git-hulk opened a new pull request, #3519: URL: https://github.com/apache/kvrocks/pull/3519
RESTORE loads intset contents from a length-prefixed RDB string. The parser checked IntSetHeaderSize + len * record_size using 32-bit arithmetic, so a large len could overflow the product and make a header-only intset appear correctly sized. It then entered the entry loop and read beyond the provided input. Before this patch, a RESTORE payload using int64 intset encoding and len 0x20000000 timed out or terminated the server instead of returning a parse error. After this patch, the same payload returns "ERR invalid intset length," and the server continues to respond to PING. Validate the encoding before using it as a record size, compare the declared length with the remaining payload to ensure no overflow, and perform a bounds check before each record read. Assistant By GPT-5.5 HIGH -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
