Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by daguimu · Pull Request #16539 · netty/netty

daguimu · 2026-03-25T05:38:20Z

Problem

StompSubframeDecoder.skipControlCharacters() reads bytes in an infinite loop without checking if the buffer has readable bytes remaining. When a STOMP heartbeat frame (just a LF byte) arrives, the method consumes the control character and then attempts to read beyond the buffer, causing an IndexOutOfBoundsException.

Root Cause

The skipControlCharacters method has an unconditional buffer.readByte() call inside a for (;;) loop with no buffer.isReadable() guard. When the buffer contains only control characters (heartbeat), all bytes are consumed and the next readByte() fails.

Fix

Add a buffer.isReadable() check before each readByte() call. When the buffer is exhausted (heartbeat-only data), the method returns gracefully and the decoder waits for more data.

Tests Added

testHeartbeatOnlyDoesNotThrowException - Single LF heartbeat byte does not cause exception
testMultipleHeartbeatsDoNotThrowException - Multiple consecutive LF bytes handled correctly
testCarriageReturnLineFeedHeartbeat - CR+LF heartbeat handled correctly
testHeartbeatFollowedByFrame - Heartbeat before a real STOMP frame, frame decodes correctly
testHeartbeatBetweenFrames - Heartbeat between two frames, both decode correctly
testHeartbeatSentSeparatelyThenFrame - Heartbeat in separate write, then frame in second write

Impact

Minimal - only adds a single isReadable() guard. No behavioral change for normal STOMP frames.

Fixes #10678

normanmaurer · 2026-03-25T07:55:23Z

@daguimu did you sign our ICLA yet ? https://netty.io/s/icla

daguimu · 2026-03-25T08:18:43Z

@daguimu did you sign our ICLA yet ? https://netty.io/s/icla

Yes, I just signed it! 😊

… heartbeat frames StompSubframeDecoder.skipControlCharacters() reads bytes in a loop without checking if the buffer has readable bytes remaining. When a STOMP heartbeat (just a LF byte) arrives, the method consumes the control character and then attempts to read beyond the buffer, causing an IndexOutOfBoundsException. Add a buffer.isReadable() check before each readByte() call so that heartbeat-only data is handled gracefully without throwing. Fixes netty#10678

daguimu · 2026-03-25T08:26:03Z

I've rebased onto the latest 4.1. This PR is ready for merge. Thanks for the review!

normanmaurer · 2026-03-25T13:14:29Z

@daguimu thanks a lot.

…16539) ## Problem `StompSubframeDecoder.skipControlCharacters()` reads bytes in an infinite loop without checking if the buffer has readable bytes remaining. When a STOMP heartbeat frame (just a LF byte) arrives, the method consumes the control character and then attempts to read beyond the buffer, causing an IndexOutOfBoundsException. ## Root Cause The `skipControlCharacters` method has an unconditional `buffer.readByte()` call inside a `for (;;)` loop with no `buffer.isReadable()` guard. When the buffer contains only control characters (heartbeat), all bytes are consumed and the next `readByte()` fails. ## Fix Add a `buffer.isReadable()` check before each `readByte()` call. When the buffer is exhausted (heartbeat-only data), the method returns gracefully and the decoder waits for more data. ## Tests Added - `testHeartbeatOnlyDoesNotThrowException` - Single LF heartbeat byte does not cause exception - `testMultipleHeartbeatsDoNotThrowException` - Multiple consecutive LF bytes handled correctly - `testCarriageReturnLineFeedHeartbeat` - CR+LF heartbeat handled correctly - `testHeartbeatFollowedByFrame` - Heartbeat before a real STOMP frame, frame decodes correctly - `testHeartbeatBetweenFrames` - Heartbeat between two frames, both decode correctly - `testHeartbeatSentSeparatelyThenFrame` - Heartbeat in separate write, then frame in second write ## Impact Minimal - only adds a single `isReadable()` guard. No behavioral change for normal STOMP frames. Fixes #10678 (cherry picked from commit 6f6ac4b)

netty-project-bot · 2026-03-25T13:14:36Z

Auto-port PR for 4.2: #16543

netty-project-bot · 2026-03-25T13:14:37Z

Could not create auto-port PR.
Got conflicts when cherry-picking onto 5.0.

