Promptly freeing the per-thread cached direct buffers when a thread exits

[Alan Bateman]

On 21/06/2018 21:13, Florian Weimer wrote:
> * Tony Printezis:
>
>> There are a few obvious ways to mitigate this, e.g., cause a Full GC /
>> concurrent GC cycle at regular intervals. However, the best solution IMHO
>> is to explicitly free any direct buffers that are still in the cache when a
>> thread exits.
> Why is this safe?  Couldn't these direct byte buffers be used with a
> custom channel that leaks them to another thread?
The temporary direct buffer mechanism is internal to java.base so it 
should never be used with custom channel implementations. There may be 
some pre-existing issues with the FileChannel transferXXX methods when 
called with an untrusted source/sink that will need to be audited but 
this is not something that I can discuss on this mailing list.

-Alan