apache / apache/shenyu

[BUG] ResponseDecorator double-releases the joined DataBuffer (IllegalReferenceCountException / pooled-buffer corruption)

Open Beginner friendly
#6,722 1 comment 0 reactions 0 assignees View on GitHub
priority: medium type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- Severity: Medium
- Location:
`shenyu-plugin/shenyu-plugin-base/src/main/java/org/apache/shenyu/plugin/base/support/ResponseDecorator.java:55` (first release) and `:58` (second release in `doFinally`)
-
Description:
`writeWith` does `DataBufferUtils.join(body)` into a single buffer, copies bytes via `dataBuffer.read(bytes)`, then calls `DataBufferUtils.release(dataBuffer)` at line 55 (refcount → 0, buffer returned to pool). The returned Mono then attaches `.doFinally(signalType -> DataBufferUtils.release(dataBuffer))` at line 58, which fires on every terminal signal and calls `release` again on the same buffer. On the default Netty pooled-direct-buffer runtime, the second release either throws `IllegalReferenceCountException` or releases a buffer the pool has already handed to another writer (refcount bumped back to 1 on reuse → release drops to 0 while in use), corrupting an unrelated response. Triggered on every response through `ResponseDecorator` (wired in `ServerWebExchangeUtils.java:76`).
-
Impact:
Post-write errors / connection resets / pooled-buffer corruption under load. On heap buffer factories the second release is a harmless no-op (why it survived).
-
Suggested fix:
Drop the eager `release` at line 55 and keep only the `doFinally` release; or vice-versa.
-
Confidence: High
- Related existing: none — #6444 is a different class.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with shenyu-plugin/shenyu-plugin-base/src/main/java/org/apache/shenyu/plugin/base/support/ResponseDecorator.java at lines 55 and 58, then trace its wiring from ServerWebExchangeUtils.java:76. Verify the joined DataBuffer is released exactly once across terminal signals and that pooled-buffer responses no longer produce post-write errors or corruption.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.