A 32-bit length field read from the wire by CBUtil.readValue (and its
siblings) flowed directly into new byte[length] with no upper bound,
allowing an unauthenticated client to drive the JVM into
OutOfMemoryError: 'Requested array size exceeds VM limit' — and, with
the default -XX:OnOutOfMemoryError=kill -9 %p, terminate the process —
by declaring Integer.MAX_VALUE as the SASL-token length in AUTH_RESPONSE.
Guard the allocation in the single private readRawBytes(ByteBuf, int)
that all int32-length readers funnel through, rejecting lengths that
exceed the buffer's readable bytes with a ProtocolException.
patch by Francisco Guerrero; reviewed by Stefan Miklosovic for CASSANDRA-21521
Cassandra resolves pluggable extensions by class name from configuration, schema, and tooling
inputs. These names were loaded with an initializing Class.forName(name) and type-checked only
afterward, so the named class ran its static initializer before its type was confirmed. After this
change such classes will be loaded without initialization, verified against the expected interface or
base class, and initialized only through normal use after validation.
A shared FBUtilities.classForNameWithoutInitialization helper and typed
instanceOrConstruct/construct overloads apply this to the configurable extension points loaded by
class name: the authentication, authorization, role-management, network and
internode-authenticator backends, the partitioner, audit logger, configuration loader, seed provider,
snitch, abstract types, secondary and custom indexes, compaction strategy, compressor, replication
strategy, SASI analyzers, key and cache providers, query handler, storage and stream hooks, tracing,
the JMX authorization proxy, MBeans, the monotonic clock, nodetool Sjk, triggers, the
sstableloader and stress class options, and diagnostic event classes (loaded without initialization
and checked against DiagnosticEvent, preserving the InvalidClassException contract and the existing
package restriction).
Regression tests confirm that an invalid-type load is rejected without initializing the target
class, and that valid implementations still resolve.
Hadoop client integration and hard-coded JDK and internal class probes are left unchanged.
patch by Jeremiah Jordan; reviewed by Stefan Miklosovic for CASSANDRA-21525
Adds missing @Test annotations to testPasswordUpdateRateLimiting and testPasswordUpdateRateLimitingDisabled.
Also fixes minor typos in comments and assertion strings.
Fix flaky CassandraRoleManagerTest by grouping per-role rate limit checks consecutively.
patch by Arvind Kandpal; reviewed by Stefan Miklosovic, Michael Semb Wever for CASSANDRA-21262
When BTreeRow.merge reconciles an update into a row whose existing deletion
shadows the update's cells, it filtered the update (incoming) side of the merge
with Reconciler.retain, which records the removal via
PostReconciliationFunction.delete. On the memtable write path that subtracts the
shadowed cells' on-heap size from the allocator's ownership even though that
incoming data was never allocated to the memtable. Under overwrite/delete churn
that re-applies cells already covered by a newer row/partition deletion (e.g.
repair re-streaming), the allocator's "owns" counter drifts negative and the next
flush trips "AssertionError: Negative released" in MemtablePool$SubPool.released
via MemtableAllocator$SubAllocator.releaseAll during discard.
Filter the update (incoming) side with a non-recording variant,
Reconciler.removeShadowed, and keep retain() for the existing side,
whose data the memtable already owns. The filtered result is identical; only the
erroneous accounting notification is dropped. This mirrors the already-correct
complex-column path in ColumnData.merge.
patch by Stefan Miklosovic; reviewed by Dmitry Konstantinov for CASSANDRA-21469
Assisted-By: Claude Opus 4.8 <noreply@anthropic.com>
CASSANDRA-21342: Long-tail xref follow-up (cassandra-4.1 subset)
Forward-merge of the cassandra-4.0 long-tail subset onto cassandra-4.1.
Same three files, same six edits as the 4.0 commit.
patch by Patrick McFadin; reviewed by Mick Semb Wever for CASSANDRA-21342
Subset of the trunk long-tail xref follow-up (commit cc97ee5332)
applicable to cassandra-4.0. Three files have broken patterns that
still apply on this branch after PR #4807's forward-merge: the
architecture index, finding_nodes, and use_tools self-page xrefs.
Six edits total. Mechanical retargets only; no prose was rewritten.
Edits omitted (trunk-only):
* Twenty files introduced in 5.0 or later (developing/cql/, reference/
cql-commands/, managing/operating/, etc).
* use_tools.adoc edits 4 and 5 (different line state on 4.x;
packet-capture anchor section structure differs).
patch by Patrick McFadin; reviewed by Mick Semb Wever for CASSANDRA-21342
The validation of snapshot names is turned off by default.
It is controlled by system property cassandra.snapshot.validation which is by default
set to false except 7.0 branch.
When the validation is turned on, the allowed characters are AWS safe characters together
with "+" character. A user can not specify any path separators in snapshot names even if
the validation as such is turned off.
patch by Stefan Miklosovic; reviewed by Francisco Guerrero, Matt Byrd for CASSANDRA-21389
patch by Andrés Beck-Ruiz, Runtian Liu; reviewed by Zhao Yang, Benedict Elliott Smith for CASSANDRA-21216
Co-authored-by: Runtian Liu <runtian@uber.com>
Forward-merge of the Phase 3 A2 fix from trunk (part of commit
32826fe563) to cassandra-4.0. Retargets the ROOT-nav and ROOT-index
Contact us xrefs from the removed master@_:ROOT:contactus.adoc page
to the existing master@_:ROOT:community.adoc.
The fix is applied as a direct edit rather than a cherry-pick: 4.0's
ROOT/nav.adoc has a different surrounding structure from trunk's (no
ifndef::local-build wrapper, no development sub-nav), so a clean
cherry-pick of the trunk patch is not possible. The net effect on
the targeted xrefs is identical.
patch by Patrick McFadin; reviewed by TBD for CASSANDRA-21342
Forward-merge of the Phase 3 A2 fix from trunk (part of commit
32826fe563) to cassandra-4.1. Retargets the ROOT-nav and ROOT-index
Contact us xrefs from the removed master@_:ROOT:contactus.adoc page
to the existing master@_:ROOT:community.adoc.
The fix is applied as a direct edit rather than a cherry-pick: 4.1's
ROOT/nav.adoc has a different surrounding structure from trunk's (no
ifndef::local-build wrapper, no development sub-nav), so a clean
cherry-pick of the trunk patch is not possible. The net effect on
the targeted xrefs is identical.
patch by Patrick McFadin; reviewed by TBD for CASSANDRA-21342
Stefan Miklosovic