git-hulk opened a new pull request, #3519:
URL: https://github.com/apache/kvrocks/pull/3519

   RESTORE loads intset contents from a length-prefixed RDB string. The parser 
checked IntSetHeaderSize + len * record_size using 32-bit arithmetic, so a 
large len could overflow the product and make a header-only intset appear 
correctly sized. It then entered the entry loop and read beyond the provided 
input.
   
   Before this patch, a RESTORE payload using int64 intset encoding and len 
0x20000000 timed out or terminated the server instead of returning a parse 
error. After this patch, the same payload returns "ERR invalid intset length," 
and the server continues to respond to PING.
   
   Validate the encoding before using it as a record size, compare the declared 
length with the remaining payload to ensure no overflow, and perform a bounds 
check before each record read.
   
   Assistant By GPT-5.5 HIGH


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to