L1nq0 opened a new pull request, #109: URL: https://github.com/apache/dubbo-hessian-lite/pull/109
## What is the purpose of the change Cap the field count in a class definition against the remaining input; a truncated definition now fails as malformed input instead of exhausting memory on the allocation. Fixes #108 ## Problem readObjectDefinition takes the field count at face value: both arrays are sized from it on the spot, the field names are read afterwards, and nothing measures the count against the bytes the stream actually holds. A short stream carrying a huge count therefore turns into a huge allocation request, and readObject fails with OutOfMemoryError before a single field name has been read. Reproducer streams are in the issue. ## Solution Right after readInt, the count is compared against the bytes the input still has: the parser's buffered remainder plus the underlying stream's available count, summed as a long so the int field count cannot overflow the comparison. For buffer-backed inputs, the common case, this is the exact remaining length. On a live socket the available count covers only the bytes that have arrived, making the sum a lower bound; dubbo decodes request bodies after they are fully buffered, which is where this input comes from. A count above the bound is rejected on the same error path as other malformed input, before either allocation. The check runs once per class definition, not per field. java-8-test gains the issue's reproducer plus a boundary test proving a count exactly at the bound is accepted and proceeds into field reading. The full module suite passes locally, with the fix built from source. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
