LuciferYang opened a new pull request, #9618:
URL: https://github.com/apache/paimon/pull/9618
### Purpose
close #9617
`VideoFrameDescriptor.deserialize` validated the URI length by adding first:
```java
if (uriLength < 0 || buffer.remaining() < uriLength + 3 * Long.BYTES) {
throw invalidPayload("invalid URI length: " + uriLength);
}
```
For a `uriLength` near `Integer.MAX_VALUE` the addition wraps negative, the
comparison against `buffer.remaining()` is then false, and control reaches `new
byte[uriLength]`. A crafted descriptor therefore ends in `OutOfMemoryError`
from a 2GB allocation instead of the `IllegalArgumentException` every other
malformed case here produces. The bytes can come from the query:
`descriptor_to_string` and `descriptor_to_presigned_url` take `BINARY`
arguments.
The sibling `BlobDescriptor.deserialize`, which dispatches here by magic
number, already validates by subtraction and reports each case separately, so
this takes the same three checks:
```java
if (uriLength < 0) {
throw invalidPayload("negative URI length: " + uriLength);
}
if (uriLength > buffer.remaining()) {
throw invalidPayload("URI length exceeds data size");
}
if (buffer.remaining() - uriLength < 3 * Long.BYTES) {
throw invalidPayload("missing offset/length/frame index");
}
```
`buffer.remaining()` is non-negative and `uriLength` is known non-negative
by the time the subtraction runs, so nothing here can wrap. Three longs rather
than the sibling's two, since a video frame descriptor also carries the frame
index.
### Tests
`VideoFrameDescriptorTest.testRejectInvalidPayload` gains a case that
serializes a valid descriptor and overwrites its URI length field with
`Integer.MAX_VALUE - 23`, the smallest value whose old `+ 24` wrapped, then
asserts the rejection message. Building the payload from `serialize()` keeps
the test off the version and magic byte layout.
Against the unfixed code that case fails with `OutOfMemoryError: Java heap
space`, from the allocation the check was supposed to prevent.
`mvn -pl paimon-common -Dtest=VideoFrameDescriptorTest,BlobDescriptorTest
test` on JDK 8: 12 tests, 0 failures. `spotless:check` and `checkstyle:check`
on paimon-common are clean.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