…etty#16539) ## Problem `StompSubframeDecoder.skipControlCharacters()` reads bytes in an infinite loop without checking if the buffer has readable bytes remaining. When a STOMP heartbeat frame (just a LF byte) arrives, the method consumes the control character and then attempts to read beyond the buffer, causing an IndexOutOfBoundsException. ## Root Cause The `skipControlCharacters` method has an unconditional `buffer.readByte()` call inside a `for (;;)` loop with no `buffer.isReadable()` guard. When the buffer contains only control characters (heartbeat), all bytes are consumed and the next `readByte()` fails. ## Fix Add a `buffer.isReadable()` check before each `readByte()` call. When the buffer is exhausted (heartbeat-only data), the method returns gracefully and the decoder waits for more data. ## Tests Added - `testHeartbeatOnlyDoesNotThrowException` - Single LF heartbeat byte does not cause exception - `testMultipleHeartbeatsDoNotThrowException` - Multiple consecutive LF bytes handled correctly - `testCarriageReturnLineFeedHeartbeat` - CR+LF heartbeat handled correctly - `testHeartbeatFollowedByFrame` - Heartbeat before a real STOMP frame, frame decodes correctly - `testHeartbeatBetweenFrames` - Heartbeat between two frames, both decode correctly - `testHeartbeatSentSeparatelyThenFrame` - Heartbeat in separate write, then frame in second write ## Impact Minimal - only adds a single `isReadable()` guard. No behavioral change for normal STOMP frames. Fixes netty#10678 (cherry picked from commit 6f6ac4b)

chrisvest · 2026-03-25T21:06:25Z

5.0 port: #16552

…artbeat (#16539) (#16552) 5.0 port of #16539 The code is already correct in the 5.0 branch, but it can't hurt to bring over the tests. --- ## Problem `StompSubframeDecoder.skipControlCharacters()` reads bytes in an infinite loop without checking if the buffer has readable bytes remaining. When a STOMP heartbeat frame (just a LF byte) arrives, the method consumes the control character and then attempts to read beyond the buffer, causing an IndexOutOfBoundsException. ## Root Cause The `skipControlCharacters` method has an unconditional `buffer.readByte()` call inside a `for (;;)` loop with no `buffer.isReadable()` guard. When the buffer contains only control characters (heartbeat), all bytes are consumed and the next `readByte()` fails. ## Fix Add a `buffer.isReadable()` check before each `readByte()` call. When the buffer is exhausted (heartbeat-only data), the method returns gracefully and the decoder waits for more data. ## Tests Added - `testHeartbeatOnlyDoesNotThrowException` - Single LF heartbeat byte does not cause exception - `testMultipleHeartbeatsDoNotThrowException` - Multiple consecutive LF bytes handled correctly - `testCarriageReturnLineFeedHeartbeat` - CR+LF heartbeat handled correctly - `testHeartbeatFollowedByFrame` - Heartbeat before a real STOMP frame, frame decodes correctly - `testHeartbeatBetweenFrames` - Heartbeat between two frames, both decode correctly - `testHeartbeatSentSeparatelyThenFrame` - Heartbeat in separate write, then frame in second write ## Impact Minimal - only adds a single `isReadable()` guard. No behavioral change for normal STOMP frames. Fixes #10678 (cherry picked from commit 6f6ac4b) Co-authored-by: Guimu <[email protected]>

