IBM Support

IT32708: Java MQ client application ArrayIndexOutOfBoundsException when using MQCCRED with TLS and SSLPEER

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • With an IBM MQ Java Client application using the mqccred
    security exit with TLS and SSLPEER defined on the channel, the
    following exception is seen, and the connection attempt fails.
    
     java.lang.ArrayIndexOutOfBoundsException: 1985
    at com.ibm.mq.jmqi.internal.JmqiDC.readU16(JmqiDC.java:1276)
    at com.ibm.mq.exits.MQCD.readFromBuffer(MQCD.java:4456)
    at com.ibm.mq.exits.MQCD.readFromBuffer(MQCD.java:3950)
    at
    com.ibm.mq.jmqi.remote.exit.NativeExitDefinition.unpackMQCD(Nati
    veExitDefinition.java:344)
    at
    com.ibm.mq.jmqi.remote.exit.NativeExitDefinition.invoke(NativeEx
    itDefinition.java:412)
    at
    com.ibm.mq.jmqi.remote.exit.RemoteExitChain.initExit(RemoteExitC
    hain.java:1279)
    at
    com.ibm.mq.jmqi.remote.exit.RemoteExitChain.initExits(RemoteExit
    Chain.java:1241)
    at
    com.ibm.mq.jmqi.remote.impl.RemoteConnection.initSecurityExits(R
    emoteConnection.java:2296)
    

Local fix

Problem summary

  • ****************************************************************
    USERS AFFECTED:
    Users who use the mqccred exit with a Java MQ client, where the
    SVRCONN-CLNTCONN channel is also configured to use TLS, and
    there is a non-empty SSLPEER attribute in the channel
    attributes.
    
    
    Platforms affected:
    MultiPlatform
    
    ****************************************************************
    PROBLEM DESCRIPTION:
    The mqccred exit is written in C, and the Java code calls it by
    crossing into the native C environment, using the JNI interface.
     This C/JNI code altered the MQCD data block, to prepare it for
    use by the exit, but did not alter it back to a form that was
    consumable by the Java code.
    
    When control passed back to the Java code after the exit had
    run, the MQCD data block had an inconsistent value within the
    SSLPeerNameLength field.
    
    The Java code interpreted this to mean there were more bytes
    available after the MQCD data block, but this was in fact true.
    
    The result of this was the
    java.lang.ArrayIndexOutOfBoundsException reported in the
    application logs, or to stdout.
    

Problem conclusion

  • The MQ code has been altered so that, after the C/JNI code has
    called the exit, the MQCD data block is returned to the correct
    state.  This avoids the error and no exception is seen.
    
    ---------------------------------------------------------------
    The fix is targeted for delivery in the following PTFs:
    
    Version    Maintenance Level
    v9.1 CD    TBC.
    v9.1 LTS   9.1.0.7
    
    The latest available maintenance can be obtained from
    'WebSphere MQ Recommended Fixes'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
    
    If the maintenance level is not yet available information on
    its planned availability can be found in 'WebSphere MQ
    Planned Maintenance Release Dates'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
    ---------------------------------------------------------------
    

Temporary fix

Comments

APAR Information

  • APAR number

    IT32708

  • Reported component name

    IBM MQ BASE MP

  • Reported component ID

    5724H7271

  • Reported release

    910

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2020-04-30

  • Closed date

    2020-05-21

  • Last modified date

    2020-05-21

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    IBM MQ BASE MP

  • Fixed component ID

    5724H7271

Applicable component levels

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSYHRD","label":"IBM MQ"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Line of Business":{"code":"LOB36","label":"IBM Automation"}}]

Document Information

Modified date:
22 May 2020