A 32-bit length field read from the wire by CBUtil.readValue (and its
siblings) flowed directly into new byte[length] with no upper bound,
allowing an unauthenticated client to drive the JVM into
OutOfMemoryError: 'Requested array size exceeds VM limit' — and, with
the default -XX:OnOutOfMemoryError=kill -9 %p, terminate the process —
by declaring Integer.MAX_VALUE as the SASL-token length in AUTH_RESPONSE.
Guard the allocation in the single private readRawBytes(ByteBuf, int)
that all int32-length readers funnel through, rejecting lengths that
exceed the buffer's readable bytes with a ProtocolException.
patch by Francisco Guerrero; reviewed by Stefan Miklosovic for CASSANDRA-21521
Cassandra resolves pluggable extensions by class name from configuration, schema, and tooling
inputs. These names were loaded with an initializing Class.forName(name) and type-checked only
afterward, so the named class ran its static initializer before its type was confirmed. After this
change such classes will be loaded without initialization, verified against the expected interface or
base class, and initialized only through normal use after validation.
A shared FBUtilities.classForNameWithoutInitialization helper and typed
instanceOrConstruct/construct overloads apply this to the configurable extension points loaded by
class name: the authentication, authorization, role-management, network and
internode-authenticator backends, the partitioner, audit logger, configuration loader, seed provider,
snitch, abstract types, secondary and custom indexes, compaction strategy, compressor, replication
strategy, SASI analyzers, key and cache providers, query handler, storage and stream hooks, tracing,
the JMX authorization proxy, MBeans, the monotonic clock, nodetool Sjk, triggers, the
sstableloader and stress class options, and diagnostic event classes (loaded without initialization
and checked against DiagnosticEvent, preserving the InvalidClassException contract and the existing
package restriction).
Regression tests confirm that an invalid-type load is rejected without initializing the target
class, and that valid implementations still resolve.
Hadoop client integration and hard-coded JDK and internal class probes are left unchanged.
patch by Jeremiah Jordan; reviewed by Stefan Miklosovic for CASSANDRA-21525
Several paths report on-heap allocation through UpdateFunction.onAllocatedOnHeap in a
way that diverges from the heap actually retained (BTree.sizeOnHeapOf), so the memtable's
owned-heap counter drifts. Five under/over-counting causes are fixed so that reported
allocation matches sizeOnHeapOf:
1) BTree.update over-counts on node split/overflow and never counts branch sizeMaps.
The Updater's running 'allocated' was not a true net delta: leaf drain() cleared the
source before subtracting it, the redistribute/overflow paths added new nodes without
releasing the source they replace, and branch sizeMaps were never counted.
Fix: account each node net - add every newly retained node's shallow heap (array plus
sizeMap) and subtract it for every replaced source, releasing before the source is
cleared; and record the root as the top builder's source so the old root is released too.
Test: BTreeUpdateHeapAccountingTest (randomized small / contiguous-block / overlapping /
height-4, coverage verified by JaCoCo).
2) BTreeRow.merge does not release a row's column tree when a row tombstone shadows its
cells: the retain branch rebuilds it smaller via BTree.transformAndFilter (node accounting
disabled) but never releases the freed structure. Fix: report sizeOnHeapOf(retained) -
sizeOnHeapOf(existing) when the filter shrinks the tree, as ColumnData.Reconciler.merge does.
3) BTreeRow.merge does not account the row's LivenessInfo/Deletion change (e.g. a tombstone
replacing a live row). Fix: account (reconciled liveness+deletion) - (existing liveness+deletion).
4) Allocation and release disagree on the branch sizeMap: allocation used sizeOfStructureOnHeap
(excludes it), release used sizeOnHeapOf (includes it). Fix: remove sizeOfStructureOnHeap and
use sizeOnHeapOf everywhere.
5) ColumnData.removeShadowed does not release a shadowed complex (collection) column's own
structure: it releases the inner cells via recordDeletion.delete but not the column's cell
tree (which can span multiple nodes) nor, when the column is dropped, its wrapper - both
counted as owned when written. Fix: report (EMPTY_SIZE + sizeOnHeapOf(tree)) after - before
(after is 0 when dropped); a no-op on the update side (recordDeletion == noOp), as required
by CASSANDRA-21469.
Tests for 2-5: PartitionRowAccountingTest.rowTombstoneOverExistingRowDoesNotInflateOwnership and
.rowTombstoneOverExistingCollectionDoesNotInflateOwnership require two logically identical
partitions reached via different merge paths to own exactly the same on-heap (only with all
fixes does it match); SetCellAccountingTest guards that a grow/reset op mix on a set<text>
column never drives the owned heap negative.
patch by Dmitry Konstantinov; reviewed by Caleb Rackliffe for CASSANDRA-21472
Adds missing @Test annotations to testPasswordUpdateRateLimiting and testPasswordUpdateRateLimitingDisabled.
Also fixes minor typos in comments and assertion strings.
