(trafficserver) branch master updated: Fix JSON-RPC request size check (#13430)

[bneradt]

This is an automated email from the ASF dual-hosted git repository.

bneradt pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficserver.git


The following commit(s) were added to refs/heads/master by this push:
     new 8940b43b9c Fix JSON-RPC request size check (#13430)
8940b43b9c is described below

commit 8940b43b9c28dee8a34d31f3247adadab9d87e51
Author: Brian Neradt <brian.ner...@gmail.com>
AuthorDate: Wed Jul 29 15:32:05 2026 -0500

    Fix JSON-RPC request size check (#13430)
    
    Unsigned subtraction can wrap after the JSON-RPC request buffer grows
    past its configured maximum. This allows oversized requests to be
    accepted.
    
    This compares stored bytes directly with the limit and adds regression
    coverage for an oversized request.
    
    Fixes: #12312
---
 src/mgmt/rpc/server/IPCSocketServer.cc           | 2 +-
 src/mgmt/rpc/server/unit_tests/test_rpcserver.cc | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/mgmt/rpc/server/IPCSocketServer.cc 
b/src/mgmt/rpc/server/IPCSocketServer.cc
index 5063f90a59..e2b235650b 100644
--- a/src/mgmt/rpc/server/IPCSocketServer.cc
+++ b/src/mgmt/rpc/server/IPCSocketServer.cc
@@ -430,7 +430,7 @@ IPCSocketServer::Client::read_all(Buffer &bw) const
       return {false, swoc::bwprint(buff, "Peer disconnected. EOF")};
     }
     bw.save(ret);
-    if (_max_req_size - bw.stored() > 0) { // we can still read more.
+    if (bw.stored() < _max_req_size) { // we can still read more.
       using namespace std::chrono_literals;
       if (!this->poll_for_data(1ms)) {
         return {true, buff};
diff --git a/src/mgmt/rpc/server/unit_tests/test_rpcserver.cc 
b/src/mgmt/rpc/server/unit_tests/test_rpcserver.cc
index 9e686d64e1..c1146f43e6 100644
--- a/src/mgmt/rpc/server/unit_tests/test_rpcserver.cc
+++ b/src/mgmt/rpc/server/unit_tests/test_rpcserver.cc
@@ -559,6 +559,15 @@ TEST_CASE("Sending a message bigger than the internal 
server's buffer. 32000", "
       auto              resp = rpc_client.query(json);
       REQUIRE(resp == R"({"jsonrpc": "2.0", "result": {"size": "32000"}, "id": 
"32k_1"})");
     }());
+
+    const int oversized_message_size{64000};
+    auto      oversized_json{R"({"jsonrpc": "2.0", "method": 
"do_nothing32000", "params": {"msg":")" +
+                        random_string(oversized_message_size) + R"("}, 
"id":"over-limit"})"};
+    REQUIRE_NOTHROW([&]() {
+      ScopedLocalSocket rpc_client;
+      auto              resp = rpc_client.query(oversized_json);
+      REQUIRE(resp.empty());
+    }());
   }
   REQUIRE(rpc::test_remove_handler("do_nothing32000"));
 }