Arawoof06 opened a new pull request, #1318: URL: https://github.com/apache/arrow-java/pull/1318
## What's Changed ArrowMessage.frame is the DoPut/DoExchange request marshaller, and for each FlightData field it allocates a buffer sized by a length prefix taken straight off the wire before reading any content, so a client can force an arbitrarily large allocation with a tiny frame (an unauthenticated denial of service during request deframing). The descriptor and header paths use `new byte[size]`, which allocates on the JVM heap and bypasses the BufferAllocator limit entirely. A field can never be longer than the bytes still buffered for the message, so `checkFieldLength` now rejects a negative or over-long size against `stream.available()` at all four allocation sites before anything is allocated. Concretely, a ~10-byte HEADER frame whose length prefix encodes `0x7FFFFFFF` drives a `new byte[2147483647]` (2 GiB) heap allocation before the subsequent read fails; with the check it is rejected in O(1) with no allocation. The added test asserts a field declaring more bytes than the frame contains is refused, and that a well-formed field still parses. Closes #1317. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
