Francisco Guerrero 251b0e9b91 Bound declared value length against readable bytes in CBUtil ... A 32-bit length field read from the wire by CBUtil.readValue (and its siblings) flowed directly into new byte[length] with no upper bound, allowing an unauthenticated client to drive the JVM into OutOfMemoryError: 'Requested array size exceeds VM limit' — and, with the default -XX:OnOutOfMemoryError=kill -9 %p, terminate the process — by declaring Integer.MAX_VALUE as the SASL-token length in AUTH_RESPONSE. Guard the allocation in the single private readRawBytes(ByteBuf, int) that all int32-length readers funnel through, rejecting lengths that exceed the buffer's readable bytes with a ProtocolException. patch by Francisco Guerrero; reviewed by Stefan Miklosovic for CASSANDRA-21521		2026-07-27 09:51:36 -05:00
..
apache/cassandra	Bound declared value length against readable bytes in CBUtil	2026-07-27 09:51:36 -05:00
quicktheories/impl	Fix few types issues and implement types compatibility tests	2024-04-18 12:33:52 +02:00