git-hulk opened a new pull request, #3550: URL: https://github.com/apache/kvrocks/pull/3550
The RDB load path sized buffers from an attacker-declared 64-bit length before checking the stream actually holds that many bytes. A write-level client could send a `RESTORE` payload declaring a huge length and make the server allocate it up front and crash (OOM) — via both the plain string path (`read_string.resize(len)`) and the LZF path (`out_buf(len, 0)`). Add `RdbStream::EnsureRemainingBytes()` and validate every length that drives a read or allocation against the bytes still remaining in the stream, so a value can never be declared larger than the input that carries it. The LZF decompressed size may legitimately exceed the remaining stream, so it is additionally capped against `proto-max-bulk-len`. Add gocase regression tests for both the plain-string and LZF-encoded `RESTORE` payloads: the server now returns an error and stays up. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
