PH24879: OUTOFMEMORY EVENT ON WEB SERVICE BAIS.CREATE()

APAR status

• Closed as program error.

Error description

• When sending an Invalid SOAP Message Application server can run
  into a situation where it will end up in allocating 2GB
  heap causing OutOfMemoryError
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  *                  version 8.5.5 and 9.0 users of              *
  *                  WebContainer                                *
  ****************************************************************
  * PROBLEM DESCRIPTION: An OutOfMemoryError could occur when    *
  *                      calling                                 *
  *                      java.io.InputStream.available().        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When an application or a third party component tries to
  allocate a buffer array to hold the input stream data, an
  OutOfMemoryError could happen if there is no check for a
  positive value, that is returned from the
  java.io.InputStream.available(), before allocating a new
  buffer.  For example:
  byte[] data = new byte[InputStream.available()]
  By default, the WebContainer implements the
  InputStream.available() and returns -1 when end of stream is
  reached.  Allocating an array with -1 results in a
  Integer.MAX_VALUE (i.e 2147483647) size being assigned and
  causes an OutOfMemoryError.
  A stack example of the problem:
  JVMDUMP039I Processing dump event "allocation",
  detail"2147483656 bytes, type byte[]" at 2020/04/16 16:12:18 -
  pleasewait.Thread=WebContainer : 187 (00007FDE74342720)
  Status=Running
  at
  com/ibm/ws/webservices/utils/BAIS.create(Ljava/io/InputStream;)L
  com/ibm/ws/webservices/utils/BAIS; (BAIS.java:74)
  at
  com/ibm/ws/webservices/utils/WebServicesInputSource.getBAISConte
  nt()Lcom/ibm/ws/webservices/utils/BAIS;(WebServicesInputSource.j
  ava:744)
  at
  com/ibm/ws/webservices/utils/WebServicesInputSource.getByteArray
  Content()[B (WebServicesInputSource.java:710)
  at
  com/ibm/ws/webservices/utils/WebServicesInputSource.getStringCon
  tent()Ljava/lang/String; (WebServicesInputSource.java:674)
  at
  com/ibm/ws/webservices/utils/WebServicesInputSource.getString()L
  java/lang/String; (WebServicesInputSource.java:425)
  at
  com/ibm/ws/webservices/engine/SOAPPart._getSOAPEnvelope()Lcom/ib
  m/ws/webservices/engine/xmlsoap/SOAPEnvelope;(SOAPPart.java:1090
  ) (Compiled Code)
  at
  com/ibm/ws/webservices/engine/SOAPPart.getAsSOAPEnvelope()Lcom/i
  bm/ws/webservices/engine/xmlsoap/SOAPEnvelope;(SOAPPart.java:628
  ) (Compiled Code)
  at
  com/ibm/ws/webservices/engine/SOAPPart.getEnvelope()Ljavax/xml/s
  oap/SOAPEnvelope; (SOAPPart.java:656) (Compiled Code)
  This problem can be avoided by checking the return value of
  InputStream.available() and not allocating a new buffer when
  it is less than 0.
  

Problem conclusion

• The WebContainer provides a new custom property to return 0
  instead of -1 when end of stream is reached for the
  InputStream.available().
  
  com.ibm.ws.webcontainer.returnZeroEndofInputStream = true
  (default is false)
  
  The fix for this APAR is targeted for inclusion in fix pack
  8.5.5.18 and 9.0.5.5.
  
  For more information, see 'Recommended Updates for
  WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R850 PSY

     UP

• R900 PSY

     UP