tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Konstantin Preißer <>
Subject BufferOverflowException in Tomcat 7.0.x at AjpAprProcessor.output()
Date Fri, 20 Apr 2012 21:47:06 GMT
Hi all,

some time ago, I wrote about a BufferOverflowException which I got sporadically on my Tomcat
7.0.21 [1], when using the AJP-APR-Connector.
However, at that time I couldn't reproduce the exception.

When I looked at this again today, I was able to create a client that sends an AJP message
and aborts the connection, resulting in the BufferOverflowException in Tomcat. I was using
Tomcat 7.0.27 with Tomcat Native 1.1.23, on Oracle JDK 1.7.0_03 and Windows 7 32-bit.

To reproduce,

1. On the Server side, create a web application containing a servlet which will generate some
random data:

public class MyTestServlet extends HttpServlet {
    private static final long serialVersionUID = 1L;
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws
ServletException, IOException {
        try {
            byte[] bytesToWrite = {48, 49, 50, 51, 52, 53, 54, 55, 56, 57};
            // Try to write 1,000,000 bytes to the client.
            try (OutputStream out = response.getOutputStream()) {
                for (int i = 0; i < 100000; i++) {
        } catch (IOException ex) {
            // Ignore

Deploy the application as ROOT, so that the servlet will be reachable at "/".
Configure Tomcat to have an AJP-APR connector listening on port 8009.

2. On the client side, create a program like this:

public class AjpTester {
    public static void main(String[] args) throws IOException {

        byte[] ajpPacketBytes = { // JK_AJP13_FORWARD_REQUEST for "/"
            0x12, 0x34, 0x00, 0x54, 0x02, 0x02, 0x00, 0x08,
            0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31,
            0x00, 0x00, 0x01, 0x2f, 0x00, 0x00, 0x07, 0x31,
            0x2e, 0x32, 0x2e, 0x33, 0x2e, 0x34, 0x00, 0x00,
            0x07, 0x31, 0x2e, 0x32, 0x2e, 0x33, 0x2e, 0x34,
            0x00, 0x00, 0x09, 0x6c, 0x6f, 0x63, 0x61, 0x6c,
            0x68, 0x6f, 0x73, 0x74, 0x00, 0x00, 0x50, 0x00,
            0x00, 0x02, (byte)0xa0, 0x06, 0x00, 0x0a, 0x4b, 0x65,
            0x65, 0x70, 0x2d, 0x41, 0x6c, 0x69, 0x76, 0x65,
            0x00, (byte)0xa0, 0x0b, 0x00, 0x09, 0x6c, 0x6f, 0x63,
            0x61, 0x6c, 0x68, 0x6f, 0x73, 0x74, 0x00, (byte)0xff

        Socket s = new Socket("localhost", 8009); // connect to AJP port
        OutputStream sout = s.getOutputStream();
        InputStream sin = s.getInputStream();

        sout.write(ajpPacketBytes); // request Url "/"

        // Read between 10,000 and 11,023 bytes, then exit the JVM
        byte[] buf = new byte[1024];
        int read;
        int bytesRead = 0;
        while ((read = > 0) {
            bytesRead += read;
            if (bytesRead >= 10000) {

The client will send an JK_AJP13_FORWARD_REQUEST message which requests URL "/" and sends
"Connection: keep-alive" and "Host: localhost" headers.

3. Tomcat will display this exception:

Apr 20, 2012 10:57:08 PM org.apache.coyote.ajp.AjpAprProcessor process
Schwerwiegend: Error processing request
	at java.nio.DirectByteBuffer.put(
	at org.apache.coyote.ajp.AjpAprProcessor.output(
	at org.apache.coyote.ajp.AbstractAjpProcessor$SocketOutputBuffer.doWrite(
	at org.apache.coyote.Response.doWrite(
	at org.apache.catalina.connector.OutputBuffer.realWriteBytes(
	at org.apache.tomcat.util.buf.ByteChunk.flushBuffer(
	at org.apache.catalina.connector.OutputBuffer.doFlush(
	at org.apache.catalina.connector.OutputBuffer.close(
	at org.apache.catalina.connector.Response.finishResponse(
	at org.apache.catalina.connector.CoyoteAdapter.service(
	at org.apache.coyote.ajp.AjpAprProcessor.process(
	at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(
	at java.util.concurrent.ThreadPoolExecutor.runWorker(
	at java.util.concurrent.ThreadPoolExecutor$

I guess the exception itself is harmless, but it may fill up log files, if clients disconnect
frequently while receiving data.
Note that before that exception occurs, a regular "ClientAbortException:
Failed to send AJP message" is thrown by org.apache.catalina.connector.OutputBuffer.realWriteBytes(

The exception occurs neither with AJP-BIO nor with AJP-NIO.

Konstantin Preißer


To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message