swaldman / mchange-commons-java Goto Github PK

I have a code which creates c3p0 ComboPooledDataSource. The code is called by multiple threads concurrently. I found that those threads hang from time to time.

Here is the stacktrace when the threads hang:

"Thread-1334" daemon prio=10 tid=0x0000000040f56000 nid=0x7527 runnable [0x00007f97d5ba6000]
  java.lang.Thread.State: RUNNABLE
        at java.util.HashMap.get(HashMap.java:303)
        at com.mchange.v1.identicator.IdMap.get(IdMap.java:63)
        at com.mchange.v1.identicator.IdWeakHashMap.get(IdWeakHashMap.java:94)
        at com.mchange.v2.encounter.AbstractEncounterCounter.encounter(AbstractEncounterCounter.java:53)
        at com.mchange.v2.c3p0.impl.C3P0ImplUtils.allocateIdentityToken(C3P0ImplUtils.java:152)
        at com.mchange.v2.c3p0.impl.PoolBackedDataSourceBase.<init>(PoolBackedDataSourceBase.java:238)
        at com.mchange.v2.c3p0.impl.AbstractPoolBackedDataSource.<init>(AbstractPoolBackedDataSource.java:74)
        at com.mchange.v2.c3p0.ComboPooledDataSource.<init>(ComboPooledDataSource.java:134)
        at com.mchange.v2.c3p0.ComboPooledDataSource.<init>(ComboPooledDataSource.java:130)

HashMap.get and .set are not thread-safe. So creating ComboPooledDataSource in multiple threads concurrently causes infinite loop.

Please update the log4j 2 version to the log4j 2.17.0 and above. As the current versions are susceptible to CVE-2021-44832 Security Vulnerability.

Affected Versions
mchange-commons-java-0.2.19.jar

Hello contributors, we (Backup & DR team at Google Cloud) are using maven source plugin to pull the source jar for mchange-commons-java library but can not seem to find EPL 2.0 license file in the source jar. Could you please add the licenses in the source jar for the mchange-commons-java library? Please let me know if you need any details. Thanks !

The following files have a GPL license header right after your standard header:

1. IOByteArrayEnumeration.java
2. IOByteArrayMap.java
3. IOEnumeration.java

Is that intended or is it a leftover from a former license change? As there is no explanation it is unclear which license is valid. If it is GPL for these 3 files the complete mchange-commons-java artifact would effectively become GPL, wouldn't it?

This is important for us (and likely others as well) as we cannot use GPL artifacts.
The removal of the GPL headers or a clarification of the license would be great.