qqeasonchen opened a new pull request, #5372: URL: https://github.com/apache/eventmesh/pull/5372
## What this PR does Closes #5361 — Phase 1 of the production-HA plan (#5354), acceptance **A3**: the frame codec enforces wire bounds at BOTH boundaries and rejects malformed input **without OOM**. ### 1. The gap this fixes The codec accepted whatever sizes the header advertised. A hostile frame declaring `dataLen = 2^31-1` made the decoder allocate that much memory before failing on the truncated body (**OOM instead of a clean reject**); truncated buffers escaped as `BufferUnderflowException`. ### 2. New `FrameLimits` (`eventmesh-common/wire`) | Limit | Value | |---|---| | `MAX_FRAME_BYTES` | 16 MiB | | `MAX_DATA_BYTES` | 8 MiB | | `MAX_ATTRIBUTES` | 64 | | `MAX_ATTR_NAME_BYTES` | 256 B | | `MAX_ATTR_VALUE_BYTES` | 4 KiB | ### 3. Boundary enforcement - **Encode**: attribute count / data length / attr name+value lengths / total encoded size all fail fast — a producer cannot build an oversized frame. - **Decode**: advertised `keyCount`/`dataLen` rejected **before any allocation**; every buffer read (attribute length prefixes, string bodies, data bulk-get) guarded. `decode` is now **total**: any byte sequence either decodes or throws `IllegalArgumentException` — never underflow, never over-allocation. ### 4. Tests (new `FrameLimitsTest`, 8 cases) - 4 encode-bound rejects + **at-the-limit acceptance** (boundary is `>`) - Hostile `dataLen=Integer.MAX_VALUE` on a 64-byte buffer → clean `IllegalArgumentException`, no allocation - Hostile `keyCount`; `dataLen` beyond provided buffer - **Deterministic 20,000-iteration byte-mutation fuzz** — every mutant either decodes or throws `IllegalArgumentException` (the fuzz found and drove the fix for both underflow escapes during development) ### Verification (local, Temurin 21.0.11) ``` :eventmesh-common:test + checkstyle (maxWarnings=0) BUILD SUCCESSFUL downstream: runtime + architecture-guard + storage-api tests BUILD SUCCESSFUL ``` ### Relations - Closes #5361 (Phase 1, P0) — completes Phase 1 alongside #5359 (`b3f9f75b4`) and #5360 (`017843ef1`) - Parent: #5354 · Plan: `docs/architecture-review/production-ha-plan.md` (PR #5366) - Builds on the #5357 immutable frame (merged `7ac0ab824`) Co-authored-by: qqeasonchen <[email protected]> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
