netudima commented on code in PR #3655:
URL: https://github.com/apache/cassandra/pull/3655#discussion_r1858963478
##########
src/java/org/apache/cassandra/transport/CQLMessageHandler.java:
##########
@@ -182,6 +190,13 @@ protected boolean
processOneContainedMessage(ShareableBytes bytes, Limit endpoin
// max CQL message size defaults to 256mb, so should be safe to
downcast
int messageSize = Ints.checkedCast(header.bodySizeInBytes);
+ if (authMessageTooBig(messageSize))
Review Comment:
yes, I though about cases when a lot of parallel requests to consume a lot
of memory by authentication requests are issued as a kind of DoS attack +
usually the normal auth message size is not more than few KiB but probably I am
overprotective here :-) and having a limit to 1 frame for auth messages is
enough.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