Fix flaky CassandraRoleManagerTest by grouping per-role rate limit checks consecutively.
patch by Arvind Kandpal; reviewed by Stefan Miklosovic, Michael Semb Wever for CASSANDRA-21262
When BTreeRow.merge reconciles an update into a row whose existing deletion
shadows the update's cells, it filtered the update (incoming) side of the merge
with Reconciler.retain, which records the removal via
PostReconciliationFunction.delete. On the memtable write path that subtracts the
shadowed cells' on-heap size from the allocator's ownership even though that
incoming data was never allocated to the memtable. Under overwrite/delete churn
that re-applies cells already covered by a newer row/partition deletion (e.g.
repair re-streaming), the allocator's "owns" counter drifts negative and the next
flush trips "AssertionError: Negative released" in MemtablePool$SubPool.released
via MemtableAllocator$SubAllocator.releaseAll during discard.
Filter the update (incoming) side with a non-recording variant,
Reconciler.removeShadowed, and keep retain() for the existing side,
whose data the memtable already owns. The filtered result is identical; only the
erroneous accounting notification is dropped. This mirrors the already-correct
complex-column path in ColumnData.merge.
patch by Stefan Miklosovic; reviewed by Dmitry Konstantinov for CASSANDRA-21469
Assisted-By: Claude Opus 4.8 <noreply@anthropic.com>
Subset of the trunk long-tail xref follow-up (commit cc97ee5332)
applicable to cassandra-4.0. Three files have broken patterns that
still apply on this branch after PR #4807's forward-merge: the
architecture index, finding_nodes, and use_tools self-page xrefs.
Six edits total. Mechanical retargets only; no prose was rewritten.
Edits omitted (trunk-only):
* Twenty files introduced in 5.0 or later (developing/cql/, reference/
cql-commands/, managing/operating/, etc).
* use_tools.adoc edits 4 and 5 (different line state on 4.x;
packet-capture anchor section structure differs).
patch by Patrick McFadin; reviewed by Mick Semb Wever for CASSANDRA-21342
The validation of snapshot names is turned off by default.
It is controlled by system property cassandra.snapshot.validation which is by default
set to false except 7.0 branch.
When the validation is turned on, the allowed characters are AWS safe characters together
with "+" character. A user can not specify any path separators in snapshot names even if
the validation as such is turned off.
patch by Stefan Miklosovic; reviewed by Francisco Guerrero, Matt Byrd for CASSANDRA-21389
patch by Andrés Beck-Ruiz, Runtian Liu; reviewed by Zhao Yang, Benedict Elliott Smith for CASSANDRA-21216
Co-authored-by: Runtian Liu <runtian@uber.com>
Forward-merge of the Phase 3 A2 fix from trunk (part of commit
32826fe563) to cassandra-4.0. Retargets the ROOT-nav and ROOT-index
Contact us xrefs from the removed master@_:ROOT:contactus.adoc page
to the existing master@_:ROOT:community.adoc.
The fix is applied as a direct edit rather than a cherry-pick: 4.0's
ROOT/nav.adoc has a different surrounding structure from trunk's (no
ifndef::local-build wrapper, no development sub-nav), so a clean
cherry-pick of the trunk patch is not possible. The net effect on
the targeted xrefs is identical.
patch by Patrick McFadin; reviewed by TBD for CASSANDRA-21342
We can disable saving of the history either via command-line parameter --disable-history, or by setting disabled = True in the history section of the cqlshrc. Both options will read existing history, and just won't save new commands.
Update help and docs for cqlsh history.
Add startup info logline whenr history logging is enabled.
Add a fix for cqlshrc file path not correctly expanding.
Includes the Backport of
Allows users to change cqlsh history location using env variable
patch by Stefan Miklosovic; reviewed by Brandon Williams for CASSANDRA-17448
patch by Ekaterina Dimitrova; reviewed by Mick Semb Wever for CASSANDRA-XXX
Co-authored-by: Alex Ott alex.ott@datastax.com
Co-authored-by: Jaroslaw Grabowski jaroslaw.grabowski@datastax.com
Introduces property cassandra.role_password_update_interval_in_ms, with default value of 5000.
Logging added when passwords on roles are changed or are rate-limited.
patch by Mick Semb Wever; reviewed by Doug Rohrer, Jeremiah Jordan for CASSANDRA-21202
Converting collections or UDTs to raw bytes is nonsensical - it
allows reading raw serialized bytes which have no meaningful
interpretation.
patch by Mikołaj Diakowski; reviewed by Stefan Miklosovic, Brandon Williams for CASSANDRA-20982
Before the fix during a capacity extension BufferPoolAllocator returned to BufferPool a sliced ByteBuffer wrapper object instead of the originally allocated one, so the ByteBuffer was not recycled by BufferPool
Adjust BufferPoolAllocatorTest to test the ByteBuf capacity extension with a real BufferPool behavior
Patch by Dmitry Konstantinov; reviewed by Michael Semb Wever for CASSANDRA-20753
CASSANDRA-20389 implemented limit on table name length of 222
characters. This commit updates the documentation to reflect this.
It also adds an assert in CreateTableValidationTest to ensure that the
documented limit matches the actual constant.
patch by Ruslan Fomkin; reviewed by Brad Schoening, Dmitry Konstantinov for CASSANDRA-20914
Dmitry Konstantinov