wwbmmm opened a new pull request, #3451:
URL: https://github.com/apache/brpc/pull/3451
### What problem does this PR solve?
Issue Number: resolve
Problem Summary:
The mcpack2pb parser trusts the item count stored in an mcpack array
header without validating it against the actual payload. The code
generated by the mcpack2pb protoc plugin uses this count to preallocate
memory for repeated protobuf fields via `Reserve()`. A malformed request
that declares a huge item count (e.g. `0x7fffffff`) can therefore make
the server preallocate about 16GB of virtual memory, which may crash the
process on memory-constrained hosts.
### What is changed and the side effects?
Changed:
- Cap `ArrayIterator::item_count()` by the remaining bytes of the array
in `mcpack2pb::ArrayIterator::init()`.
- Add unit tests covering huge and inconsistent item counts.
Side effects:
- Performance effects: none for well-formed input; the item count of a
well-formed array never exceeds the remaining bytes.
- Breaking backward compatibility: none. The item count returned for
malformed input is now clamped, but such input previously caused
incorrect large preallocations or parse failures anyway.
---
### Check List:
- Please make sure your changes are compilable.
- When providing us with a new feature, it is best to add related tests.
- Please follow [Contributor Covenant Code of
Conduct](https://github.com/apache/brpc/blob/master/CODE_OF_CONDUCT.md).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
