cassandra

History

Francisco Guerrero 251b0e9b91 Bound declared value length against readable bytes in CBUtil A 32-bit length field read from the wire by CBUtil.readValue (and its siblings) flowed directly into new byte[length] with no upper bound, allowing an unauthenticated client to drive the JVM into OutOfMemoryError: 'Requested array size exceeds VM limit' — and, with the default -XX:OnOutOfMemoryError=kill -9 %p, terminate the process — by declaring Integer.MAX_VALUE as the SASL-token length in AUTH_RESPONSE. Guard the allocation in the single private readRawBytes(ByteBuf, int) that all int32-length readers funnel through, rejecting lengths that exceed the buffer's readable bytes with a ProtocolException. patch by Francisco Guerrero; reviewed by Stefan Miklosovic for CASSANDRA-21521	2026-07-27 09:51:36 -05:00
..
cassandra	Bound declared value length against readable bytes in CBUtil	2026-07-27 09:51:36 -05:00

Francisco Guerrero 251b0e9b91 Bound declared value length against readable bytes in CBUtil

A 32-bit length field read from the wire by CBUtil.readValue (and its
siblings) flowed directly into new byte[length] with no upper bound,
allowing an unauthenticated client to drive the JVM into
OutOfMemoryError: 'Requested array size exceeds VM limit' — and, with
the default -XX:OnOutOfMemoryError=kill -9 %p, terminate the process —
by declaring Integer.MAX_VALUE as the SASL-token length in AUTH_RESPONSE.

Guard the allocation in the single private readRawBytes(ByteBuf, int)
that all int32-length readers funnel through, rejecting lengths that
exceed the buffer's readable bytes with a ProtocolException.

patch by Francisco Guerrero; reviewed by Stefan Miklosovic for CASSANDRA-21521

2026-07-27 09:51:36 -05:00

cassandra

Bound declared value length against readable bytes in CBUtil

2026-07-27 09:51:36 -05:00