Bug 62176

Whe using Apache POI, a single instance of DefaultTempFileCreationStrategy is created and used by the org.apache.poi.util.TempFile static class.

This means that this component is shared by the whole Java application in which POI is used.

Assuming an application is processing two Excel files in parallel via Apache POI, it will end up calling DefaultTempFileCreationStrategy#createTempDirectory(java.io.File) in order to create the '/tmp/poifiles' directory (default name on Linux system).

This code will then be run:

private void createTempDirectory(File directory) throws IOException {
    // create directory if it doesn't exist
    final boolean dirExists = (directory.exists() || directory.mkdirs());

    // snip
}

Let's say this method is being called at the same time in the same JVM by thread A and thread B

1) Thread A and Thread B execute directory.exists(). Both calls return 'false' as the directory does not exist yet

2) Thread A and Thread B start executing directory.mkdirs() up until the part where the directory existence is checked

3) Thread A creates the directory first: mkdirs() returns true. Thread B fails to create the directory and mkdirs() returns false.

4) An IOException will be thrown in Thread B


To make this method Thread-safe, a synchronized block could be added to the method, with a lock on the whole class.