…on heartbeat (#16543) Auto-port of #16539 to 4.2 Cherry-picked commit: 6f6ac4b --- ## Problem `StompSubframeDecoder.skipControlCharacters()` reads bytes in an infinite loop without checking if the buffer has readable bytes remaining. When a STOMP heartbeat frame (just a LF byte) arrives, the method consumes the control character and then attempts to read beyond the buffer, causing an IndexOutOfBoundsException. ## Root Cause The `skipControlCharacters` method has an unconditional `buffer.readByte()` call inside a `for (;;)` loop with no `buffer.isReadable()` guard. When the buffer contains only control characters (heartbeat), all bytes are consumed and the next `readByte()` fails. ## Fix Add a `buffer.isReadable()` check before each `readByte()` call. When the buffer is exhausted (heartbeat-only data), the method returns gracefully and the decoder waits for more data. ## Tests Added - `testHeartbeatOnlyDoesNotThrowException` - Single LF heartbeat byte does not cause exception - `testMultipleHeartbeatsDoNotThrowException` - Multiple consecutive LF bytes handled correctly - `testCarriageReturnLineFeedHeartbeat` - CR+LF heartbeat handled correctly - `testHeartbeatFollowedByFrame` - Heartbeat before a real STOMP frame, frame decodes correctly - `testHeartbeatBetweenFrames` - Heartbeat between two frames, both decode correctly - `testHeartbeatSentSeparatelyThenFrame` - Heartbeat in separate write, then frame in second write ## Impact Minimal - only adds a single `isReadable()` guard. No behavioral change for normal STOMP frames. Fixes #10678 Co-authored-by: Guimu <[email protected]>

normanmaurer approved these changes Mar 25, 2026

View reviewed changes

normanmaurer added this to the 4.2.12.Final milestone Mar 25, 2026

normanmaurer added needs-cherry-pick-4.1 This PR should be cherry-picked to 4.1 once merged. needs-cherry-pick-5.0 This PR should be cherry-picked to 5.0 once merged. labels Mar 25, 2026

daguimu force-pushed the fix/stomp-heartbeat-ioobe-10678 branch from 730f619 to 4cdc3d8 Compare March 25, 2026 08:25

normanmaurer added needs-cherry-pick-4.2 This PR should be cherry-picked to 4.2 once merged. and removed needs-cherry-pick-4.1 This PR should be cherry-picked to 4.1 once merged. labels Mar 25, 2026

normanmaurer modified the milestones: 4.2.12.Final, 4.1.133.Final Mar 25, 2026

normanmaurer merged commit 6f6ac4b into netty:4.1 Mar 25, 2026
18 checks passed

netty-project-bot mentioned this pull request Mar 25, 2026

Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat #16543

Merged

github-actions Bot removed the needs-cherry-pick-4.2 This PR should be cherry-picked to 4.2 once merged. label Mar 25, 2026

chrisvest mentioned this pull request Mar 25, 2026

5.0 port: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat (#16539) #16552

Merged

chrisvest removed the needs-cherry-pick-5.0 This PR should be cherry-picked to 5.0 once merged. label Mar 25, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat#16539

Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat#16539
normanmaurer merged 1 commit into
netty:4.1from
daguimu:fix/stomp-heartbeat-ioobe-10678

daguimu commented Mar 25, 2026

Uh oh!

normanmaurer commented Mar 25, 2026

Uh oh!

daguimu commented Mar 25, 2026

Uh oh!

daguimu commented Mar 25, 2026 •

edited

Loading

Uh oh!

Uh oh!

normanmaurer commented Mar 25, 2026

Uh oh!

netty-project-bot commented Mar 25, 2026

Uh oh!

netty-project-bot commented Mar 25, 2026

Uh oh!

chrisvest commented Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

daguimu commented Mar 25, 2026

Problem

Root Cause

Fix

Tests Added

Impact

Uh oh!

normanmaurer commented Mar 25, 2026

Uh oh!

daguimu commented Mar 25, 2026

Uh oh!

daguimu commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

normanmaurer commented Mar 25, 2026

Uh oh!

netty-project-bot commented Mar 25, 2026

Uh oh!

netty-project-bot commented Mar 25, 2026

Uh oh!

chrisvest commented Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

daguimu commented Mar 25, 2026 •

edited

Loading