[BUG] ResponseDecorator double-releases the joined DataBuffer (IllegalReferenceCountException / pooled-buffer corruption)
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
- Severity: Medium
- Location:
`shenyu-plugin/shenyu-plugin-base/src/main/java/org/apache/shenyu/plugin/base/support/ResponseDecorator.java:55` (first release) and `:58` (second release in `doFinally`)
-
Description:
`writeWith` does `DataBufferUtils.join(body)` into a single buffer, copies bytes via `dataBuffer.read(bytes)`, then calls `DataBufferUtils.release(dataBuffer)` at line 55 (refcount → 0, buffer returned to pool). The returned Mono then attaches `.doFinally(signalType -> DataBufferUtils.release(dataBuffer))` at line 58, which fires on every terminal signal and calls `release` again on the same buffer. On the default Netty pooled-direct-buffer runtime, the second release either throws `IllegalReferenceCountException` or releases a buffer the pool has already handed to another writer (refcount bumped back to 1 on reuse → release drops to 0 while in use), corrupting an unrelated response. Triggered on every response through `ResponseDecorator` (wired in `ServerWebExchangeUtils.java:76`).
-
Impact:
Post-write errors / connection resets / pooled-buffer corruption under load. On heap buffer factories the second release is a harmless no-op (why it survived).
-
Suggested fix:
Drop the eager `release` at line 55 and keep only the `doFinally` release; or vice-versa.
-
Confidence: High
- Related existing: none — #6444 is a different class.
---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with shenyu-plugin/shenyu-plugin-base/src/main/java/org/apache/shenyu/plugin/base/support/ResponseDecorator.java at lines 55 and 58, then trace its wiring from ServerWebExchangeUtils.java:76. Verify the joined DataBuffer is released exactly once across terminal signals and that pooled-buffer responses no longer produce post-write errors or corruption.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 74/100