mirror of https://github.com/apache/cassandra
251b0e9b91
A 32-bit length field read from the wire by CBUtil.readValue (and its siblings) flowed directly into new byte[length] with no upper bound, allowing an unauthenticated client to drive the JVM into OutOfMemoryError: 'Requested array size exceeds VM limit' — and, with the default -XX:OnOutOfMemoryError=kill -9 %p, terminate the process — by declaring Integer.MAX_VALUE as the SASL-token length in AUTH_RESPONSE. Guard the allocation in the single private readRawBytes(ByteBuf, int) that all int32-length readers funnel through, rejecting lengths that exceed the buffer's readable bytes with a ProtocolException. patch by Francisco Guerrero; reviewed by Stefan Miklosovic for CASSANDRA-21521 |
||
|---|---|---|
| .. | ||
| anttasks/org/apache/cassandra/anttasks | ||
| bin | ||
| burn/org/apache/cassandra | ||
| conf | ||
| data | ||
| distributed/org/apache/cassandra | ||
| long/org/apache/cassandra | ||
| memory/org/apache/cassandra/db/compaction | ||
| microbench/org/apache/cassandra/test/microbench | ||
| resources | ||
| unit/org | ||