PI94763: Fileupload causes NullPointerException on getHeader() call

Download Description

NOTE: Interim Fix PI90804 had a regression problem The fixes for PI90804 have been replaced for Liberty only with interim fixes PI94763. For more information, refer to the security bulletin http://www-01.ibm.com/support/docview.wss?uid=swg22011428

PI94763 resolves the following problem:

ERROR DESCRIPTION:
During a servlet request, the customer could encounter a
Null Pointer Exception when accessing the getHeader() call
because a previous call using the commons file upload
library cause a null header to be produced.

LOCAL FIX:

PROBLEM SUMMARY

USERS AFFECTED:
All users of IBM WebSphere Application
Server Liberty

PROBLEM DESCRIPTION:
NullPointerException when servlet calls
getHeader()

RECOMMENDATION:
None

During a servlet request, the customer could encounter a
NullPointerException when calling getHeader() if a previous
servlet request handled a file upload and contained an embedded
FileItem.

An example stackdump of the NPE:
Caused by: java.lang.NullPointerException
at
com.ibm.ws.webcontainer.srt.SRTServletRequestPart.getHeader(SRTS
ervletRequestPart.java:90)
at
org.springframework.web.multipart.support.StandardMultipartHttpS
ervletRequest.parseRequest(StandardMultipartHttpServletRequest.j
ava:97)
... 72 more

PROBLEM CONCLUSION:
A class in the commons fileupload library was recently patched
to address another issue, (APAR PI90804) but was missing an implementing
interface, which caused this regression. This fix adds in the
interface, which resolves the issue.

The fix for this APAR is currently targeted for inclusion in fix
pack 18.0.0.1. Please refer to the Recommended Updates page for
delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980