[jboss-jira] [JBoss JIRA] Closed: (JBAS-4324) Race condition when checking logged on client ids

Race condition when checking logged on client ids ------------------------------------------------- Key: JBAS-4324 URL: http://jira.jboss.com/jira/browse/JBAS-4324 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Components: JMS service Affects Versions: JBossAS-4.2.0.CR1 Reporter: Adrian Brock Assigned To: Adrian Brock Fix For: JBossAS-5.0.0.Beta2, JBossAS-4.2.0.GA, JBossAS-4.0.5.SP1 The code that checks whether a client id is already logged in is not thread safe. org.jboss.mq.sm.AbstractStateManager public void addLoggedOnClientId(String ID) throws JMSException { // CHECK NOT ALREADY PRESENT synchronized (loggedOnClientIds) { if (loggedOnClientIds.contains(ID)) throw new InvalidClientIDException("This client id '" + ID + "' is already registered!"); } // CHECK THIS CLIENT ID IS ALLOWED TO BE SET MANUALLY checkLoggedOnClientId(ID); // REGISTER THE CLIENT ID synchronized (loggedOnClientIds) { loggedOnClientIds.add(ID); } if (log.isTraceEnabled()) log.trace("Client id '" + ID + "' is logged in."); } The two synchronized blocks need combining into one block after we have checked whether the client id is password protected.