IT32708: Java MQ client application ArrayIndexOutOfBoundsException when using MQCCRED with TLS and SSLPEER

APAR status

• Closed as program error.

Error description

• With an IBM MQ Java Client application using the mqccred
  security exit with TLS and SSLPEER defined on the channel, the
  following exception is seen, and the connection attempt fails.
  
   java.lang.ArrayIndexOutOfBoundsException: 1985
  at com.ibm.mq.jmqi.internal.JmqiDC.readU16(JmqiDC.java:1276)
  at com.ibm.mq.exits.MQCD.readFromBuffer(MQCD.java:4456)
  at com.ibm.mq.exits.MQCD.readFromBuffer(MQCD.java:3950)
  at
  com.ibm.mq.jmqi.remote.exit.NativeExitDefinition.unpackMQCD(Nati
  veExitDefinition.java:344)
  at
  com.ibm.mq.jmqi.remote.exit.NativeExitDefinition.invoke(NativeEx
  itDefinition.java:412)
  at
  com.ibm.mq.jmqi.remote.exit.RemoteExitChain.initExit(RemoteExitC
  hain.java:1279)
  at
  com.ibm.mq.jmqi.remote.exit.RemoteExitChain.initExits(RemoteExit
  Chain.java:1241)
  at
  com.ibm.mq.jmqi.remote.impl.RemoteConnection.initSecurityExits(R
  emoteConnection.java:2296)
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users who use the mqccred exit with a Java MQ client, where the
  SVRCONN-CLNTCONN channel is also configured to use TLS, and
  there is a non-empty SSLPEER attribute in the channel
  attributes.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  The mqccred exit is written in C, and the Java code calls it by
  crossing into the native C environment, using the JNI interface.
   This C/JNI code altered the MQCD data block, to prepare it for
  use by the exit, but did not alter it back to a form that was
  consumable by the Java code.
  
  When control passed back to the Java code after the exit had
  run, the MQCD data block had an inconsistent value within the
  SSLPeerNameLength field.
  
  The Java code interpreted this to mean there were more bytes
  available after the MQCD data block, but this was in fact true.
  
  The result of this was the
  java.lang.ArrayIndexOutOfBoundsException reported in the
  application logs, or to stdout.
  

Problem conclusion

• The MQ code has been altered so that, after the C/JNI code has
  called the exit, the MQCD data block is returned to the correct
  state.  This avoids the error and no exception is seen.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.1 CD    TBC.
  v9.1 LTS   9.1.0.7
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM MQ BASE MP

• Fixed component ID

  5724H7271

Applicable component levels