetty/server/HttpOutput.java b/jetty-server/src/main/java/org/eclipse/jetty/server/HttpOutput.java
index 6102f535b60..a21fd36c53d 100644
--- a/jetty-server/src/main/java/org/eclipse/jetty/server/HttpOutput.java
+++ b/jetty-server/src/main/java/org/eclipse/jetty/server/HttpOutput.java
@@ -487,8 +487,8 @@ public class HttpOutput extends ServletOutputStream implements Runnable
         synchronized (_channelState)
         {
             _state = State.CLOSED;
+            releaseBuffer();
         }
-        releaseBuffer();
     }
 
     @Override
@@ -613,10 +613,13 @@ public class HttpOutput extends ServletOutputStream implements Runnable
 
     public ByteBuffer getBuffer()
     {
-        return _aggregate;
+        synchronized (_channelState)
+        {
+            return acquireBuffer();
+        }
     }
 
-    public ByteBuffer acquireBuffer()
+    private ByteBuffer acquireBuffer()
     {
         if (_aggregate == null)
             _aggregate = _channel.getByteBufferPool().acquire(getBufferSize(), _interceptor.isOptimizedForDirectBuffers());
@@ -1410,10 +1413,13 @@ public class HttpOutput extends ServletOutputStream implements Runnable
 
     public void resetBuffer()
     {
-        _interceptor.resetBuffer();
-        if (BufferUtil.hasContent(_aggregate))
-            BufferUtil.clear(_aggregate);
-        _written = 0;
+        synchronized (_channelState)
+        {
+            _interceptor.resetBuffer();
+            if (BufferUtil.hasContent(_aggregate))
+                BufferUtil.clear(_aggregate);
+            _written = 0;
+        }
     }
 
     @Override
diff --git a/jetty-server/src/main/java/org/eclipse/jetty/server/handler/ErrorHandler.java b/jetty-server/src/main/java/org/eclipse/jetty/server/handler/ErrorHandler.java
index 7d11d60bdd4..174d84670f6 100644
--- a/jetty-server/src/main/java/org/eclipse/jetty/server/handler/ErrorHandler.java
+++ b/jetty-server/src/main/java/org/eclipse/jetty/server/handler/ErrorHandler.java
@@ -305,7 +305,7 @@ public class ErrorHandler extends AbstractHandler
                 // TODO error page may cause a BufferOverflow.  In which case we try
                 // TODO again with stacks disabled. If it still overflows, it is
                 // TODO written without a body.
-                ByteBuffer buffer = baseRequest.getResponse().getHttpOutput().acquireBuffer();
+                ByteBuffer buffer = baseRequest.getResponse().getHttpOutput().getBuffer();
                 ByteBufferOutputStream out = new ByteBufferOutputStream(buffer);
                 PrintWriter writer = new PrintWriter(new OutputStreamWriter(out, charset));