Skip to content

Synchronize overrides of synchronized methods (CodeQL java/non-sync-override)#234

Open
vharseko wants to merge 2 commits into
OpenIdentityPlatform:masterfrom
vharseko:features/codeql-non-sync-override
Open

Synchronize overrides of synchronized methods (CodeQL java/non-sync-override)#234
vharseko wants to merge 2 commits into
OpenIdentityPlatform:masterfrom
vharseko:features/codeql-non-sync-override

Conversation

@vharseko

@vharseko vharseko commented Jul 8, 2026

Copy link
Copy Markdown
Member

Summary

Resolves all four open java/non-sync-override CodeQL alerts. Each method
overrode a synchronized method from java.io.InputStream or
java.lang.Throwable but dropped the synchronized modifier, so a caller that
relies on the base-class locking contract silently loses it on these subtypes.
The fix restores the modifier on each override.

File Method Overrides
ByteArrayBranchingStream.java (105) mark InputStream.mark
Value.java (5059) mark InputStream.mark
Value.java (5064) reset InputStream.reset
PersistitMap.java (744) getCause Throwable.getCause

Why it is safe

  • ByteArrayBranchingStream.mark — the class already declares read,
    skip, available and reset as synchronized, and they all read/write the
    shared position / mark fields. mark was the one method mutating mark
    from position without the lock, so adding synchronized simply makes it
    consistent with its siblings.
  • Value.OldValueInputStream.mark / reset — this is the
    ObjectInputStream used to decode a Value; both methods touch the shared
    _mark / _value._next cursor. Synchronizing restores the InputStream
    contract.
  • PersistitMap.PersistitMapException.getCause — restores the
    Throwable.getCause contract for this unchecked wrapper.

Every one of these methods only reads or writes its own instance fields and
calls nothing that takes another lock, so adding synchronized cannot introduce
a lock-ordering deadlock. Single-threaded callers see no behavioural change.

Testing

mvn -o -pl commons/http-framework/core,persistit/core -am compile — BUILD SUCCESS.

…verride)

Four methods overrode a synchronized method from java.io.InputStream or
java.lang.Throwable without carrying the synchronized modifier, so a caller
that relies on the base-class locking contract loses it on these subtypes.
Restore the modifier on each override:

  - ByteArrayBranchingStream.mark: the class already synchronizes read/skip/
    available/reset, all of which share the position/mark fields; mark mutated
    mark from position without the lock, so add synchronized to match.
  - Value.OldValueInputStream.mark and reset: honour the InputStream contract
    for the ObjectInputStream used to decode a Value; both touch the shared
    _mark / _value._next cursor.
  - PersistitMap.PersistitMapException.getCause: honour the Throwable.getCause
    contract.

Each method only reads or writes its own fields, so adding synchronized cannot
introduce a lock-ordering deadlock, and single-threaded callers are unaffected.
@vharseko vharseko added bug java codeql CodeQL static-analysis findings labels Jul 8, 2026
@vharseko vharseko requested a review from maximthomas July 8, 2026 13:14
@vharseko vharseko removed the java label Jul 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug codeql CodeQL static-analysis findings

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants