Bug 57347 - AJP response contains wrong status reason phrase
Summary: AJP response contains wrong status reason phrase
Alias: None
Product: Tomcat 8
Classification: Unclassified
Component: Connectors (show other bugs)
Version: 8.0.x-trunk
Hardware: All All
: P2 normal (vote)
Target Milestone: ----
Assignee: Tomcat Developers Mailing List
: 57443 (view as bug list)
Depends on:
Reported: 2014-12-13 15:41 UTC by Rainer Jung
Modified: 2015-01-14 15:59 UTC (History)
1 user (show)


Note You need to log in before you can comment on or make changes to this bug.
Description Rainer Jung 2014-12-13 15:41:57 UTC
This problem applies to TC 8 and 9:

I get AJP responses with status code 200 but wrong reason phrase "ACT" instead of "OK".

The problem is due to the MessageBytes tmpMB being used in AbstractAjpProcessor first in prepareResponse() for processing the request, then in prepareResponse() for setting the reason phrase.

During prepareRequest() only the byte (ByteChunk) functionality of tmpMB is used, during prepareResponse() the String functionality. Now appending the reason phrase to the AJP message is done using AjpMessage.appendBytes(). This function has changed between TC 7 and TC 8 to support multiple charsets (r1630910).

In TC 7 when the MessageBytes is of type T_STR, which is the case here, the append does:


After the change in TC 8 it calls


and then uses the ByteChunk in mb. The implementation of mb.toBytes() checks, whether the ByteChunk already set before (isSet) and then doesn't do the string to ByteChunk conversion. Since the MessageBytes tmpMB was used before to read request headers and attributes, it already has a ByteChunk set, so the conversion is skipped and the old value of the ByteChunk is used. As a result the value of the last part read from the request - in my case the string "ACT" is appended as the status reason phrase.

I suggest to not change the behavior in AjpMessage.appendBytes() but instead recycle the tmpMB MessageBytes before using it in AjpProcessor.prepareResponse() (TC 9) resp. AbstractAjpProcessor.prepareResponse() (TC 8).

--- java/org/apache/coyote/ajp/AjpProcessor.java        (revision 1645245)
+++ java/org/apache/coyote/ajp/AjpProcessor.java        (working copy)
@@ -1388,6 +1388,7 @@


+        tmpMB.recycle();
         responseMsgPos = -1;


Comment 1 Rainer Jung 2014-12-13 16:17:27 UTC
Fixed for TC 9 and TC 8 (8.0.16) with r1645247 resp. r1645248.
Comment 2 Victor 2015-01-14 15:59:42 UTC
*** Bug 57443 has been marked as a duplicate of this bug. ***